Transcript
if the industry as a whole isn't able to figure out how to solve for this, right, how to provide the right level of authentication, the right level of identity, if we don't handle the identity for AI agents quickly, this is going to become a catastrophic event. Hi, everybody. My name is Micah Spieler. I'm the chief product officer at StrikeGraph. At StrikeGraph, we're building an AI-native compliance platform, and as we've been layering in AI pretty much from day one, we've had to manage and take into consideration the sensitivity of our customers' data. We want to make sure that the agents that we're building have the right access to the right information, but in a secure and sensitive way. We know that if we can solve this, we can provide really robust and innovative tools for our customers so that they can manage their compliance programs better. In this new paradigm of enterprise agents and different AI agents, we're seeing pressures from all sides. Our competitors, our customers are building some of their own AI tools, and we want to make sure that we can continue to stay ahead, stay competitive. I think it's been really important for us to have tools that we can use that our engineering team especially can just implement right out of the box. We were able to take an idea like an MCP server and pretty much put it into production and have our customers start using it all within one sprint, and that was largely because that authentication layer was already in place. We could just connect into what we knew was really secure systems that Auth0 provides and just kind of get to the more important thing, which is figuring out how this system can actually provide value for our customers. At StrikeGraph, we're always investigating how we can bring AI to the compliance data that our customers trust us with. We have to slow down almost every conversation to make sure that we're treating that data with the right level of sensitivity and the right level of security. We've got Verify AI, which is one of our AI tools that actually reads every single piece of evidence that a customer uploads to ensure that it's meeting the requirements of the compliance framework. It's been really eye-opening for me to see how our customers are using our MCP servers. We're really lucky to have Auth0 as a way for us to quickly spin up the MCP server that we provided to our customers. Now that they have those tools in hand, they're showing us these cases that we never even thought of in the first place. It's been really incredible to see how that works. Recognizing that large language models and AI systems don't query data in the same way that humans do. It's not this one question, one answer kind of situation. They're making hundreds of API calls almost at once. When you start to pair that at scale with lots of other customers using their MCP tools to connect to their data, making sure that all of that can scale seamlessly and securely, it's been really important for us. Okta's blueprint around where, what, and how can agents interact with this information has been a good guiding post for us to really think about how we develop our own AI agents internally. All of our agents are built within our own ecosystem. So we don't rely on third parties. We want to make sure that we have full control over what these agents are doing. That means we can answer the question around what are they doing and where do they have access and what data do they have access to because we have that full control. This is really critical for establishing trust with customers because when they come to you and they ask a question about your AI agents, if you can't answer that quickly and concisely and confidently, they're going to see right through you. So for us, being able to follow that Okta blueprint and really thinking about how we can develop AI in a secure manner has allowed us to enter into those conversations with a ton of confidence, really build that trust with our customers. And at the end of the day, that just helps us build a better product. It helps us provide those delight moments that they're excited about and gets them excited about using AI also. A couple of things that I'm really watching right now are how we utilize smaller models and how models get more and more bespoke, trained to a specific task over time. I think we've all really benefited from these big frontier models that can handle almost any task with pretty decent accuracy. But what we've seen recently is that we can fine tune smaller models that run with a smaller footprint more affordably and with a higher level of accuracy on really specific tasks that then allow us to do much more exciting and innovative things a lot quicker and a lot more affordably. Chaining together multiple small models actually produces better results than relying on these big frontier models. All of a sudden, we're passing data around a lot more frequently. So we really have to think about how that data is secure and how we're using authentication to ensure that that data remains encrypted and is only accessed by the right AI agents. More and more, we're seeing our customers settling internally within their organizations on one or two providers. Because of this, I think MCP tooling in particular is going to become even more and more critical. But we have to be really thoughtful about how that data is protected because sooner or later, we're going to see a big data breach that was because an AI agent went rogue inside someone's system because it wasn't securely cordoned off, didn't have the right access controls in place, and that's just going to be a disaster. For folks who are just exploring how AI agents can work in their system, I think a really great place to start is just thinking through what information should this AI have access to and making sure you put that authentication layer in place first. What you don't want is for an AI to have access to information that it shouldn't and for you not to notice until something bad happens. And look at Auth0. Auth0 has authentication for AI agents. You can just turn that on and you can start to implement an MCP server and the authentication layer shouldn't be the biggest problem. So if you can get that out of the way in the beginning by understanding what your data model is, how those AI agents should access that data, I think you'll have a really great platform to just start experimenting. Thanks for watching. If you have any of your own agent eye-opener ideas, definitely drop them in the comments. I'd love to hear about them. And if you want to learn more about my story, click the link in the description to find out more.
