Person
4 episodes · 44 quoted claims
Tim Crawford says users can give AI agents their own credentials so the agents act on their behalf, possibly outside the enterprise's visibility.
“Such that now we can give agents, and this kind of gets to Anthony's point about agency, we can give agents our credentials and have these agents do work on our behalf.”
Tim Crawford says many enterprise AI projects are kept small in scope to limit the blast radius of potential harm.
“Because that's the way that they protect themselves against exposing the blast radius and and potentially opening themselves up to, um, undue risk.”
Tim Crawford cites Moderna as the poster child of the debate over applying HR policies to AI agents.
“Moderna's the poster child of this, you know, should we be taking HR policies and applying it to agents”
Tim Crawford says super-agents can call sub-agents through an orchestration layer, requiring governance at each step.
“Now you have this concept of super agents that can go through an orchestration layer and call sub agents”
Tim Crawford names IBM's Granite, Amazon Web Services' Nova and Google's Gemini as models whose makers are building in safety measures.
“whether it's granite from IBM, Nova from AWS, Gemini from, uh, Google, for example, they are putting safety measures in the mix.”
Tim Crawford defines a red team as the attackers who simulate attacks, with blue teams building defenses and green teams working out fixes.
“a red team is the attackers, right? We're simulating those attacks and trying to understand kind of what's happening.”
Tim Crawford poses a thought experiment in which forced automatic patching would remove the ability to test patches before deployment.
“What happens if you have to take patches automatically? You no longer can do testing before you deploy it”
Tim Crawford says sophisticated agents are breaking APIs and websites that were not designed for their scale and speed.
“They're breaking APIs, they're breaking websites because they just weren't, they were not never designed for that kind of scale and that kind of speed.”
Tim Crawford says business processes span systems such as ServiceNow, Salesforce and SAP, each with its own governance layers that must be reconciled for agents.
“we might have some data in ServiceNow, we might have some data in Salesforce, we might have some data in SAP, and so each of those systems have their own governance layers.”
Tim Crawford defines value as opportunity minus cost when discussing how to measure the true value of AI.
“Value is an equation that is value equals opportunity minus cost, right?”
Tim Crawford says FinOps is extending its FOCUS framework to account for the true cost of AI, and that the TBM Council is also working on understanding IT value.
“Uh, FinOps is is working on versions of focus and their framework to be able to accommodate understanding the true AI cost.”
Tim Crawford wrote a post several years ago describing a three-legged race framework for how CIOs, IT teams and executives view IT.
“I wrote a post, uh, quite a while ago now, several years ago, talking about the three-legged race.”
Tim Crawford wrote a recent post describing two paths to AI success: AI that does not disrupt how people work, or AI wrapped in training.
“I wrote a post just recently and and kind of outlined that I'm finding two swim lanes of success.”
Tim Crawford said agentic AI governance now has to account for technologies such as MCP, agent-to-agent communication and ephemeral agents.
“you start thinking about MCP, you start thinking about a two A, you start thinking about ephemeral agents.”
Tim Crawford said data used by AI agents may sit in systems of record outside central repositories such as Snowflake or Databricks, each with its own governance.
“that data may not exist within a central repository like your Snowflake repository or Databricks or whatnot.”
Tim Crawford said a number of corporate AI councils are led by the CEO or another executive, not by the CIO.
“Some of those AI councils, in fact, a number of them, are not actually led by the CIO or head of IT, they're led by the CEO”
Tim Crawford defined value as opportunity or outcome minus cost and argued that leaders should discuss value, not cost.
“Value is opportunity or outcome minus cost, and the value is what moves the needle, not the cost.”
Tim Crawford said cybersecurity is a case where waiting for human review can be too slow, so automated action is needed.
“if you think about cybersecurity today, it is almost too slow in some functions to wait for a human to review a particular case”
Tim Crawford said AI has three horizons and that organizations are still in the first, which focuses on efficiency.
“there are three basic horizons or three fundamental horizons for AI. And we're still in this first horizon”
Tim Crawford invoked the Henry Ford adage that customers asked what they want would say faster horses, to argue for rethinking how businesses operate.
“it's the Henry Ford adage, right? If I ask customers what they want, they'd say faster horses.”
According to Tim Crawford's description of the IBM CEO study, only 25% of AI projects were believed by CEOs to be proving return on investment and only 16% were expected to scale.
“only 25% of the of AI projects, according to those CEOs in the study, um, they believe are proving out the ROI, and only 16% are actually going to scale.”
A recent MIT study on AI projects was widely quoted because of its dramatic failure figures, though Tim Crawford advises taking it with a grain of salt.
“you saw the MIT AI study, which a lot of folks want to quote because the numbers are so dramatic.”
Apptio, which belongs to IBM, along with the TBM Council and the FinOps Foundation, is working on understanding what AI and cloud efforts actually cost.
“companies like Apptio, um, from IBM and the TBM Council, they're trying to get their arms around this as much as even just the FinOps Foundation.”
Tim Crawford says IT began by focusing on business outcomes in the 1960s and later lost touch with them, creating a gap between IT and the business.
“I have a whole talk track on the anthropology of IT and how we started by focusing on business outcomes in the sixties, um, and we kinda lost track of that.”
Tim Crawford pointed to a separate MIT study about 'meek models' that looks at how smaller models compare with big ones.
“there's an interesting MIT study, different than the MIT AI study that talks about meek models, and so just probably just look for MIT meek models”
Tim Crawford said Amazon was asked not to bring more workloads into Ireland because of energy concerns.
“Amazon got asked not to not to, uh, bring more workloads into Ireland or something along those lines.”
Tim Crawford says communities hosting data centers are seeing their power costs rise.
“Communities that have data centers, they're seeing power costs go up.”
Tim Crawford observed that OpenAI, Oracle and Meta are pushing toward ever larger AI models, and he expects enterprises to shift toward smaller, more specific models.
“it's kind of crazy when you look at the whole OpenAI, Oracle, Meta, and they're just driving toward bigger, bigger, bigger.”
Tim Crawford cited a study saying six out of ten executives globally are expected to change roles within three years.
“six out of ten executives across the spectrum, so globally across the spectrum, are expected to change roles within the next three years.”
Tim Crawford told a group of executives that today is the slowest their company will ever operate, because pace of change will keep increasing.
“today is the slowest your company will ever operate. Think about that for a minute.”
Tim Crawford says that as an IT leader, his first relationships in a new organization were with the chief legal counsel and the head of audit.
“some of the first relationships that I built when I walked into a new organization were with my, um, chief legal counsel and head of audit.”
Tim Crawford described an organization where half the staff was outsourced and much of its innovation was being done by outsourced workers, which he called expensive and detrimental.
“I ran into one organization where half the organization was outsourced.”
Tim Crawford argues that a company seeking a chief AI officer or chief digital officer probably does not have the right CIO, and favors a VP of AI or VP of data instead.
“if you are looking at a chief AI officer or chief digital officer, CDO or CAI, oh, you probably don't have the right CIO.”
Tim Crawford says some organizations form cross-functional AI councils, led by the CIO or sometimes the CEO, to jointly handle prioritization, guardrails and costs.
“some organizations are putting together an AI council that can be driven maybe by the CIO, sometimes by the CEO of the company.”
Tim Crawford argues that people and CIOs who use AI will outperform those who do not, rather than AI itself directly replacing workers.
“AI is not directly going to take your job, but AI could take your job.”
Tim Crawford said he had just published a blog post on his blog about the CIO role moving from traditional to transformational.
“I just published, um, a blog post, um, talking a little bit about this last night on my blog on Avova dot com.”
Tim Crawford argues AI efforts should begin with business analysis rather than conventional systems analysis, to avoid simply refactoring existing systems for AI.
“too many people would go, Oh, okay. So I just apply my normal system process, take this the way the system was built, understand how the system was built, and refactor it for AI.”
Tim Crawford said that over 400 AI-related regulatory components were emerging across US states, about 40 of them in California.
“There's a lot of regulation that's coming about over 400, uh, components across just the US. states alone, something like 40 in California.”
Tim Crawford said OpenAI had begun sharing some of its models' reasoning, and he thought DeepSeek was driving that change.
“We just saw, um, OpenAI come out and start to share some of the reasoning, and I think DeepSeek is driving some of this.”
Tim Crawford said that data centers he has assessed were not as secure as their operators believed.
“Of all the data centers I have done assessments on, they are not as secure as you think they are.”