Identity Decoded — Sean O’Dell TranscriptSean O’Dell:[00:00:00]
If you don’t bake identity in as a first directive into all things agentic, you’re missing the boat.
Rob Ainscough:
What do you see Identity’s role as in terms of securing the agentic revolution?
Sean O’Dell:
With agentic now and identity, it needs to be product-minded centric. It has to be. It isn’t a service owner, it isn’t a program, it is a product.
Sean O’Dell:
What do I do now? Pick one team, pick one use case, deliver one verified agentic identity. Do one. If you solve for a use case, you have a customer
Rob Ainscough:
Welcome today to Identity Decoded, coming live from Identiverse. I don’t know if you can say live for a recorded podcast, but live from Identiverse with the one and only Mr. Sean O’Dell, AKA Sean O’Dentity. Welcome.
Sean O’Dell:
Pleasure to be here.
Rob Ainscough:
Welcome. Good to have you here. So, today we’re gonna be talking about an under-talked about subject, right?
Rob Ainscough:
We’re gonna talk about agentic. I don’t think anyone’s talking about that right now, right?
Sean O’Dell:
No. It’s the biggest two-valent catchphrase float right now.
Rob Ainscough:
Yeah. I’ve literally been here a day and not seen it mentioned- … or talked about at all.
Sean O’Dell:
Nope.
Rob Ainscough:
Not at all. So we’re gonna dive into that though, right?
Rob Ainscough:
We’re gonna try and understand a bit about identity’s role in this agentic revolution. A little bit about how you start as well, right? It’s a big change for us as practitioners. It’s a big change that we need to understand, so we’re gonna dive into that.
Sean O’Dell:
Yep. Sound good? Let’s dive. Let’s do it. Awesome.
Rob Ainscough:
So to kick us off, tell us a bit about yourself, Sean, a bit about your background, a bit about you at Identiverse this year, and then we’ll go from there.
Sean O’Dell:
So, Sean O’Dell. I work for a large healthcare provider and retailer in charge of IAM, consumer, agentic identity, access security. background is very interesting. So, I’ve done healthcare, logistics, engineering, and the common principle was user needs access to things. I u- I also built, CMS sites, so it was very- Mm
Sean O’Dell:
like back in the dot net days, user principle dot something. So I was like, “Oh, this is kinda interesting.” Then they’re always like, “Can you build us a custom one?” And I’m like, “Sure. Why not? Let’s do it.” But it was always like, it was always about principle, identity, and context, and I was like, “Hmm, okay.” Then I figured out, I’m like, “I think I’m doing identity and access management?”
Sean O’Dell:
So the big break came when, when I got, when I got a certain gig and it was more like… It was, it was at, it was at The Walt Disney Company. And they’re like, “Hey, we need you to reverse engineer this thing, and it’s based on authorization, and just go built it.” And I’m like, “This could be fun.”
Rob Ainscough:
Nice. Ooh, yeah.
Sean O’Dell:
And then enter the world of do this well, you get a bigger plate. Then they put a plate under the bigger plate and give you more spaghetti. Then a bigger plate, and then you get meatballs, and you’re like, “Hey, that’s enough. Cry uncle.” And they’re like, “No, no, no.” I’m full. More. And it’s like, “You’re full? Just, give it an hour.”
Sean O’Dell:
“More food.” So, but it’s, it is the most intellectually complex space.
Rob Ainscough:
Yeah.
Sean O’Dell:
You never solve the same problem twice- Yeah … because of the, the range of you have vendor, you have integrations, you have design, and you have business, and a lot of the-
Rob Ainscough:
Mm …
Sean O’Dell:
a lot of what I’m seeing, and I’m gonna matriculate into, like, where I came from to where I see, I see it going now is- This, th-this isn’t an AI thing, this is just in general.
Sean O’Dell:
a lot of, a lot of companies want to hire well-rounded individuals. This isn’t “Oh, I’m a Java engineer.” That, that’s awesome- Yeah … there’s a place for that, but they want, they want product, they want context, they want business, they want engineering. If you have to interface with someone, they don’t want that anymore.
Sean O’Dell:
They want, they want you to be able to have the speak, the lingo, the jargon- Right … and then go execute. So it’s, it’s interesting. And in my current role where, where I’m at now, I love my leadership. They’re amazing. They, they give me full autonomy to go pitch, go do, go prototype, and go design and build, and it is, it is awesome.
Sean O’Dell:
So great. Wow.
Roy Akerman:
So great. It sounds, it sounds like it’s a product forward kind of job, right? You need to understand the business, you need to understand what it serves. Do you find some, differences between different types of your work on identity between the businesses, between the healthcare provider, the entertainment provider?
Roy Akerman:
huge differences, or by the end of the day, it’s the same pattern, the same technology?
Sean O’Dell:
It’s the same problems, it’s different scale and consequences, if you will. Mm. So the difference is in entertainment, you can’t watch something. In healthcare- Your pills don’t come out. No. you don’t get- Right … this thing done, right?
Sean O’Dell:
Most domains and industries still do not get traditional IAM right.
Roy Akerman:
Right.
Sean O’Dell:
So AI is squeezing that and compressing that timeframe into, what used to be years is now, I’m gonna say months- Mm … maybe weeks. ‘Cause every week you wake up and you’re like, “Oh, look, this thing happened. Yay, fantastic.”
Rob Ainscough:
Mm.
Sean O’Dell:
So it’s squeezing it more and more and close together, and you’re just like, we’re all chasing a bubble.
Sean O’Dell:
And it’s, it’s not when is it gonna pop, it’s like, “Hey, we keep squeezing the bubble.” Yeah. It’s going to burst.
Rob Ainscough:
Mm.
Sean O’Dell:
And it’s gonna be… It isn’t end of the world, Skynet come down and, like- Fuck
Roy Akerman:
it.
Sean O’Dell:
Yeah.
Roy Akerman:
Yeah. But, but I think-
Sean O’Dell:
A few years. Few
Roy Akerman:
years. Yeah, few years. But s- so there’s a big opportunity to fix what we already done- Yeah
Roy Akerman:
on a shaky ground. And there is a, there’s a, an opportunity to build right the next phase of problems that we need to deal with. Correct. Which brings us to agentic, which is what we’re trying to speak about today, right?
Rob Ainscough:
Yeah. For sure. So i- in terms of agentic, right, as you see it. So we’ve, we’ve talked about, you know, the challenges we’ve seen in the past a little bit there, and we’ll dive into them kind of further as we go.
Rob Ainscough:
But in terms of this agentic revolution, right, it’s unfolding before our eyes now. Not revolution?
Sean O’Dell:
No. You should trademark that. Ma- ma- make it a shirt.
Roy Akerman:
Yeah. That’s awesome. Rapid evolution. Yeah.
Rob Ainscough:
Rapid evolution. So in terms of agentic and identity, what do you see as the, the core thing that matters, right?
Rob Ainscough:
What do you see identity’s role as, in terms of securing the agentic revolution?
Sean O’Dell:
It, it’s a very nascent thing you just said because- Yeah … a lot of people still look at it tr- traditionally. And the way that you, the way you should shift the thinking overall is if you don’t bake identity in as a first directive into all things agentic-
Rob Ainscough:
Mm-hmm
Sean O’Dell:
you’re missing the boat because- Mm-hmm … identity is so core to inciting entitlement, security, intent, all the lovely buzzwords-
Rob Ainscough:
Yeah …
Sean O’Dell:
that everyone’s so quick to market that there’s a real sense of FOMO that I gotta- Yeah … I gotta build an agent. I got… is it, is it really an agent, or is it just, a workload?
Sean O’Dell:
Is it just a cron job? Do you just have this discrete task that have to happen?
Rob Ainscough:
Mm-hmm.
Sean O’Dell:
So even with that, with that being said- Baking an agent at, I’m gonna say at birth- Yeah … but at creation.
Rob Ainscough:
Yeah.
Sean O’Dell:
If you do that, it quantifies 80% of your problems downstream are solved, because a lot of, a lot of stuff that’s happening with, with agentic star, all the things-
Rob Ainscough:
Yep
Sean O’Dell:
if you don’t have provenance or verification at birth-
Rob Ainscough:
Yeah …
Sean O’Dell:
you don’t really know what’s legitimate and what’s not. And then separating that out between legitimate actors can still do bad things, like insider threat. Yep. But if you don’t have that bounds, y- you’re gonna spend a fortune trying to gate something with which has no gates.
Roy Akerman:
So, so let- let’s double-click on this one. there’s the bounds, there’s the guardrails, there’s the, borders that we’re trying to build around that. Yeah. But at the end of the day, the definition of agent and agent identity is like- Nebulous … vague.
Sean O’Dell:
Yeah.
Roy Akerman:
Because at birth it’s one thing, then it evolves, then it builds its own capabilities.
Roy Akerman:
Right. We have the consumers, like people who use it. Right. We have other agents that are using it. We have the tools that it uses. Yes. We have the plans, we have the reasoning. How can you define an identity of an agent, if at all? Or how can we build or construct a framework around the term identity when it comes to agents?
Roy Akerman:
I know that it’s a big question. Gee, go on. Let’s see. Let’s see how we’re dealing with it. You don’t
Sean O’Dell:
say. Should I pay you $20 tomorrow- …
Roy Akerman:
for the thing today?
Sean O’Dell:
No, just like
Roy Akerman:
taking notes. I’m gonna build something afterwards. Take my… I gotcha.
Sean O’Dell:
But, yeah. So I talked about this in a, a blog that I, I put out, and it’s, it’s of my own opinion, not of my employer.
Sean O’Dell:
It’s, it’s out of my, my, my crazy brain- … and my crazy hair. Identity is shifting, and I’m going… I promise I’m going somewhere with this. We’re smashing together the words governance, trust, identity, access, intents, authorization, mission, scope, scale, when in reality it’s you’re building a, a trust framework- Mm
Sean O’Dell:
but there’s so many domains that you’re, you’re literally, again- Meshing … love it, meshing it together. I think it’s less about identity right now, ’cause we’re all chasing, it’s, “Oh, what’s the identity of an agent?” It’s so ephemeral, we have no one, is it, is it a bill of materials?
Rob Ainscough:
Right.
Sean O’Dell:
Is it I’m, I’m a machine acting as a Kubernetes cluster or as an agent running in some cloud workload?
Sean O’Dell:
I’m more interested in agent identifiers.
Rob Ainscough:
Right. ‘
Sean O’Dell:
Cause if you have identifiers, you can class them into identities, right? So, I don’t like comparing non… Or I don’t like comparing machines or agents into humans because it’s, it’s like comparing steak and peanut butter, right?
Rob Ainscough:
Mm.
Sean O’Dell:
I love both, but I don’t want peanut butter for dinner.
Sean O’Dell:
I want steak for dinner ’cause steak in Vegas is chef’s kiss, right? So the identifiers means something because you have to have a stable identifier at birth.
Rob Ainscough:
Mm-hmm.
Sean O’Dell:
Social, social identifier number.
Rob Ainscough:
Yep.
Sean O’Dell:
Sim- similar concepts, right? But the difference between the natural progression of an agent and a human being is not much different.
Sean O’Dell:
So if I, if I go from kid to adole- to adolescence to professional, I’m still Sean with a social.
Rob Ainscough:
Yep.
Sean O’Dell:
But I’m playing the role of or playing a part, like Sean is a, Sean is a dad, Sean is a husband, Sean is a worker. So wh- when you, and your agents have identifiers. Your natural progression of what your agent is going to do should not change your
Rob Ainscough:
identifier.
Rob Ainscough:
Agree.
Sean O’Dell:
But it does change your identity asterisk- Interesting … star, dollar sign, tilde, like a lot of caveats to that. Mm. And again, this is very esoteric, very na- nascent, and we’re likely gonna get half this wrong and then be like, “Whoa, six months ago, what the heck were we thinking?” Right? But in, but in reality, you’re, the level of depth for identity and agent, there’s, there’s seven layers of the bean depth, if you will.
Sean O’Dell:
Mm. I was gonna use a different word but trying to be PC on, on, H-E double hockey sticks, right? But the seven layers of it, you have the identifier, then you have the authentication, then you have the, the transaction. Can’t use the word intent anymore or scope ’cause those are overloaded. Then you have the task, right?
Rob Ainscough:
Yeah.
Sean O’Dell:
Then you have the instance of the task. Mm-hmm. Then you have what I’m trying to do with it, and there’s, you’re gonna have to g- in order to have end-to-end assurance, you have to build identity, hear me out, in the beginning because you have auditors, you have governance, you have risk, you have s- you have legal.
Sean O’Dell:
You have so many things that if you don’t have a full trace of the whole thing-
Rob Ainscough:
Yeah …
Sean O’Dell:
how do you know what happened?
Rob Ainscough:
Yep.
Sean O’Dell:
Where does that start? At the door.
Rob Ainscough:
Yeah.
Sean O’Dell:
So you have to have verification and providence at the gate. Mm. And a lot of, a lot of big companies and a lot of big providers are like, “Yeah, we’re gonna handle that.”
Sean O’Dell:
And I’m like, “Cool. So less hand waving. let’s all work together because if, if company A and CSP, I’m sorry, if company A and cloud service provider B don’t unite on a standard-
Rob Ainscough:
Mm …
Sean O’Dell:
companies are going to, to build and, and host in different providers and platforms. It is the nature of a big company.
Rob Ainscough:
Yeah.
Sean O’Dell:
So how do I as a company know if I’m in A and B, how do I know that I’m r- my agents are registered in A and B? It’s like, this is using IDs one, two, three, four, five. This is using like a GUID. How the heck does that work? Mm. So what I’m teasing at here is Standards and interoperability- Yep … is key for this to work.
Roy Akerman:
I’ll just say one thing about this. So there’s the identifier, and then there’s a lot of, attributes that are being changed all the time. So, this identity is dynamic, right? Right. Continuous, identity, kind of definition. I get- Speaking
Sean O’Dell:
my language. Absolutely.
Roy Akerman:
I get this one. So I’ll try to stress the point about the collaborations that you’re calling out to.
Roy Akerman:
And of course, we’re missing standards, and we see the fights of building different standards. Let’s keep this aside for a second. Maybe we’ll have the time to talk about it. What is the number one… Please don’t say identifiers. What is the number one thing that you’re not getting from most of the providers today that you wish to have, that you wish they will sit together and will say, “Okay, this how you’re, like, start phase one.
Roy Akerman:
We’re still figuring out the rest, but here’s something to rely on”?
Sean O’Dell:
I won’t say identifier. Pick a standard to go off of for an identifier.
Roy Akerman:
A standard for identifier?
Sean O’Dell:
Yeah.
Roy Akerman:
Okay.
Sean O’Dell:
And, and what I’m getting at here is some use their own, some use JWT-based tokens, some use SPIFFE, some are gonna use WMSI, some are gonna use something proprietary.
Sean O’Dell:
Pick one or allow them all.
Rob Ainscough:
Yeah, no, I think something really interesting that I’ve seen, seen here and in my conversations before the conference is it’s really interesting. I’m seeing an increasing, variability in the products and, and technologies companies are using to bring agentic to life, right?
Rob Ainscough:
I’m seeing people backing multiple horses and multiple different horses in this, and it’s a really fragmented picture that we’re seeing emerge that is far from settled in terms of pattern. Yeah. And I didn’t, I didn’t see that until the last few weeks. It’s just increasing, I think, in terms of that fragmentation that we’re gonna have to deal with securing those identities on
Sean O’Dell:
top of.
Sean O’Dell:
It’s every day. Yeah. It’s every day. I’m like, I cry. I’m like, “Oh my gosh, another one,” right? This is like cloud 2.0.
Roy Akerman:
Agree. Totally agree.
Sean O’Dell:
They being providers are giving enough rope to say, “Here you go. Go forth and conquer.” But a lot of, a lot of the stuff being offered is, “Hit okay. Trust us What does that look like?
Sean O’Dell:
‘Cause if you peel back the layers of transparency, it, it’s consent-based security. And I’m not saying consent like on behalf of, a user agent. I’m saying consent-based like, “Yes, look at the agreement, look at the terms. You’re good to go. We’re secure.” But in reality, how do you know that what you’re entering in or doing is guarded the right way to only call what you want it to call?
Sean O’Dell:
So that’s a very nebulous term to say, “Please give us access and authorization.” That is the n- that is the next frontier, pun intended That is the hardest piece of agentic right now. The identifiers, we’ll figure it out. there’s, 10 things, I’m being… it’s, it’s a gross exaggeration, but that’s the easy part.
Sean O’Dell:
So then- Auth then identifier, check, check. It’ll happen …
Roy Akerman:
so identifiers and then points of control inside the reasoning before the execution- Got it … before the tools, things like that- Yeah,
Sean O’Dell:
yep …
Roy Akerman:
that will become a standard. So you n- you want to more fine grain control-
Sean O’Dell:
Correct …
Roy Akerman:
on that package that- Right … is about to execute a non-deterministic plan.
Sean O’Dell:
Correct. Okay, cool. But you need, the… You need prior authorization before you can go get the authorization because there’s, there’s so, there’s so much more to this than tech and standards. It’s, there’s financial ramifications here.
Rob Ainscough:
Yeah.
Sean O’Dell:
you need to know at the gate, and the gate meaning before you even hit an LLM, because then it’s like-
Roy Akerman:
Yep
Sean O’Dell:
spend. You have to know, hey, does it look right?
Roy Akerman:
So I, yeah, so I think our audience, and, and this is why we have Rob here, to keep it sane a little bit. They’re saying, yes, there’s a lot of misses piece- missing pieces. There’s a lot of gaps. What are we doing? nobody waits. Everybody are just, bringing tons of, bu- building tons of agents, bringing tons of, agentic solutions to their, organization.
Roy Akerman:
Let’s assume that only 50% of it is traditional software that agent build, and we’re calling this an agent, and it’s not, right? But the rest is flooding us, and we, we do need let people do their job, right? Yeah. We do have, do more with less and all of those things. So how do we start? Rob, we, we…
Roy Akerman:
A lot of people came to our booth. A lot of people are, came to speak with us about, “Okay, so what do I do first?” Yes, don’t, please don’t come back with, first you have visibility, then you have this, then you have that. Doesn’t work, doesn’t scale, and- Mm-hmm … please don’t say the other thing, AI agents will come and save us from the other AI agents, right?
Roy Akerman:
It won’t. It won’t.
Rob Ainscough:
Maybe one day.
Roy Akerman:
It will demolish you.
Rob Ainscough:
Maybe one day.
Sean O’Dell:
Spoiler alert that. You should add in, spoiler alert- … the agents cannot solve the agent… Oh, no. Exactly.
Rob Ainscough:
So I think it’s an interesting question. So I was, we hosted with the Identity Underground, so a great community that I’m part of, a breakfast at EIC recently.
Rob Ainscough:
and there was a really interesting discussion about this because I, I think there was a real split in the room from practitioner perspective of how to start and approach this problem. Yep. Because I think for some who are more mature in the traditional identity security, or IAM sense, had some building blocks, that they could rely on, and then work out what this meant for them and what they needed to do to grow that into this new use case.
Rob Ainscough:
Hmm. But then there were some who’d really struggled with The human world, the non-human world, right? And even getting a handle on that. And for them it was really like, “This problem is, too big an elephant to eat,” right? It is too big to break down. You
Sean O’Dell:
stole my analogy. Yeah. Exactly.
Rob Ainscough:
It’s good. It’s good.
Rob Ainscough:
It’s too big to break down. Yeah. And what I saw from there was this absolute paralysis.
Sean O’Dell:
Yep.
Rob Ainscough:
Right? And then there was a mix of companies here, right? So there was about a 50/50 split of, companies really working hard to put the right people together to adopt agentic responsibly- Yep … was usually the word attached, and then companies who were just adopting it.
Rob Ainscough:
And there was no correlation between that and their incoming maturity in terms of managing identity, and that presents a really interesting challenge for companies coming in, and it really made me think, and something I wanted to talk about today. So, if you’re not really at the bar already, right, if you’re struggling in the human world, you’re struggling in the non-human world, which plenty of companies are, and you might have already adopted agents, you probably don’t know where they are, like, where do we go with that?
Rob Ainscough:
Because, getting to a world of, short-lived credentials, blah, blah, blah, blah, blah, all this stuff, is a big jump from where they’re at. But how do we go about breaking the problem down? How do we go about starting? I think it’s an interesting question.
Sean O’Dell:
It’s a loaded question. Yes. How much time do we have?
Sean O’Dell:
I
Rob Ainscough:
don’t know.
Sean O’Dell:
So in, in, in reality, you should just close up shop, don’t use AI, and call… Jo- joking, obviously.
Rob Ainscough:
Some are holding back the
Sean O’Dell:
wave-
Rob Ainscough:
I know. Yeah … by the way. Some are holding back the wave.
Sean O’Dell:
And, and I think that is a, to be slightly off topic, that is not a wrong approach.
Rob Ainscough:
Yep. ‘
Sean O’Dell:
Cause some companies are very old school, wait till gen two comes and adopt then.
Sean O’Dell:
That’s- Do
Roy Akerman:
you see those? I, I didn’t see any, any company hold back on-
Sean O’Dell:
There are a few. There, there are a few … efficiency. There are? There are a few, yeah. Yeah. It’s, it’s more like the mid to lower size, the, ’cause they’re just- Yeah … terrified that the security’s gonna cost $1 billion- … right? To quote Dr.
Sean O’Dell:
Evil, right? Right? And he’s … It, it’s just, it’s, it’s so scary, but in reality, the, the … Just, this is just my opinion, but I think the, the sensory overload on the term, people are over it. They’re like, “Oh, AI again.” Yeah.
Roy Akerman:
Agree.
Sean O’Dell:
the letter A and I are, like, the, the most hated vowels right now.
Sean O’Dell:
Okay. Right?
Roy Akerman:
So i- I’m
Sean O’Dell:
going- …
Roy Akerman:
ignoring the problem.
Sean O’Dell:
Yeah.
Roy Akerman:
Th- that’s one, one way.
Sean O’Dell:
That is. The … But now back to how do you bite off a piece of the elephant one at a time? I’m actually giving a, a talk on this Wednesday
Roy Akerman:
Can you do a, a little bit of spoiler over here?
Sean O’Dell:
Yeah. Spoiler alert, right? The trick’s gonna be identity verification is the Trojan horse to modern IAM.
Sean O’Dell:
You’re gonna ask, “What the heck does that mean?”
Rob Ainscough:
What does that mean, Sean?
Sean O’Dell:
So it means that in order for you to figure it out, everyone is gonna go after, we gotta solve this, and then that, and then this, and then that, and then this, and then how to have a plan, a framework, a PowerPoint presentation, buy-in, go to your stakeholders and customers and get all buy-in.
Sean O’Dell:
You’re like, “Great.” That’s two months later. The problem happened six, six minutes ago, right?
Rob Ainscough:
Mm-hmm.
Sean O’Dell:
So the trick and… The trick, what I’ve seen is you’re going to get this wrong a lot. Pivot and shift and go and do it again. So here’s a spoiler alert: pick one team Pick one use case, deliver one verified agentic identity.
Sean O’Dell:
Do one.
Rob Ainscough:
Yep.
Sean O’Dell:
Just do one. Get one right, and there’s your pattern. And as you build more and more into it, you’re like, “Hmm, I need this square peg.” Go get the square peg. “I need this, triangle over here.” It may be a vendor. Go to the vendor. But if you have no plan, and you’re like, as you said, deer in the headlights-
Rob Ainscough:
Mm
Sean O’Dell:
you’re gonna walk this vendor floor and be like, every vendor has the word AI or security in it, and you go back from Identifirst and you’re just like, “I had a problem before. Now I’m like, ‘Okay, there’s 9,000 people…'” I’m, I’m exaggerating. “There’s 9,000 vendors here all claiming they do AI security. What do I do now?”
Rob Ainscough:
Right.
Sean O’Dell:
So have a, have a plan and path, but it does not have to be overarching perfect. Pick the most discreet, small, if you mess up it won’t hurt your business use case. Yep. Go get it, ’cause what’s gonna happen is if you solve for a use case, you have a customer, and you have to look at things, especially with, with agentic now in, in id- in identity, it needs to be product-minded centric.
Sean O’Dell:
Completely. It has to be.
Rob Ainscough:
Agree.
Sean O’Dell:
It isn’t a service owner, it isn’t a program, it is, it is a product.
Rob Ainscough:
Yeah.
Sean O’Dell:
Because you have customers, and your customers, newsflash, spoiler alert, they’re gonna be people and non-people. Right. There are real companies doing real things right now where they are designing journeys, not user journeys, journeys for non-humans and humans.
Sean O’Dell:
It is, it is live. Like, they’re going with it.
Roy Akerman:
So you’re assuming that they’ll be what? That we’ll recognize the pattern, that we can order a repetitive formula, or that every single solution will need to have its own discrete, uh… Sorry. E- every, every kind of like, uh, singular problem will have to have its own discrete solution, right?
Roy Akerman:
Wh- where are we going with it? Because it, I mean, it sounds promising, but is it s- can it scale?
Sean O’Dell:
I think the way you phrased it may have been different in my head, so let me, let me re- let me rephrase or maybe correct myself. If you pick one use case, and you really hear your customer out-
Rob Ainscough:
Yep …
Sean O’Dell:
the odds of that being the same pattern you need for 10 customers, highly likely.
Sean O’Dell:
Right. I need this agent to perform this task for this reason. So when you, when you listen to your customers, you’re hearing their requirements. The requirements- Right … are there, but you need to listen through the noise and hear what they’re actually asking. And that’s why it’s very important to partner with a good…
Sean O’Dell:
Someone who understands product and someone who, who understands- Agreed … how to, how to, how to t- how to deliver, because the world is changing so drastically that there’s, there’s no more, “I’m an engineer.” So I think, uh, there was one of the, one of the companies or o- one of the, AI companies are, are looking at forward deployed engineers.
Sean O’Dell:
Yep. That is a fancy way of saying sales consultant solution engineer architect- … engineer-
Roy Akerman:
Yeah …
Sean O’Dell:
thing.
Roy Akerman:
Yeah, it sounds like- A suit to wear.
Sean O’Dell:
It is. But yeah, it’s like, there you go. And it’s, it’s, it is a thing now, and companies need to have that. You’re, you’re gonna get a… What you’re gonna get out of this naturally is you’re gonna have a fleet of things that you, as a forward deployed person, engineer, architect, solution analyst, whatever, what- whatever the, whatever Gartner says the word’s gonna be.
Sean O’Dell:
You’re gonna have a bunch of digital workers to go help you do your things to make us more efficient. I wanna be, and I wanna be very clear, efficiencies does not mean we all don’t have jobs. It does not mean that. Yeah, I agree. It means efficiencies and scale becomes easier, but if we don’t, if we don’t do that right at the beginning, the efficiencies and scale are gonna be ridden with security holes, and then it’s gonna be, not blow up the world, but like it’s gonna, it’s gonna be…
Sean O’Dell:
You’re gonna have to fix a problem that in traditional IAM, like if you rolled out IGA incorrectly, “Yeah, it’s a couple years, we’ll fix it.” This- Yeah … there’s no couple years anymore.
Roy Akerman:
Totally agree. Yeah.
Sean O’Dell:
Because it’s gonna be… The, the, the scale is, if it’s not exponential, it’s parabolic.
Rob Ainscough:
Agreed. Agreed. I, coming back to your kind of- Yeah
Rob Ainscough:
starting point there of, partner with people, really listen to them, and do it once, right? And that’s what I saw from the people who are making progress in the room, and this was always my approach as a practitioner. Do it once, get it right for one. You can even do things that don’t scale, right, at that point.
Rob Ainscough:
Yep. Because the most important thing you can be doing there is learning. Right.
Sean O’Dell:
So do you
Rob Ainscough:
want listening and learning.
Sean O’Dell:
Do you want the curve ball?
Rob Ainscough:
Go on.
Sean O’Dell:
You are 100% accurate, but then you weigh in vendors.
Rob Ainscough:
Right.
Sean O’Dell:
And that’s, it isn’t a, a negative term, but it’s more- You’re, you’re battling the approach versus the, the noise in the market is so saturated.
Sean O’Dell:
And every company, just like practitioners, they’re looking to reinvent themselves.
Roy Akerman:
So just, to start to wrap it up a little bit, as our production team over here are stressed with time, although they’re enjoying every word that you’re, you’re saying, is that we expect our vendors, we’re ex- expect our cloud providers, solution providers to provide us with an agentic control plane.
Roy Akerman:
The… That’s, that’s the highest level of a general purpose-
Sean O’Dell:
Correct …
Roy Akerman:
thing. And, and I think that I heard this in your talk. This is why I’m stealing a little bit. But, that’s the highest level of general purpose solution we can have as, as, as, uh, as much as possible, like, to be granular and smart or whatever.
Roy Akerman:
But then this forward, how do you call it? Forward-
Sean O’Dell:
I think it wasn’t mine. I’m, I’m just- Yeah … I saw it. It’s a forward deployed engineer.
Roy Akerman:
For- so, I think the forward deployed engineer-
Sean O’Dell:
Yeah …
Roy Akerman:
will need to step up, speak with the customer, understand the use case, and then hopefully we’ll be able to, yeah, to tweak this control plane per use case, per product, and I don’t know, maybe have other agents help in order to do that.
Roy Akerman:
Or
Sean O’Dell:
you contribute back to it to say, “I know we need to talk to X in the control plane. It’s just a policy.” And that, that way, when you register the agent, it’s just “Hey, registered,” and this is very hand-wavy, but it, it works Your agent’s registered. You give it a discrete boundary of, “I’m accessing this realm.”
Sean O’Dell:
The realm could be, finance.
Rob Ainscough:
Mm-hmm.
Sean O’Dell:
You know the bucket is this, because a lot of, a lot of what people are trying to chase is you’re trying to control something that is probabilistic. You- it’s n- you’re not going to win. Yeah. It isn’t control, it’s guidance.
Rob Ainscough:
Right.
Sean O’Dell:
And I think that’s, I think a lot of, a lot of good practitioners landed on that on Sunday and Monday, and they’re like, “Yeah, can’t do that.”
Sean O’Dell:
I’m like, “The whole point of an LLM is to reason and, and, and gain something. It’s a goal.” Yeah. It’s like saying, “Play Monopoly, but don’t win.” Like, “I want all the hotels for me. It’s mine.” Yeah. Like, “I want all the money. Like, give me the bank,” right?
Roy Akerman:
Yeah. I think that by the end of the day, you’re, there’s two, two questions that, that everyone should ask themselves all the time when someone’s throwing agentic on their face.
Roy Akerman:
The first one is that, how granular can I control this? The second one, how truly I understand the desired outcome, like in a general way, of this program, of the person who actually try to operate or build that, right? And how… A- and, and the process, the new kind of like job that I have is how to prote- to, to mesh them together in a secured way.
Sean O’Dell:
You are absolutely right, 100%. I just… There’s one level higher. Is this even agentic?
Rob Ainscough:
Mm. ‘
Sean O’Dell:
Cause a lot of people are like, “I wanna build an a-” I said it earlier. Yeah. “I wanna build an agent.” I’m like, “No, that’s just natural language querying, or that’s just machine learning.”
Rob Ainscough:
Mm.
Sean O’Dell:
It isn’t an agent. ‘Cause again, FOMO, like, “I gotta build an agent, I gotta build an agent.”
Sean O’Dell:
I’m like, “Why do you have to?”
Rob Ainscough:
Yeah.
Sean O’Dell:
It’s just a workload. It’s a thing. I think actually ask yourself with like discrete principles of what’s… You hit it nail on the head. What is my goal? What am I doing? Do I need to call an LLM to do this thing?
Rob Ainscough:
Mm-hmm.
Sean O’Dell:
If I know the task is every 10 minutes, check this thing, there’s no- No, no, no
Sean O’Dell:
reason for that. You’re burning money at this point. Right. Just, just go buy fireworks. Yeah.
Rob Ainscough:
Blow it up, right? And companies will mature into that, right? They will understand what, what LLMs are for- Yeah … and where they are a very expensive solution to a, a known problem, right? Yeah. They’ll figure
Roy Akerman:
it out. But I think that they’re, they’re seeing, like in R&D, they’re seeing in the endpoints, like the OpenCloses of the world, they’re seeing like a pile of AI agents that somebody built.
Roy Akerman:
Let’s say that, again, 80% of them are just like traditional software that, that we’re calling them an agent, right? Because we don’t know what there is over there. They need to start somewhere, right? So I understand about the process, about how to build it or whatever. What are we doing with this overwhelming amount of already made and built agent that are operating- Yeah
Roy Akerman:
in our environment? I think that this is kind of like the, uh, overwhelm- That’s a problem … big question.
Sean O’Dell:
Yes. It is. ‘Cause it- The business is always gonna outpace… It, it, it always is, in anything. It’ll always outpace security, always.
Roy Akerman:
Which is, so you’re actually saying calm down, go to the method that we just, like offered, do them one by one.
Roy Akerman:
I mean, you cannot fight progression. You cannot really be in the middle and stop it.
Sean O’Dell:
No, I’m saying get, get the right pattern.
Roy Akerman:
And get the
Sean O’Dell:
right pattern. Yeah. And then, and then you have to just, I mean, like, like any other rollout or in, or any other rollout or integration, it’s Business has to pr- business has to propagate because it’s, it’s money, right?
Sean O’Dell:
Yeah. But if you don’t have a way to, to, to do it securely, the business isn’t gonna stop. Mm. And I … This is, I’m a security engineer by trade. I’m like, “I get it, but they’re gonna wanna make money.”
Rob Ainscough:
And I, I think a really interesting point that just came to mind is, what’s secure enough?
Sean O’Dell:
Big
Rob Ainscough:
yup. Right? What is su- sufficiently secure?
Rob Ainscough:
Big yup. And this is where I’ve seen really interesting approaches by practitioners saying- I bet … “Hey, well, I’ve got core screen guardrails to bound the problem.”
Sean O’Dell:
Correct.
Rob Ainscough:
Right? And then I’ve got dynamic within that-
Sean O’Dell:
Yup …
Rob Ainscough:
to then give me control. I do- And that’s something that I’ve seen being, you know, talked about as a really effective solution to problems, to start bounding the problem- Yes
Rob Ainscough:
trying to get to secure enough to start. And that doesn’t mean necessarily perfectly secure. It’s not where we wanna be-
Sean O’Dell:
Yup …
Rob Ainscough:
but it’s a great place to start for practitioners.
Sean O’Dell:
Are you sure you didn’t go to my workshop yesterday? ‘Cause I l- I wanted
Rob Ainscough:
to,
Sean O’Dell:
but my, uh, my muscle memory- Andrew Cameron and I use that, use that exact line.
Sean O’Dell:
We’re like, “This is, like, this is where you wanna get to. Start here.” Like, like you, you … Great example is get one guardrail in place. Yeah. Look for model poisoning. Yes, that’s a win. Yeah. Next one is semantic routing. Okay. Do you need to use Opus 47 to, chat with somebody? No. you can, if you like burning money, right?
Sean O’Dell:
But it’s little thi- build little by little by little.
Rob Ainscough:
Right.
Roy Akerman:
So now that you put an order to the word and that was, perfectly code, thank you for that. Word, not a buzzword, but the, like the hype over Mythos. Any thoughts on that you feel comfortable to share?
Sean O’Dell:
It’s really gonna make security a first-class principle.
Rob Ainscough:
So just before we get to rapid fire, something that I wanted to add to that, ’cause I, really what I think, the phrase that always comes to mind when we think about frontier, not necessarily Mythos, but frontier more generally is, if footholds are more likely because this thing democratized the ability to give it a go to people who are unskilled and is adept at discovering vulnerabilities that can be exploited, what it’s really doing from an identity perspective for me, it raises the bar.
Rob Ainscough:
It raises the bar in terms of what we’ve needed to do in the past and maybe struggled with, and really it does bring those chickens home to roost in terms of the identity technical debt we’ve got in the past. And that is something that, you know, putting agentic adoption aside, that’s really important for us to realize, that that bar is raising, and raising very fast.
Sean O’Dell:
I think it’s, it’s gonna force the cleanup faster. I really do. Agree. I really do. Mm-hmm.
Rob Ainscough:
Agree. Yeah. Agree. It has to. Right. We’re gonna move on to our rapid fire questions. We do this with all of our guests. Okay. So we’ll start with a myth. A myth. What’s one identity or security myth?
Sean O’Dell:
What’s one identity or security myth?
Sean O’Dell:
IGA is the answer to all your questions.
Rob Ainscough:
Arguably the answer to none. I agree. Oof. Very good. A malpractice. So what is one thing that, leaders, security leaders get wrong?
Sean O’Dell:
They don’t trust their most senior and polished practitioners.
Rob Ainscough:
Wow.
Sean O’Dell:
They tend to look towards vendors for an answer, when if they have it in-house, they should trust in-house.
Sean O’Dell:
I agree with that one. Just being, being honest, being honest.
Rob Ainscough:
Significantly. Yeah. Yeah.
Sean O’Dell:
Third-party opinions- Again, not, not, not where I work at all, by any means, just being very, very honest here. But, the, in the generality, that is a… I have enough friends who are practitioners, and it’s like they’re battling against the, the, the, the sales funnel of insert company name here, and it’s…
Sean O’Dell:
You can’t win.
Roy Akerman:
Yep.
Rob Ainscough:
Yeah, I think, the valuing of third-party opinion over first-party opinion, definitely a problem. Yeah. Definitely a problem. All right, a hard truth. What’s one hard truth?
Sean O’Dell:
In life or in identity?
Rob Ainscough:
Let’s go identity, then life.
Sean O’Dell:
geez, this is great. one hard truth, authorization matters.
Roy Akerman:
Wow.
Sean O’Dell:
That is a hard
Rob Ainscough:
truth.
Roy Akerman:
Wow. This is- That’s an easy problem to solve, though, right? People are forgetting about that,
Sean O’Dell:
yeah. Deep thoughts-
Roy Akerman:
yeah …
Sean O’Dell:
by Sean O’Dell.
Rob Ainscough:
Two-word answers by Sean O’Dell. final one, overhyped. What’s one trend, and I suspect I know what you’re gonna say, that is overhyped? AI
Sean O’Dell:
security.
Rob Ainscough:
I wondered whether you’d say that. I wondered whether you’d
Sean O’Dell:
say that. It was between identity security or AI security.
Roy Akerman:
Yeah. I’m
Sean O’Dell:
like, “Eh, let’s go AI.”
Roy Akerman:
we have, what did you say? 9,000 vendors over here, and I wanna be vendor agnostic for a second. Did anything in those, three, four days, when the words are coming, got you excited?
Roy Akerman:
A concept.
Sean O’Dell:
Yes. It’s more around, it’s the legal, it’s the legal side of decisioning and reasoning being made by LLMs on behalf of. It, it’s so weird because I was always– I’ve always fathomed on like you’re offloading this power of attorney consent, not really consent, to Something. You have no clue what something is.
Sean O’Dell:
So there was a talk given, I think it’s tomorrow or t- or, or today.
Roy Akerman:
Mm-hmm.
Sean O’Dell:
It’s about, bringing identities, bringing identity or identities to models. Because when you, when you talk to, a haiku or a sonnet, take your pick, doesn’t matter, you don’t really know the lineage of that model. You don’t know.
Rob Ainscough:
Mm.
Sean O’Dell:
It self-identifies as yes, I’m the, I’m the next version. You, you… When you click the dropdown, you have no idea. Yeah. None. So if you’re asking it to do something for you on your behalf, you need to have a rationale check at the LLM layer to say, “Prove to me that your providence came… your lineage, like you grew up from, a, a toddler to an adult.”
Sean O’Dell:
And if that, you can’t prove that, you don’t have, you don’t have the, the lineage of how do I trust-
Rob Ainscough:
Right …
Sean O’Dell:
that what I asked it six days ago should give me the rationale of the same answer? And the layer higher to that is there’s real-world implications here. So if you are at work doing something, relying on AI to help you with an answer, and you get it wrong-
Rob Ainscough:
Mm
Sean O’Dell:
and there’s finances here, who’s to blame? Is it you? Is it… It has to be, it has to be a principle or it has to be a company or a thing. It can’t be just like, “Oh, yeah, it’s AI.” No, it has to be… Liability has to fall on something. Yeah. And I think if we get that, we’re gonna get the answer of what is the intent and why?
Sean O’Dell:
And commerce, agenda commerce, they kinda have this.
Roy Akerman:
Mm-hmm.
Sean O’Dell:
Like, why are you doing this thing? Prove to me this payment. What are you using it for? Mm. And, and identity, we’re chasing that problem. But if you look to the, to the commerce area, it isn’t perfect, but guess what? It’s something. Yeah. ‘Cause right now everyone’s like, “Oh, intent-based access control.”
Sean O’Dell:
I’m like, “Please, no more star backs.” We don’t need them. No, we don’t need any more. We don’t need them. Yeah. Like IBAC. No, please stop. Like, I, I mean, please. Like, it’s, it’s okay. If, if it’s your thing, it’s fine, but I’m like, “Another…” ‘Cause now it’s relationship BAC and PBAC and ABAC. I’m like, “Oh, a whole alphabet soup,” right?
Roy Akerman:
Yeah.
Sean O’Dell:
Pretty soon we’ll have AIBAC, and I’m like, what is… That’s kinda funny.
Roy Akerman:
I smell here another, like, great- We should use
Sean O’Dell:
that.
Roy Akerman:
We should use that … another- We
Sean O’Dell:
should use that …
Roy Akerman:
yeah, another great, like, topic for an epis- e- episode. But I think, yeah, I will allow you to go as far as you want with non-determinism, but the second that you want to make an action, you need to go back-
Sean O’Dell:
Yes
Roy Akerman:
and to give me a rational that I can then use in order to approve something.
Sean O’Dell:
And that’s why identifiers are important. Yeah. And that’s why you have- Bring you back to where we started … you have to tie it back to, liability. ‘Cause we’re moving from- reasoning, helping me out, things, but it’s gonna start doing things.
Sean O’Dell:
And when it does things, like heaven forbid, ’cause this has never happened, it deletes something.
Rob Ainscough:
Yeah.
Sean O’Dell:
Why did it do it?
Rob Ainscough:
Yeah.
Sean O’Dell:
Oh, ’cause it was a, it was a bad, a bad prompt. Was it? Mm. Or was it you’d used the wrong, the, the wrong model? Did the model reasoning correctly? Was it your prompt? Was it the end user?
Sean O’Dell:
What was it? Right now everyone’s like, “Yeah, it’s the, it’s just AI.” I’m like, you can’t answer the question saying it’s AI anymore. I want a- Right … discrete point to the problem. in, in software engineering, it’s, it’s observability. Yeah.
Rob Ainscough:
Yeah.
Sean O’Dell:
Where’s it at? Show me where it’s at. It’s
Rob Ainscough:
attribution, right?
Sean O’Dell:
Yep. 100%.
Rob Ainscough:
Very
Roy Akerman:
interesting. Cool. so many more questions, but we have to finalize this. So we would like to thank you very much, Sean.
Sean O’Dell:
Pleasure. Anytime.
Roy Akerman:
And for coming in, sharing your thoughts. I bet that, e- even if we’ll meet within a month or two, the answers-
Sean O’Dell:
All different …
Roy Akerman:
yeah, all different. The problems-
Sean O’Dell:
Sadly
Roy Akerman:
will grow.
Sean O’Dell:
Yes.
Roy Akerman:
but as you said, like we’re here to iterate, we’re here, like to own this problem. Yeah. I don’t, I don’t believe that it will go and stabilize or pla- go plateau in some places. That’s the new reality. Yeah. Everything is changing super fast, and we’re here to- Mm-hmm … at
Rob Ainscough:
least compete.
Rob Ainscough:
Well, we gotta learn and grow together, right? Yeah. And that’s why we’re
Sean O’Dell:
here, that’s why we’re sharing,
Rob Ainscough:
that’s why we’re doing the podcast. 100%. So thanks again, Sean.
Sean O’Dell:
Anytime. Good luck with your talk. Thank you very much.
Roy Akerman:
Appreciate it. We’ll watch it stream from the sidelines. Thank you.
Rob Ainscough:
Thanks. That’s it for this episode of Identity Decoded.
Roy Akerman:
If this conversation changed anything that you thought about identity security, share it with someone who’s working through the same challenges.
Rob Ainscough:
And don’t forget to follow the show so you don’t miss what’s
Rob Ainscough:
next.