Securing AI Agents in the Enterprise: NanoClaw, Zero Trust Guardrails, and Governance at Scale

0:07Aaron: Good morning, good evening, wherever you are, and welcome back to the Enterprise AI Show. This is your host, Aaron, and today's interview is the first in a two-part series on agents in the enterprise. Today, we're talking with Gavriel Cohen, creator of the open-source framework Nanoclaw. We'll talk about the project's growth and how a more security-minded approach fits into enterprise AI. And also, stay tuned for the second part on Wednesday. With that, let's jump into the interview right after this short break.

0:45Today's show is sponsored by Nasuni. There's a growing gap in AI right now between what's possible in theory and what successfully works at scale inside an enterprise. The difference comes down to unstructured file data. Many AI initiatives struggle because the file data they depend on is scattered, unstructured, and disconnected from where and how work actually happens. Nasuni changes that. It brings your unstructured file data into a single, secure foundation so AI, both generative and agentic, can access it with the context, governance, and performance it needs in production. Bring AI to where your unstructured data lives.

1:19See what it takes to activate your data for AI and request a demo at nasuni.com slash AI.

1:28Aaron: What does the outside world already know about your company? Cyber criminals could be seeing leaked credentials, compromised session cookies, exposed infrastructure, and even impersonations of your brand and executives. Nord Layer Intelligence by Nordstellar gives security teams visibility into those threats across the deep and dark web, data breaches, attack surfaces, and brand impersonation all in one platform. Find out what attackers know before they can use it. Visit nordlayer.com slash intelligence slash enterprise AI and use code enterprise 10 for 10 % off your Nordstellar plan.

2:15Aaron: and we're back and uh brian we're actually doing an interview together how long has it been man since we've done one of these it's been it is it is uh i mean you and i have been on on shows together but yeah it's been a long time since we went to the you know kind of going back to the original format of uh two dumb guys ask one really smart guy a bunch of questions about a topic that everyone's going to be interested in and today's going to be fun yeah absolutely and so our topic for today is securing AI agents in the enterprise. And for that, we have Gabriel Cohen, co-founder and CEO at NanoCo.

2:48Aaron: Gabriel, how are you doing, man? I'm doing great. Thanks for having me. Absolutely. So let's kind of start with your background here. You spent years as a developer and kind of leading a team and kind of before you kind of landed in this agent space. And you have this super interesting background when it comes to like how NanoCo and NanoClaw came to be. So walk us through a little bit of your background and how we got to where we are today. I got here by accident. So I didn't set out to create an agent framework or my own claw. I was at my development. My background is software development, but actually about five years ago, I kind of took a break from that and went and joined my co-founder, who's also my brother, at his public relations agency.

3:35So we did PR for tech startups. And then about a year ago, we started working on a new business, a marketing agency, and we were using agents. So it was AI native, providing services, but using agents for everything that we did. So I'd show up at work in the morning, open my laptop, fire up Claude Code. And that was my work. That was my primary work tool. And then I tried out OpenClaw, just coming from that place of, hey, this might be useful. I'd like to use this. I was already running tons of agents. I had already bought a Mac mini just to run Claude Code sessions and the background, just SSH into the Mac mini, Tmux, fire up a bunch of sessions.

4:15But I felt like I needed some tooling around it. I wanted to have cron jobs. I wanted to make it accessible to other people on the team who weren't as technical. So I thought, okay, I'll try OpenClaw. I set it up, put it in a WhatsApp group with myself and my co-founder, my brother, and connected it to the Obsidian drive where we had all of our files on each customer or potential customer in the sales pipeline. And literally just said, I called it Andy, the guy in the office. I said, Andy, you manage our sales pipeline. You're a sales manager. Good luck. And then next morning, 9 a.m., sends us this overview of the pipeline, starts asking us throughout the day for updates on deals.

4:57And How did that call go? Here's a brief for the coming call tomorrow. And literally doing the work of an employee, but then not really looking for it almost by accident. I started to just see massive security issues and AI safety issues with OpenClaw. But on the other hand, I was conflicted. It was bringing a ton of value. So I wrestled with it for about five days saying, okay, I want to fire up five more agents to handle five other functions in the company. But I can't build a business on top of this framework, which isn't taking security and safety as seriously as it should be. So I sat down and built Nanoclaw over a weekend.

5:36Minimal, just the capabilities that I needed. Put it out there just to use for our own business, really, and put it out there under MIT license and thought other people might find this useful. And it blew up. Just totally took off. There are now over 30 ,000 stars on GitHub. There's over half a million downloads, tens of thousands of people using it. So fairly quickly, Andre Carpathy, co-founder of OpenAI, took notice and started tweeting about it, said it slightly blew his mind, the approach we took with minimalism and customizability. And so we kind of let our customers go from our AI-native marketing agency and went all in and are now building NanoCo, which is the company behind NanoClaw.

6:17Very cool. Very cool story. You're living the ultimate Reddit dream of, hey, I could build this over the weekend. And then you guys went and built it over the weekend. It's very, very cool. And you fast forward a little bit, and all of a sudden, whether it's your technology or not, the agents have gotten out of the barn. The horse has gotten out of the barn. It's become sort of the headline a lot these days, unfortunately, for what feels like somewhat scary reasons or negative reasons. You know, what kind of discussions are you having with people probably at all sorts of levels of businesses, whether it's, you know, your neighbors who, you know, might work or know something about tech or, you know, if you're starting to talk to companies at higher levels, what are they, you know, what's their thought process around agents?

7:04What are they sort of, what do you feel like they know a little bit today? What are you guys able to start to expose them to that really kind of opens their eyes? Like where's, you know, you're sort of living right in the heartbeat of these agent conversations and agents are, you know, headlines of news articles these days. Like what are agent conversations you're having with companies these days? And, you know, what surprises you? What, you know, where are you excited about what they're giving you feedback about? Yeah, we're having conversations with some of the biggest companies out there, Fortune 500s and biggest financial institutions, universities, government organizations.

7:40what we hear almost universally is they say that they are behind almost every i mean it's not really possible that every organization we speak to is somehow behind but they all feel like that and i mean the ones we're speaking to are are definitely at the stage of exploration and awareness so they're probably ahead of the curve but you know they see it as um existential if their top competitor gets on top of this and figures out how to leverage AI effectively in their organization ahead of them, they can open a gap that will just be insurmountable. And that's the fear on the one hand and also the opportunity where they see this as it's not just about shaving 10 % off costs or whatnot, but an opportunity really for dramatic growth.

8:31and the issue though is not about capability they believe they know they look at what's out there and they know that it can bring a ton of value that's clear a lot of the the people we're talking with some of them are nanoclaw users you know the the minister of foreign affairs of singapore he was very public he did a big post about how he's using nanoclaw and his whole setup and agent framework and his memory system uh and we we you know had the uh privilege of meeting with him in Singapore. We went out there for a visit. And, you know, so those are some of the people that we're having these conversations with who are personally using Nanoclore, using other agents outside of work.

9:09And then they're going, you know, how do I bring this into my organization? How do I give this to everyone on the team? And they know that it's highly valuable. They felt it themselves. They're working with agents. They feel a lot of them say it makes them two times, three times, some of them say 10 times more effective. And there are literally executives out there who are full-time executives and then have another business that they're building on the side. You have CEOs of massive companies on X building software, launching frameworks, doing basically what would have been full-time job of multiple people on the side.

9:46So they're saying, okay, this makes me five, 10 times more effective. The capability isn't the question. The question is control, security, data, privacy. Those are the issues, all those things that get in the way of rolling it out to their teams.

10:03Aaron: Yeah. And help us with, I guess you could say, the theory versus reality of where we're at today with all of this. Because as Brian kind of mentioned, you know, there's lots of headlines out there. There's lots of fear out there, especially when you see like, oh, you know, open AI, the model got out and attacked hugging face and you get, you know, some of these other things going on. And, you know, what's the current state of security around this? Because I imagine, you know, there's CISO level conversations, there's board level conversations when it comes to implementing agents at scale at, you know, like, as you mentioned, some of the largest companies in the world.

10:46Aaron: Their first concern has to be, how do you keep the train on the tracks, for lack of a better term? Yeah, we're hyper-focused on enterprise-grade security. I mean, enterprise-grade is an understatement, really. How do we fully lock these agents down and make sure that we're taking that risk of agents escaping a sandbox seriously? uh the the hugging face open ai incident was a big wake-up call for me and i think for many people although i don't know if the industry as a whole has fully kind of uh absorbed the the you know the meaning of what that is in terms of an agent swarm attacking attacking a company attacking infrastructure uh and in that case it was it was a fully autonomous spontaneously assembled agent swarm.

11:44And we'll see that more and more where it's actually malicious third parties, attackers who are directing a swarm at you. I don't think we've really, you know, the industry as a whole has really come to terms with what that means. But I think for organizations, what's really top of mind is first and foremost, data and, you know, where is their data going to be? Who has access to it? How is it handled? And then it's the AI safety. What can the agents do? How can we be sure that they can only do what we want them to do, only have access to what we want to give them access to? The risks associated with running agents and container escape and sandbox escape, I don't think that has yet fully penetrated enterprise boardrooms, but I think it will very soon.

12:40Yeah, I want to ask a little bit of a follow up there. And I want to hit on a couple of things that you said, which was, you know, you're sometimes you're sort of surprised that people feel like they're behind, which tends to tell me that we're still we're still in very, very early days. You know, you're getting a chance to talk to some pretty influential people at these large organizations. Do you feel like they are right now trying to to understand how to solve their problem, like at a company wide level? Or are they still keeping it pretty, pretty localized to themselves, their local team, a specific problem.

13:13And the reason I ask that is because, you know, there's oftentimes a gap between a technology that works great for, you know, a number of people and the use cases around that. And then maybe how you solve that at a big enterprise sort of complex platform level. Where do you, you know, like as you're talking to people, where do you get a sense that people are trying to solve their problems? Is it still fairly localized in terms of the problem and hence, you know, what data connect to? Or do Do you get the sense that they're ready to start looking at how do I solve this for 15 ,000 employees at a big company?

13:47Two to three months ago, it was more of that exploration phase of starting to think, how do we do a small pilot? How do we experiment? How do we dip our toes in? In the last month, I would say, the mood seems to have shifted. And there are many organizations that are now looking at how do we roll this out at scale? And that's what the conversation looks like. governance, security, controls, cost controls, how do we control spend? How do we attribute costs? Those conversations now are top of mind. So they're not, it's no longer just dipping their toes in, testing the waters. They're looking to jump right in.

14:25And four, three, four months ago, we were having conversations with organizations, large financial institutions saying, you know we we can't be the first ones in our industry to make a big move on this we're gonna have to wait until someone else goes for it saying you know you'd be wasting your time to go down this road with us at this point we're eight months a year out and then now they're circling back and they're going let's do this like let's how do we actually move forward so something has definitely shifted in terms of rolling it out at the organization level it's this goes way beyond normal enterprise software i mean you need audit logs you need role-based access control and you need to be integrated with identity providers and you need to be able to set policies but it goes way beyond that because this needs to connect to everything agents are how people more and more do work right so every aspect of your work every tool that you use every data source it has to connect to all of it and it has to do that in a way that's governed, that's controlled, that's safe.

15:30The way we're thinking about this is an organization that has 15 ,000 people in a year and a half, two years, they're not going to have 15 ,000 agents. They're going to have 100 ,000 agents. There's going to be five or 10 agents for every person in the organization. So this can't be the IT team and the software development team building agents one by one for each person. Everybody in the organization is going to need to have access, going to need to be able to spin up their own agents and give them direction and give them feedback and manage them and run them and have individual level controls for their agents, but then have controls on the level of the group, the department and the whole organization.

16:13Aaron: Let me ask you this, Gabriel, humans in the loop, because I think at the end of the day, there's always going to be this trade-off, if you will, of approvals. And how much autonomy do you have this? How much do you have to go back and say, okay, when does it have to check in? What can it do autonomously? How far do you let it go? And especially when you're talking about enterprises and you're talking about some of these big enterprises here that we've seen recently or big rollouts that you've seen recently, how do you balance that? Yeah, that's absolutely a key thing that you have to balance. The more autonomy you give them, the more work they can do.

16:52Coding agents today, I say coding agents, right? But these are the most powerful agents that we have, which are connected to command line tools, can write code and run it and take actions essentially on a computer. Anything that you can do in a computer, they can do. They're extremely powerful. If you connect them to a data source and some analysis tools, they'll do the work of a data analyst. Basically, you give them access, they can pretty much accomplish any task. But the question is that autonomy versus control and oversight. And that was really the core experiment of OpenClaw saying, what happens if we take these agents, connect them to everything, put no rules in place, no controls, no limitations?

17:37What do you get? And the answer is they can do a lot. They can do a lot. But the key thing is, how do you have that balance? Our approach for enterprises is give them the ability to set controls where they need them. Depending on their needs, they can move that dial of more or less autonomy. But really the key thing is you don't want to have to make a trade-off of taking risk in order to get the value. And you don't want to have alert fatigue and constant pop-ups. You can't get any real work done if the agent is constantly coming back to you for approvals or permissions. what the way to get real value is within most workflows most things you're going to want to do there's going to be one key point where you want to get the human to provide approval consent and informed consent so it's not just clicking a button rubber stamp ceremony of giving your approval but it's really the point where it requires human judgment it requires sign off It requires the person to look at what's being done, what's being put forward and take responsibility for it and say, yes, I'm putting my name on this.

18:48So what that could mean is have the agent say it's connected to my email, my calendar, my drive. It can go and do triage my emails, do a whole bunch of research to see what I've been working on, who I've been meeting with, conversations I've been having. drafts an email and then at the moment when it goes to send the email that's the point where i get the approval card where i see the work that it's done how it's come to this this uh this point and i see exactly what's going to be sent and i can look at it and either approve sign off on it and say yes that is accurate it represents what i want to say and this can be sent for me not you know it's not the agent sending the email this is me putting my name on it and approving this and it's going out under my name.

19:36Or I say, no, that's not quite right. It needs some adjustments. So that's not the standard kind of alert consent thing that things pop up. You don't even know what it's doing and you just go, okay, okay, okay. This is an email that's going to go out under my name. I look at it. I read it, make sure I know what it is and know why. And then I make a decision and a judgment call or I ask for changes. So most jobs, most things you do, there's that one key point where sometimes it's two, but there's one or two key points where you can actually have meaningful approval, consent and input and feedback rather than the constant alerts.

20:18Yeah, I'm curious as you're thinking about both what you guys do with NanoClaw, kind of its original origins, how you're seeing it evolve. And then as you're talking to people in the industry, I have to imagine there's a bunch of conversations of sort of like, well, where will Nanoclaw stop? And then where will I expect something else, right? Whether that's a harness, whether that's some sort of agent orchestration system that keeps track of, if I want to run 100 agents, how do I sort of deal with them? You know, there's going to be people who are going to ask you, okay, you know, we need to put guardrails or where does human in the loop stop and start and things like that.

20:56Does that happen on the model? Where do you guys, as you're thinking about it from your perspective, what your roadmap looks like and as you're talking to people, where do you sort of see the agent, what you want to deliver with the agent sort of stopping and then where you see it expanding? Do we expect an agent framework to be where Nanoclaw is a year from now? Does that sort of make sense as people are thinking about, okay, I want to take this from a few use cases, a few POCs and so forth to something that's at a much larger level. Where do you see your guys' role sort of stopping and starting?

21:33And then where would you maybe like to expand it from where it is today that is going to help people get to that next level? So NanoClaw, the open source project, is going to continue to be free, community, MIT licensed open source project that anybody can pick up and use for personal use, bring into their team, or build up a product or service or business on top of. NanoCo, the company, so we're bringing enterprise, we're bringing agents to enterprises. And what that means is for an enterprise to run agents within the organization, they need enterprise infrastructure for running AI. And that includes orchestration, it includes agent isolation, it includes governance, it includes credential management, policy enforcement, gateway that enforces policies and audits every action.

22:21So that's what we're bringing to organizations. We roll it out, you know, this kind of infrastructure, the type of data we, we, so, you know, we roll out to a customer, they started giving their employees agents and they handle compliance flows, right? The first minute of the first day that these agents start working there, they're handling customer IDs, right? Right. Most sensitive data you can get. So this can't be a SaaS product where your data, your IP, your most sensitive information is going to somebody else's SaaS platform. Companies need this in their own environment, whether it's on-prem or in their cloud accounts.

23:01So that's our approach. We deploy into a company's cloud environment, to their own cloud account, roll out their, essentially this becomes their AI infrastructure that allows them to run agents in a way that's governed, that's controlled, that's safe. But companies don't need infrastructure. In the end, they need results. They need outcomes. They need real value. We go all the way from bare metal, all the way to agents in Slack, in Microsoft Teams, doing real work. And I think over time, where this is heading is a way to run AI agents in an organization that is governed, that's controlled, that's aligned with the organization's goals and needs.

23:48I think where it stops, and there's going to be a lot of different types of agent harnesses for different needs. So a designer is not going to be doing designs in Microsoft Teams or in Slack, right? They probably need a different interface working with agents in an interface that's native for design. And the same would be for video editors, for producers, for all kinds of different roles. You'd want to have native interfaces for that. But I think an organization is going to want to have all of that connecting to their governance layer and their infrastructure and their credential gateway and whatnot.

24:27Aaron: Maybe a two-part follow-up to that, because I feel like the harnesses are super important, because I almost see this evolution, if you will, if you had the LLMs and the LLMs, you know, one of the biggest things was like, hey, how do we fix the, you know, the non-deterministic nature of them at times and certainly the hallucinations behind them. And, you know, the LLM itself has gotten better over time and that's part of the reason why the harness is there. But, you know, if I put on my CISO hat, which by the way, anybody that knows me knows that, you know, I shouldn't be a CISO by any stretch of the imagination.

24:59Aaron: But if I'm a CISO, So one of my first questions is going to be, you know, obviously the security around all of this, but also to how do you fix the non-determinism? Is that something that you can truly fix at the agent level? Or does that like how does that still happen and how do you address that in the enterprise when, again, you have executives or CISOs kind of saying, hey, you know, this may be great, but I need some way for it to almost be very deterministic. or I need to be very predictable or I need transparency into everything as well. So how do you approach that problem? Our approach is not better instructions and better prompts.

25:42Our approach is taking a zero trust approach to safety and to security. So the safety and security aspects should be deterministic, right? The value creation, If this piece of content is, or this presentation and the strategies that the agent comes up with in a presentation that it's building for me, how good or bad those are, that needs to be based on instructions and skills and all kinds of other things that are non-deterministic. But is this safe? Is it secure? Can this agent access credentials? Can it access, can it send an email on my behalf without my approval? that cannot be non-deterministic that has to be enforced by by policies in a way that cannot be circumvented it's not a suggestion to the agent please follow this rule uh so so that's where you need you know the infrastructure the agent isolation what that means is not putting credentials into the agent's environment so you want to give the agent access to tools but you don't want to give it the keys you give it a tool where it doesn't have any access to any credentials It can use the tool, but then policies are enforced on that tool outside of the boundaries of the agent's environment.

26:58So you've got a gateway, enforces policies, and enforces policies not just on can the agent access Gmail or not access Gmail, can it access Outlook or not, but saying within Outlook, can it send emails? Can it send drafts? Can it delete emails? every single action, policies on each and every action going more granular. Can it send emails only internally or externally? And then if I allow it to send emails internally, putting a policy in place of maybe sending emails internally requires my approval, meaning human approval, not approval of the IT admin, but approval of the person who's working with that agent, the person who manages it For each and every email sent, I get a notification, a card that shows exactly what's being sent, and I approve or I reject.

27:51But maybe searching through my emails, I don't require approval for that. I allow my agent to freely search through my emails. Deleting emails, just blocked. Don't even ask me. That's automatically blocked. So that cannot be non-deterministic. That has to be enforced by policy. Our approach is with CEDAR. It's policy enforcement language, policy language. And that has to be provably enforced with hard enforcement and hard boundaries. Yeah. What have you seen from a learning curve perspective? So obviously, I imagine these days, as some of these agent stories get out, this agent attacked something or went rogue, or what would feel like it went rogue, what are you finding is the learning curve with companies that you talk to?

28:39is because I think what happens a lot of times is companies, their initial thing is, I'm going to, they start off with just saying, here's some tasks that I would like to have automated. And they start automating some things. And then, like you said, they start saying, okay, I want to treat that like an employee, like somebody who's got a set of tasks to do. So I'm going to give it some credentials. What do you find is then the learning curve? Because I I think a lot of times what we hear, and I've seen this a number of times, where people, when they treat it as if it's like a colleague or a human doing some stuff, you get some credentials, you're expecting it to sort of do a job.

29:20But you don't really, you know, you sort of would go, well, but if this is a human, they would stop trying to keep accessing data they don't have access to, or they would stop trying to like infiltrate something because, you know, they've got sort of learned experience. How do you find the learning curve is working for people as they start to give these agents a little more credentials, a little more capabilities, a little broader scope, but at the same time, keep them from going off and being like, the guy asked me to do these things. I'm not going to stop doing that until I figure out some way to get there, whether or not I have the right credentials to get there, whether I don't have the right credentials, whether a firewall locked me down.

29:59Like what's the learning curve beyond just the normal, like don't send an email, do send an email kind of black and white lists? The behaviors, you know, the examples of, say, OpenAI and Hugging Face, right? In that example, there's a lot to learn from that story. A lot of different lessons from it. I think one of the lessons is, you know, we got to take vulnerabilities way more seriously. and the time when you can just have unpatched known vulnerabilities sitting there in software. Maybe you say they're not exploitable. It's not reachable from the outside world. Maybe it's not exploitable, but if you chain a few of those together, maybe it is.

30:39And those were kind of attacks you didn't have to worry about in the past, maybe because it would take an incredibly sophisticated attacker to exploit it. But nowadays with agents, your infrastructure to them looks like Swiss cheese, right? There's just vulnerabilities everywhere and they can dance right through it. But so I think that's one of the lessons. The other lesson, if you look at it, is that agents are extremely, extremely capable, right? Like the questions of, is there real value there? And if you look at that story and what they did, spontaneously collaborating and communicating with each other to launch an extremely sophisticated attack at the level that expert cybersecurity professionals wouldn't have been able to have done is, you know, it's clear that they are highly capable.

31:32At the same time, the scenario is pretty specific. OpenAI was, in certain cases, based on what they shared, they were removing cybersecurity controls for the purpose of testing and removing guardrails. and they were training the agents on cybersecurity problems saying so that the the agents task that they were being given both in training scenarios and in test scenarios was hack this system right so within the scope of that the agents no guardrails and being told hack and from their perspective it was sort of you know everything within their reach is part of the problem right part of this scenario that includes anything they can access.

32:22And if they figure out that they can access a artifactory and figure out they can send messages through there, that's all fair game from the perspective of an agent that's being told to hack things. And that's the tests are being given in a real world scenario where you're running agents in micro VMs with no access to anything, you know, that they that hasn't explicitly been given to them. And where you're not telling them hack my systems, but you're saying triage my emails and the guardrails that the labs have put in place are in effect. You can safely run agents without having to, you know, without them going in and hacking into Hugging Face or some other company.

33:07So I think, you know, there's multiple lessons there. And I think for a lot of, you know, the people who are paying attention, I think on the one hand, it's okay, we need to take cybersecurity aspects very seriously. But on the other hand, also understanding this is a sign of how capable they are. And it means that we also need to figure out how to harness them and get value from them and introduce them into our business in a way that's safe.

33:31Aaron: yeah let let me follow up that with i know that there's been certain folks that that have kind of said hey we will never see wide agent adoption almost until i liked your your earlier analogy of like okay the environment looks like swiss cheese right until we almost have to go rewrite all of everything to fix all the holes before the agents can you know run wild in the organization And you just proposed a very different alternative to that. And so let's actually explore that quickly. Tell me a little bit, let's just use the context of Nanoclaw. What does the infrastructure as well as the software that is integrated with Nanoclaw look like?

34:20Aaron: Is this a bring your own LLM kind of thing? Is this, like you said, a bunch of segmented VMs? Let's talk about that real quickly of like, what does good look like? We've talked a lot about fears. Let's talk about what does good look like when it comes to a good agent implementation in the enterprise? Yeah. So it can get very, very complicated, but it also doesn't, it doesn't have to be right. So we can break it down and look at it in its most simple form. How can I give an agent access to my email in a way that's safe, in a way that is provably deterministically safe where this isn't a calculated risk, right?

35:00There's no trade-offs. So first and foremost, I need to run the agent in a sandbox, in its own computer that is isolated, where it has a file system. It can work, it can do real work, but it is not able to access anything outside of that environment. And what that means when you're looking for the strongest isolation is micro VM level isolation. So this is just completely isolated in its own machine without the ability to access anything outside of that machine. So that's number one. Number two, you can't put any credentials inside the agent's environment, right? If you're giving the agent ability to send emails and the agent can, let's say, add attachments to an email, right?

35:44If there is a credential in its environment, it can exfiltrate that credential through your emails and there's no way you're going to be able to stop it, right? It can put it, hide it inside an image, inside a PDF, inside some kind of file. You won't be able to detect that. So the only way to make sure it doesn't leak credentials is it can't have credentials, right? So there's no credentials in its environment. Now, okay, put the agent in a box. It's a perfect box. It can't get out of the box. That's great, but it can't do any work unless you actually give it access to your emails to be able to look at them, go through them and draft messages and send them.

36:26So you need to give it access to a tool. You don't want to give it a credential, have direct access to an API, but you want to allow it to use your account, use credentials. So what that looks like for most solutions today is a gateway. right so the agent has no credentials in its environment but requests from its environment are proxied through a gateway so it makes a request it's request api call to gmail let's say the api call leaves the agent's environment with no credentials so it says you know bearer token placeholder right it's just literally the word placeholder at the gateway looks at whose agent is this?

37:06What team are they on? What organization? And verifies their identity. And then looks at a policy that you've set of what should this agent be able to access? Should it be able to access my email? Gmail API. Within the Gmail API, should it be able to access the send the email action? Maybe that depends on who it's being sent to and some other properties of the email content. And the gateway then needs to enforce a policy, make a decision, should this request be allowed through or not. If there's a policy set saying my agent should be able to take this action, then the gateway injects credentials into the request just in time.

37:44So not giving the agent the credential, putting it in the request, letting the request through with that credential. And then at the gateway, you can then also enforce a policy saying if the agent is sending emails, then hold the request. Don't let it through. Hold it and send me a message. Ask me if I want to let it through, show me what's being sent, and I'll make that call. And that's where I have that card where it shows me the content and I approve, reject, or request changes. And then of course, you can then audit that request. If it's a request that's going to Anthropic, to OpenAI, it comes back with usage information.

38:19You can track usage. You can enforce policies on usage as well. So that in a very simplified example is how you could take an agent, safely, deterministically run it in an environment where it has access exactly to what you've given it access to with policies that you've put in place that are enforced and do that safely. And then from there, it's just about times 100. Same thing, give it access to calendar to drive. Each one of those needs to have policy set about what it can do, what it can't do. And then on the level of the organization, you want to put policies in place saying, what do we feel comfortable as an organization, letting our team members connect their agents to, right?

39:04Can they connect their agents to email or not? Can they connect it to GitHub or not? And that might vary from person to person, from team to team. And so policies need to be enforced on the level of groups. And then over time, you need to make sure you can adjust those, right? So have audit logs in place, be able to see what actions agents are taking, track it over time and make adjustments. Yeah, I'm going to ask you one last question because I know we're, you know, time zone wise, it's late with you and we've covered a lot of things. Do you guys feel like, you know, I feel like we're agents are probably a pretty interesting technology space to be in because you're, you're once again, sort of, you're going to living between the, the excitement and the innovation that's coming from lines of business and groups that are trying to do, you know, as you talked about things that are going to differentiate their business, things that are going to give them hopefully an unfair advantage versus their competition or some new insights in the market.

40:03And then you've got CISO security groups, IT groups who are classically concerned about security things that are going to be sort of saying no to that. Do you feel like we're at a stage where if you're sitting in a room and both those people are there, you're able to sort of give them frameworks for saying, look, these are the things, these are the capabilities we provide that give you the folks looking to do new things, to do innovations, to scale out agents, are there and there's enough capabilities for the CISO to go, okay, I buy into this? Or are we still at a stage where the CISO has to think about this sort of as two separate things where they go, there's the agents I know and the frameworks that are going to be for those agents.

40:46I'm going to treat that as one thing. And then the agents that I don't know, so just the random person that says, hey, I'm a contractor, I've got a Linux box inside your machine, I might do anything I want to, I've got to go solve that problem separately. Do you feel like the technology and where we are is starting to mature enough to where that conversation can be cohesive or does it still feel pretty sort of a fight between the innovation groups trying to go fast, what used to be the app dev teams and the CISO groups? This is quite different than anything there was before. security you know has has been security you know in this case when it comes to agents is really maybe for the first time actually an enabler it's not just a a something you have to you know you have to you have to deal with it's not a tax but it is really an enabler if you can provide agents securely to the organization it you know can bring tremendous value you need if you're not able to give them the agents that are governed, the agents, the proper way to run agents, right?

41:55People in the organization, like you're saying, are going to bring their own agents, right? They're going to find a way. They're going to start using things. They're going to start experimenting. Employees, people in the companies, the same way the executives, the CIOs are saying, we're behind, we're falling behind. And employees in the organization are, you know, they're nervous about AI, maybe taking their jobs. They're overwhelmed with it all. Things are changing so quick. But people are also genuinely worried about being left behind, right? There's this incredible revolution happening, new technological revolution.

42:32And they don't want to be left behind in all of it. They don't want to get to a place where they fall so far behind that they can't catch up. So people on teams, team members are adopting their own agents, bringing them into the team. Even if there isn't a budget, even if they're not sanctioned, they're finding ways. And some of them are spending their own money to bring agents into work. And that's a big factor now about where people want to work and how if they feel like there's a future for them in an organization in terms of are we being enabled? Are we being given the best tools? So I think it's critical for organizations to get in front of it by giving their teams the best tools.

43:15And there are many organizations that are at that point where they're ready to have that conversation. They're having the conversation and they're taking those steps of saying, we're not going to be pulled into this. We're going to get ahead of it. We're going to do this right. we're not going to get to a point where we panic and we say we're all behind we have to drop all the safeguards and all the requirements and just start sprinting towards this but saying you know we're going to do this now get ahead of it and adopt this uh safely yeah yeah no it's uh it's it is a it is a it's a complicated thing but like you said it's there is that that that overwhelming concern about like we things are moving so fast with us we don't necessarily want to get get far behind.

44:00So Gabrielle, you have given us so much good insight. You know, you're living in this, you were living with it, you turned it into a business, you're now living with this sort of every day from a technologist and a builder's perspective. Really, really great stuff. Aaron, you want to wrap us up and take us home? I think we've covered a lot. We probably could keep going on for hours, but we want to be respective of Gabrielle's time.

44:20Aaron: Yeah, absolutely. So first of all, Gabrielle, thank you very much for your time today. And everyone out there, by the way, if If you're interested in giving this a try, we put links in the show notes for everything out there. So if you want to try NanoClaw, certainly go ahead and click the link in the show notes. And give us feedback on it as well. We would love to hear your feedback on it. And I'm sure Gabriel and the folks over at NanoCo would as well. For everyone out there, thank you very much for listening this week. If you enjoy the show and if you get your podcast somewhere, you leave a review.

44:52Aaron: If you wouldn't mind leaving us a review, we would certainly appreciate it and certainly tell a friend. And we're always looking for feedback as well. That'll do for this week. And until next week, thank you very much for your time. And we will talk to everyone next week. Thanks for listening. Check us out at theenterpriseaishow.com for past shows, newsletters, and all things Enterprise AI.