Person
1 episodes · 8 quoted claims
Ben Mayrides says much of an AI agent's reasoning is opaque and hard to reconstruct, and that existing observability controls do not integrate well with agentic architectures.
“a lot of agent reasoning is opaque, um, and it's difficult to sort of reconstruct those those elements as well, and we need that.”
Ben Mayrides says the ability to reconstruct agent actions is needed for compliance with regulations such as the EU AI Act.
“We need that for compliance reasons with things like the EU AI Act.”
Ben Mayrides says existing frameworks such as the EU AI Act and the NIST risk management framework are mainly organizational governance frameworks that do not go deep into technical controls for agents.
“the frameworks that are out there are predominantly organizational governance frameworks. So, when you think about the EU AI Act or the NIST, uh, risk management framework, again, they're great”
Ben Mayrides says that for agents, risk assessment must focus on what an agent can do, access and decide, rather than only on model security such as training data and data retention.
“in an agentic architecture, it's completely different, right? It is about what that agent can do, what it can access, what decisions it's making”
Ben Mayrides says answering five questions related to the AWARE framework gives security and business leaders shared success criteria and reduces gut-feel objections.
“if we can just answer these, let's say, 5 questions related to the aware framework, um, if we can agree on”
Ben Mayrides says on-device inference might slightly reduce the risk of data exfiltration but could cost visibility into and control over what an agent is doing.
“on-device inference, that's awesome. Uh, maybe, um, from the standpoint of it's going to maybe slightly reduce the risk of data exfiltration”
Ben Mayrides predicts SOC 2 will add control criteria for AI agents within about a year and a half to two years.
“I can see us seeing a control criteria in SOC 2 within, like, say, the next year and a half, 2 years, uh, we need to be ready for that.”
Ben Mayrides argues that applying the same level of governance to every agent will not scale, so risk processes should be tiered.
“if you're applying, you know, governance to, uh, the same level of governance and control to every agent or every AI system out there, your your governance, uh, capabilities are just they're gonna crumble”