Your Agent Shouldn't Have Your Password
You Can't Secure AI With More AI
Show Your Work
Governance Is the Real Blocker
Building Safe AI Systems in Practice
Ari Shamash spent sixteen years at Google. For part of it he managed the Zanzibar team, which means he is a large part of the reason anyone outside Google knows Zanzibar exists: the paper came out on his watch, and it did not come easily. He is blunt about how the system got built. "It's not like we had a magic wand or some divine intuition. Standard engineering applies." A large problem, no idea how to solve it, lots of trials, most of them failures, and occasionally a nugget worth chasing. Jake pushes back that Google scale from day one is its own kind of magic, and Ari half concedes it: Spanner already existed, the data centers already existed, and clients like YouTube supplied constraints that were real rather than invented. The paper itself was the hard sell, and the hardest audience was the team. Writing it cost a lead engineer a year or two of wall-clock time that could have gone to features, scale or cost. Then came finding a lawyer technical enough to read it, and a handful of executives who all had to agree on the one question that mattered: how much to give away. Engineers wanted maximum detail. The company wanted minimum. He calls publishing it one of the best decisions the team ever made, and notes that Zanzibar may be the last big infrastructure paper Google has put out. On scale, the best story in the episode: someone misconfigured a load test and pointed it at production instead of staging, adding something like ten million QPS. "We didn't notice." Nobody got paged, nothing fell over, and the reward was an immediate question from capacity planning about why they were sitting on that much headroom. On adoption, there is no silver bullet and he refuses to pretend otherwise. No corporate mandate. They went and found teams whose authorization was actually hurting, spoke in those teams' vocabulary, and co-built the integration. A mentor's line stuck with him: "it is our job to walk a mile to save an inch for our customers." Then the turn. Fifteen years ago, when code started acting on our behalf, it was obvious that you did not hard-code your own username and password into a service, so the industry built service-to-service authorization and moved on. "I don't understand why in the AI world we think it's completely reasonable to say, here's my Amazon password, agent, go do whatever you want with it." His read is that we may be one disaster away from taking agent authorization seriously, and that every previous disruption, the browser, e-commerce, mobile, eventually circled back to the same basics. He closes an optimist, by way of Calvin and Hobbes: you find out how much a bridge holds by driving heavier trucks over it until it falls down. The point is not to avoid building. It is that the software industry, unlike every other engineering discipline, keeps skipping the part where you think about the support structure first.
Sohan Maheshwar is a developer advocate at AuthZed and the first in-house guest on the show. He has been in the industry about sixteen years, most of it in cloud, including the Amazon Alexa team from 2016 to 2018. He opens with a demo built on a MIDI keyboard: each key carries its own permission, so one user can play every note and another only an octave. The version he did not get around to building is authorizing only the keys in a scale, so you can mash the keyboard and everything you play is in key, because the unauthorized notes make no sound. The number he puts on slides: broken access control has topped the OWASP Top 10 for the last two lists, six years, and the most recent report found broken access control issues in 100% of the applications tested. "Not even 95, not 98, but literally every app tested." At a conference keynote in Amsterdam, a speaker told a thousand people that the way to secure AI is more LLMs, and got applause. Sohan's position is that LLMs are probabilistic, and access control is a place where working 99.5% of the time still means things go wrong. Jake calls it an algebra of determinism: mix a deterministic thing with a non-deterministic thing and the result is non-deterministic. For anyone building agentic RAG, the rule he repeats is "don't let the agent decide whether it needs authorization." Also in the episode: prompt injection landing more often in Portuguese or Hindi than in English; RAG is not old news, enterprises are only now adopting it; enterprises de-risking onto open-weight models after three months of turbulence; whether Python and JavaScript will read like Assyrian on papyrus in a museum ten years from now; and his bet that daily Claude Code use is costing him the ability to write code by hand. He puts himself firmly in the futurist camp, by way of Gutenberg: the scholars of the late 1400s who wrote that the printing press was the worst invention ever, because now the common person could read the sacred texts.
Taylor Dolezal has spent his career where infrastructure meets community: HashiCorp, then Head of Ecosystem at the CNCF, now Head of Open Source Software at Dosu. The cold open is his worry in one line. For months his commit history sat near zero, tens of commits a week. A device in his family room now shows the trailing thirty days: 2,700 commits. Over the same stretch, GitHub issues and discussions are measurably down. The code still lands. The reasoning behind it stops being written anywhere anyone can read. "My math teacher would always say, show your work, and now I understand why." Dosu's answer is a set of primitives. Notes are captured by hooks while you work a feature branch, and most get thrown away when the branch does. Topics are what notes compress into once a branch merges. Documents are the long-form layer, readable by people and by agents, that steers future work. Each has a lifetime: what the team did last week is worth a week or two, the company mission is worth a year or more. Jake asks whether agents working in a repo should be treated as users, coworkers, bots or service accounts. Taylor sorts them by the work, and service accounts are where he hesitates: "When I want to do something like just check Google is up, I want to see the HTTP 200 OK response. I don't want to spend tokens on that." Pull out whatever can be made deterministic, and keep the models for the rest. The bet he says might not pay off is locally hosted, open-weight models, small enough to own. Behind it: today's tokens are subsidized, and he is fearful of a future where "your $200 a month bill becomes 2,000, 20,000" and the capability goes with it. So he is crystallizing what he can while it is cheap. His CEO's line for it: rent the intelligence, keep the knowledge. Also in the episode: All Good, the iOS app he built to watch status pages across the frontier labs; tldraw shutting down pull requests altogether; the agentic bill of materials he wants to exist; whether left-pad-sized packages survive; where prose still gives the models away; and what he wants for Gen Alpha, which is arithmetic before the calculator. He puts himself at 75, maybe 80 percent optimistic, and says what the rest is.
Spencer Kimball has been building infrastructure for three decades. At Berkeley he co-created GIMP with Peter Mattis and handed it to the community in 1997. He went on to Google, then co-founded Cockroach Labs, where he's CEO. AuthZed runs on CockroachDB, so this one isn't abstract for us. Most of this conversation is about something Spencer built on paternity leave. Chitta, a Sanskrit and Pali term for the storehouse of memory and impressions that lead to action, is an AI memory system that distills dense sources into structured, queryable knowledge. The numbers are the interesting part: on Cockroach's Zendesk tickets, it produces a full root cause analysis 41% of the time from the customer's initial filing alone, in under a minute, for roughly $1.50. Opus without it lands around 10%. Humans almost never get there on the first pass. The lesson Spencer draws is that generic distillation doesn't work. The same source (a Zendesk ticket, a Git log, a source repository) has to be distilled with a purpose in mind. Reading code to add a feature and reading code to find a vulnerability produce different structures, because a human reading for those two purposes would pay attention to different things. We also get into MICA, the internal tool a departing engineer left behind that has produced thousands of applications in a few months; why Spencer thinks the cheapest database at scale wins the market; the dirty secret that operational databases run at 5–15% utilization; and what Cockroach is building to fix it. And because this is the base-layer, we spend time on the part nobody demos: governance. Pools of distilled intelligence inherit the permissions of their sources, or they should. Spencer's answer, that "governance is the ultimate blocker to AI adoption", is the reason this show exists.
Emilie Schario has had the kind of career that makes the rest of us re-evaluate ours: GitLab through its pre-IPO years, data at Netlify, strategist in residence at Amplify, founder of Turbine (acquired by Settle), and now co-founder and VP Engineering at Kilo Code, recently acquired by Anaconda. She joins Jake Moshenko to talk about what AI adoption actually looks like on the ground. Not the discourse, the practice. The conversation starts somewhere unexpected: a hair-care app she built for herself after her third kid, used for months, then threw away. She calls it selfieware: software with no users, no tracking, and no authorization, built because the cost of building finally dropped below the cost of caring. The best thing she ever built with AI was a thing she was able to discard. From there: why multi-model is inevitable (a chef doesn't use one knife for every task), what happens when benchmarks become training data, and why tying your tooling to a single lab's models is a bet you don't need to make. Then the part that lands closest to home for anyone thinking about authorization. Emilie runs two agents (Chad, personal; Snivel, for work) and holds a hard line between them: an agent gets internal data or external comms, never both. She arrives at agent identity, audit trails, and code provenance on her own terms, from the practitioner's side rather than the vendor's. Also discussed: whether AI spend is even the right metric (she proposes spend divided by PRs merged), the financial institution budgeting $13 per engineer per month, and why the biggest gap right now isn't capability. It's the long tail of people who haven't started yet.
Zac Smith has spent 25 years building the internet underneath the internet. He got into it in 2001 out of music school, hosting websites for musician friends, and ended up helping build the New York Internet Exchange back when moving bits cost $2,000 a megabit. He co-founded Packet, the bare metal cloud that made physical servers programmable, and sold it to Equinix for $335 million. Now he is CEO of Datum. His argument is that the internet needs an upgrade, for three reasons. Policy is fragmenting: the splinternet is real, and increasingly you need to control who you exchange traffic with and where. Data has stopped being centralized; we spent 25 years with smart servers and dumb clients, and now the clients are smart and the data is everywhere. And infrastructure has fragmented across dozens of providers, which makes your perimeter enormous. His answer is a private backbone for every application, built on SRv6, segment routing over IPv6, which lets you put policy into the header of the packet itself rather than letting the public internet decide where your traffic goes. The part that should make you uncomfortable is his answer to what AI is about to invalidate: the assumption that the computer your software runs on is safe. "I think you just can't trust pretty much any of your infrastructure." Design from there. We also get into a soccer club in Denmark he helped crowdfund out of bankruptcy and the open source media system he built for it; why the data center industry's instinct to hide behind a fence is a mistake; the security asymmetry where defenders are refused the AI tools attackers use freely; what happened to Intel and why Jensen Huang is determined not to repeat it; and what the Luddites were really fighting for, which was not the machines. Learn more about what Zac’s building at Datum: https://www.datum.net/ Want to contribute? Join Datum on Github: https://github.com/datum-cloud Check out AB Copenhagen on Github: https://github.com/AB-Copenhagen