The Video Signal

Topic

Governance

All digests tagged Governance

Agents Are Where Microservices Were in 2015 — Roberto Milev & Uday Kanagala, Navan thumbnail

· 19:28

Agents Are Where Microservices Were in 2015 — Roberto Milev & Uday Kanagala, Navan

The talk outlines that AI agents represent a paradigm shift comparable to microservices in 2015, requiring entirely new architectural patterns for reliable production deployment. Key areas of focus include managing agent statefulness (moving beyond stateless APIs), implementing advanced observability via hooks and traces, adopting skills as the primary unit of context, and establishing robust governance through guardrails at the policy layer. The industry is moving toward scoring non-deterministic trajectories rather than asserting fixed outputs.

Key takeaways

  1. Agents are Stateful by Nature 3:54

    Unlike traditional stateless API services, agents require persistent sessions and state management, necessitating specialized agentic runtimes (e.g., AWS Agent Core Runtime) [2:34].

  2. Skills as Context Unit 6:04

    To manage context effectively, the focus should be on treating 'skills'—which include instructions and tool execution logic—as pluggable units of work that allow for progressive disclosure of context [6:04].

  3. Observability via Hooks and Traces 7:16

    Because agents emit excessive thinking output, traditional logging fails. Operational reliability requires intercepting every step (pre-tool/post-tool, pre-decision/post-decision) to capture auto-traces, goals, reasoning, belief status, and confidence scores [7:16].

  4. Testing Non-Deterministic Systems 9:32

    Since agents are non-deterministic, testing must shift from asserting fixed outputs to scoring trajectories—evaluating the efficiency and completeness of the path taken toward a goal [9:32].

  5. Guardrails for Authorization 13:44

    The blurring line between an agent acting on behalf of a user versus using its own service account requires fine-grained authorization policies (guardrails) applied before and after every tool call to prevent sensitive data leakage [13:04].

Watch on YouTube Full article

IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork thumbnail

· 16:17

IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork

Enterprises are adopting autonomous AI agents as a 'second workforce,' shifting focus from model behavior to operational safety and governance. The core challenge is managing agents that possess tools, private data, and delegated authority. To mitigate risks—exemplified by incidents like the Replit breach and zero-click CVEs like EchoLeak—the architecture must implement robust identity standards and strict privilege separation, ensuring that planning (intent) is separated from execution (action).

Key takeaways

  1. Capability vs. Employment Readiness 1:48

    A working demo only proves capability; it does not prove employment readiness. An agent with a goal, tools, private data, and delegated authority acts as an 'actor,' requiring governance controls like identity, owner definition, policy scoping, and reliable revocation.

  2. The Need for Agent Identity Standards 4:08

    Current identity systems (like OAuth token exchange) provide the right shape but lack a dedicated agent identity standard. Agents require a defined lifecycle—provisioning, authorization, monitoring, and revocation—mirroring human employee management.

  3. Privilege Separation Architecture

    To ensure bounded authority, the system must separate trusted intent from untrusted content processing. The Planner turns authenticated intent into a typed, logged plan, while the Executor runs that plan without holding standing credentials, preventing actions outside the defined scope.

Watch on YouTube Full article

POC Prison: Why agentic systems never escape the lab and how to fix that in 90 days - Luise Freese thumbnail

· 56:48

POC Prison: Why agentic systems never escape the lab and how to fix that in 90 days - Luise Freese

The talk argues that most agentic AI systems fail to move from Proof-of-Concept (POC) to production because they are blocked not by model limitations, but by fundamental organizational and governance realities. The speaker proposes a structured, 90-day program focused on building the 'paved road'—an operational backbone—to ensure agents can run safely in messy, legacy enterprise environments with clear accountability.

Key takeaways

  1. The POC Prison Problem 17:05

    POCs are often temporary, unmeasured, and reversible experiments that fail because they lack a defined path to production ownership. This creates an 'AI zombie' state where the system exists but delivers no measurable value or transformation.

  2. The Three Pillars of Enterprise Readiness 24:10

    Successful deployment requires addressing technical, organizational, and cultural gaps. The biggest hurdles are unclear ownership (who owns it when it breaks?), lack of dedicated funding for operations, and a culture that rewards demos over deployment frequency.

  3. The 90-Day Transition Program 29:10

    To escape the POC prison, implement a structured 90-day program: (1) Document current reality (ugly processes/data); (2) Achieve commitment and accountability by selecting one initiative; (3) Deploy into real systems under supervision to build the paved road.

  4. Governance Must Be Code 38:20

    Compliance and governance cannot live in slide decks or meetings. They must be embedded directly into the delivery process (e.g., 'governance as code'), making rules executable, auditable, and non-negotiable.

Watch on YouTube Full article