← The Digital Executive
The Digital Executive
Rory Blundell: Who's Governing Your AI Agents? Probably No One. | Ep 1294
00:22:03
Loading summary
Transcript14 lines
- [00:01]
A
This episode is brought to you by Accenture. When your advertising operations fall out of sync, everything else follows. Spotify and Accenture are working together to reinvent the rhythm of ad sales using automation, analytics and smarter workflows to simplify campaign delivery and access better data across the business. The result? Less time spent on operations, more time connecting brands with the moments and fandoms that matter most. Learn more@accenture.com Spotify this episode is brought to you by Facebook. So you were scrolling on Marketplace and there it was, the bike you'd been searching for. You sent a message and it turned out the seller was super chatty, kind of funny, and an avid cyclist. The next thing you know, you're in a cycling crew. Well, a community cycling group. The thing about Facebook, you might find more than what you're looking for. From a browse to a bike ride. You can this summer find more on Facebook.
- [01:09]
B
Welcome to Corusant Technologies, home of the Digital Executive Podcast. Do you work in emerging tech? Working on something innovative? Maybe an entrepreneur? Apply to be a guest at www.corusant.com brand welcome to the Digital Executive. Today's guest is Rory Blundell. Rory Blundell is the Chief Executive Officer of Gravity, one of Europe's fastest growing companies and a leader in agentic, API and event management. He joined in March 2020 as the Chief Revenue Officer, becoming CEO in September 2020. Under his leadership, Gravity has grown from four people and a half a million dollars in revenue to over 180 employees and more than 40 million in revenue, earning recognition as a Gartner leader in API management. The platform delivers consistent security, discoverability and observability across APIs, event streams and AI agents serving organizations across Europe and North America, including Blue Yonder, Walmart, and Ernest and Young. Well, good afternoon Rory. Welcome to the show.
- [02:12]
C
Thank you for having me, Brian.
- [02:14]
B
Absolutely my friend. I appreciate it. And I know you took the time to traverse time zones and calendars to get here. Today you're hailing out of London, England and I know you do quite a bit of travel to the US as well. So I appreciate your time today. And Rory, jumping into your first question here, you joined Gravity as Chief Revenue Officer in March of 2020 and became CEO just six months later. Then scaled the company from four people and a half million dollars in revenue to over 180 employees and more than 40 million revenue. What was it like taking the top job in the middle of a pandemic at such an early stage company? And what conviction did you have about Gravity's mission that made you bet on it.
- [02:57]
C
Yeah, great question I had just taking the second point first, the conviction that I had was I so I got to know gravity by installing and using the software myself in actual fact, and I was just amazed at the capability this platform had. And I felt that the world at that time, back in 2020, 2021, was going through a. A shift probably not as seismic now looking back at it in retrospect, as the AI world that we're in at the moment. But it was still going through a significant change of people starting to adopt real time event based architectures. And what I saw with the company was the ability to pioneer an entirely new space of API and event stream management. So everything that we had done for the last 15 or 20 years with APIs, I thought, hang on a sec, you could do this with event streams as well. And to cut a long story short, this is we're trying to do the same thing again with agents as well in the agentic world. But that was really what sort of made me think, hey, I'm going to go and take a 50% pay cut, I'm going to go and join this company in the middle of a pandemic. And all the crazy decisions, frankly, in retrospect, when I look at it that I made it was because I had this fervent belief that we could achieve a lot more and that the foundations of the business were exceptionally strong.
- [04:19]
B
That's awesome. Love the story. And again, that's usually the first question here on the podcast is kind of that backstory. And you were from the get go early on, you were early user of the software, impressed by the capability, but the ability to pioneer event streaming with the platform really inspired you and your belief in the company where it was going to, even though it was during the pandemic and the next day to day, just nobody knew what was going to go on with the global economy. So I appreciate the backstory. Thank you. Rory, you've argued that governance frameworks built for the API economy are fundamentally insufficient for the agentic era, that traditional API management platforms are essentially blind to the unique behaviors and risks of AI agents. What specifically breaks down what when you point legacy API governance at autonomous agents?
- [05:10]
C
Well, I think, I think there's a number of things associated with this that are challenging really for when you look at the technology. The first thing is that agents operate at a fundamentally different speed than we would have had with APIs and things of that nature. And so it's less, I guess it's less that the foundations of an API gateway and things of that nature aren't necessarily. They're just not built and architected to be able to utilize those sorts of technologies. So if you've got mcp, for example, a fundamentally different protocol that one would use to be able to mediate agents communicating with tools, for example, now behind that tool might be an API fundamentally, but where. Where APIs themselves are maybe not best placed, and API gateways as a result of that, is that some of these subtle changes, the speed, the types of authentication, the granularity of authorization, authentic application, all these sorts of things, because the whole world, not just APIs and API management and API gateways, the whole world was architected around the human being, the central point of focus. And there is a seismic, subtle, but seismic shift that has changed that. No longer is it the human that's necessarily the sole center of gravity, excuse the pun, it's the. It's also now the agent. And that is a truly, truly differentiated thing that we've never really had to contend with, I would say any point that I can think of, certainly from a technological perspective, in the past. So it's less specifically that it's just, oh, these things, APIs, etcetera, bad, etcetera, or that they're a thing of the past, that that's not the case. They're still very, very widely used and still required. But it's just that the mechanisms and the speed and the authentication, the authorization, all of these sorts of things, the paradigms are fundamentally shifted. In the new agentic world versus the. Versus the human world.
- [07:12]
B
Absolutely. We're just seeing a major shift across the world in just about every vertical. And API is obviously at the forefront of that, in my opinion, as a prior developer. But agents are operating much faster, faster than we've ever seen. And we can't just rely on Legacy APIs for this new agentic world that we're moving into. And I appreciate you breaking that apart for us, and I like the pun there as well. Humans aren't that no longer the center of gravity? Right. That's awesome. Thank you. Rory, you've said that we're giving AI arms and legs. Would it be reckless not to give it a central nervous system too? Positioning gamma as a control layer that makes the agentic future safe to deploy. Unpack that metaphor for us. What does that central nervous system actually consist of technically? And why is a unified control plane better and bolting governance onto each tool?
- [08:09]
C
Yeah, it's a great, It's a great question. What's the best way to describe this. So let's imagine for example in the old world, let's say you've got a door, you've got a door into your office and your door has a keypad next to it and you've got your key card and you swipe your key card on the keypad. Now historically what you had to do is the keypad might have been tools like, I don't know, octa ping, things like this and the, the, the door might have been your API gateway. Now what you had to do is you had to stitch those two things together and it's very, it's challenging in a, in the modern world when things are operating with non human identities and stuff like that to actually to have to do all this stitching together. When you need to start looking at technologies like fine grained authorization, you need to really be able to look things like OAuth2 where you have more coarse grained permissions and all that sort of stuff don't really work when you've got humans and agents that act on behalf of the humans, which is quite a common thing that we're seeing these days. They call the on behalf of flow. Those two things alone add a layer of complexity that just talks to the fact that really this concept of having the keypad and the door separate, actually what gravity is bringing and our agent management, or gamma as you called it, Framework Enable gives you one platform where a single place, the first in the world that we've seen that you've got the keypad and the door in a single platform. Now so what that ultimately means, let me be fundamentally clear about it. I think that businesses have a governance crisis at this particular point in time. All the companies that we speak to have this governance crisis. The first thing is it's a combination of three things that we see and usually it's, it's multiple of these three things, but the first is they might not even have an enforcement layer. So let me make this point to you Brian, as a very, very seasoned and experienced executive yourself. If you were to go back 10 years and somebody say to you, hey Brian, I want to access one of your backend services directly, I don't really want to have to go through a gateway, I don't really want to have to go through any intermediary layer, I would hazard a guess that your reaction would be to jump out of your skin and say absolutely not. Now in the modern world people are doing effectively that with their agents, so they are not having that intermediary yet. Intermediary layer. And that to me is a, is something that's a massive, massive mistake. You need to have that layer in place because that's where you add the governance, that's where you add the controls, that's where you add things like the cost controls, for example, if you want people not to use so many tokens, if you want to be able to route between different models, if you want to be able to control which particular MCP service a particular agent should be able to use and governing that, using things like fine grained authorization. So that's the first problem. The second problem is that is the who, so as I said in the past used to have these keypads, the equivalent digital keypad next to your door. And that would be a ping or an octa or something like that. And that was fine when you had coarse grained, coarse grain and human based identities. But when you're working with agents that are acting on behalf of humans, that should have a subset of their capabilities and a subset of their permissions. Where do you, where do you store that? Where do you. Because it shouldn't be subsumed into the end application. And that's one of the challenges that people have had in the past. And they're starting to really have much bigger issues now when you go into the agentic world. And the third part is that those two things, even if you can address those two things, what agents and AI needs more than anything a lot of the time is context. It needs information to be like. Information is almost like the air of a fire, like it needs this fuel to be able to get going. And my belief is that those three things, when you look at gravity and the Gamma platform, what we bring in a single place is, is a way to be able to address all of these sorts of things. So with capabilities that we've introduced, like our new Daylight product, where you can force at the demon level traffic through the gateway. So that rather than people saying, oh, I'm just going to go around the gateway, or an agent going around the gateway, it goes through the gateway and therefore have your AI controls, your MCP controls, you have all your enforcement layer. And on top of that, because it's in the gateway, you can then use things like fine grained authorization and very, very fine grained controls to, to manage the permissioning and the scopes and all those sorts of things of your agents, both for your agent and your human identities, for APIs, for event streams and for the agents themselves. And the last thing is within gravity, you now have the ability to connect to third party repositories, whether it be vector databases and all these sorts of things, or whether it be actually storing it yourself in gravity so you can address all those three core things. That I do believe is the fundamental answer to the governance crisis people face today.
- [13:08]
B
Thank you. Lot to unpack there, but I appreciate it. I loved your, your metaphor, your, your API metaphor. The door on the key card, right, and the keypad. You talked about the complexity around its security agents now working on behalf of humans. But your platform Gamma is really integrating that keypad and door together into a single platform. And you talked about governance and security may not have an appropriate security layer. You talked through that, validating who has access and then that context that it needs in order to seamlessly make this secure. So I appreciate that. And the last question of the day, Rory, you've predicted that before long the same LLMs running in enterprise software will be running the machines on factory floors and in warehouses, with robotics not far behind. As you look five years out, maybe less, what does a fully governed agentic enterprise actually look like? And what has to be true technically, organizationally, and in terms of standards for organizations to scale AI agents with confidence rather than caution?
- [14:09]
C
That's a great question. It's a complex one. And what I fundamentally think the answer to this is that this is something I've been grappling with. I spent a lot of time recently unpacking a lot of the legislation that people are that legislatures, both in the Europe, in European Union, but also in the US different states are introducing AI legislation. So I've been looking a lot of this and fundamentally what I've concluded is that in order for people to have the confidence to be able to utilize and leverage AI to the right to its fullest, fullest extent, and to make the greatest economic gains that it could be, I do think you have to solve that governance crisis that I spoke about in the last, in the last point. But there's one additional point that I didn't necessarily talk about that I do think you need to be able to address that I don't think I've seen a good implementation of yet, which is this concept, a term that's probably bandied around, that I'm sure you've heard it a number of times, Brian, which is human in the loop. It's a very interesting concept. And when you look at the technical implementations at the moment, my view is what you really need is you need to first of all implement all of your AI ecosystem and your AI Infrastructure must go through a central point of governance and control. I think that is the starting point. I really strongly believe it must go through a central governance control point because unless you have that, you will have no mechanism to be able to control what happens. Now if you were to ask the average person on the street and say, okay, that's my starting point, what people are. And you look at a lot of the legislation and you, when you. I've spoken to people and interviewed them about this, I think what people want is a mechanism and a way for agents and humans to work in harmony. If you look at a lot of the reporting about this subject to the moment, what you find is it's almost a zero sum game when one loses, the other one wins and all that sort of stuff. And in actual fact what you need in order to what I think people want, which is this type of human in the loop type of interaction, you need to have that central point of governance control first. Once you've got that, what we've introduced for example with Gamma, is you can now bring your own model. So in the gateway, what we're now doing is classifying the stuff that comes through the gateway such that you can say, well at this particular point in time now you need a human to go and take the action and you can then have a very temporary entry into the fine grained authorization rule set or policy structure that basically says the next action that's taken must come from the human in the loop. Now the reason why this is important is it's very easy for organizations to generally have a set of yes, no rules, permit deny rules for a a finite set of very risky things. But what happens when it's not about a very, very risky thing? When you want a human to be able to guide an overall process to say, well this is the sort of thing I want the agent to be doing. No, it really needs to get my approval for this. You can't really do it. And this is where I think that having the central point of governance control, where you can do things like bringing your own model, you can then make classification decisions about should you do human in the loop, should you not? Do you have a portal to enable humans to be able to interact with it things of that nature. That from my perspective is what is critically important to be able to enable humans and agents to work in harmony. And that is what I spend so much time thinking about.
- [17:37]
B
That's awesome, thank you. And I'll just highlight a few things here. I definitely agree with you. There's a lot of AI legislation that is really starting to be at the forefront of every conversation Now. I've seen that local and national level of governments, as everybody wants to solve this governance issue. Right. I want to just highlight that human in a loop you talked about at the core of this. You talked about this AI development. The AI infrastructure must go through a centralized governance control. And at the end of the day, people want a framework that allows agents and humans to work in harmony. And I thought that was pretty interesting, for sure. And I see it in my everyday work life as well. So thank you, Rory. It was such a pleasure having you on today, and I look forward to speaking with you real soon.
- [18:20]
C
Thank you, Brian. It was a pleasure speaking with you. Have a lovely day.
- [18:24]
B
Bye for now.