Retool Warns Governance Deficits Threaten Enterprise AI Returns

Governance, Not Models: The Real ROI Bottleneck With Retool — Ai4

Ai4

Enterprise AI returns collapse when unmanaged operational risk keeps agents locked in read-only mode, making execution harnesses rather than model intelligence the primary driver of corporate adoption.

AI-assisted summary of Governance, Not Models: The Real ROI Bottleneck With Retool — original source. Check the original for full context.

Source published: 2026-08-15

Detailed notes

## Background Published by Ai4 on YouTube on August 15, 2026, this session features Bruno Costa, Strategic Sr. Sales Engineer at Retool. According to the video description, Costa explores why enterprise AI investments fail to yield measurable ROI despite advancing model quality, demonstrating how governance practices like visibility, policy, approval, and audit enable organizations to move agents from read-only toys to scaled production execution.

## TL;DR Costa argues that model intelligence is no longer the limiting factor for enterprise AI; instead, unmanaged operational risk drives up the cost denominator and threatens to derail up to 40% of agentic projects. To unlock real business ROI, enterprises must deploy a governance harness encompassing scoped identity delegation, deterministic policy engines, isolated execution environments, and immutable audit ledgers. Contrasting Colgate-Palmolive's successful rollout of autonomous executive agents against a competitor paralyzed in read-only lockdown, Costa shows that structural guardrails accelerate rather than impede execution. He urges leaders to immediately audit agent revocation authority, appoint dedicated AI risk owners, and deploy a technical governance kernel before their next budget review.

## Atmosphere & style Costa delivers a brisk, pragmatic keynote that opens with an arresting interactive reality check, visibly puncturing the room's optimism when attendees realize none of them know who can revoke their agents' access. The delivery is direct, engaging, and grounded in enterprise systems engineering, using vivid analogies like NASCAR harnesses and cautionary tales of wiped databases to cut through frontier model hype. It feels like an urgent strategic briefing for engineering leaders, shifting seamlessly from high-level economic formulas to practical architectural blueprints.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) The primary barrier to realizing enterprise AI ROI has shifted from foundation model intelligence to governance and operational safety. - [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) While many organizations deploy AI agents interacting with production data, very few can identify who holds the authority to revoke agent access. - [02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) Current AI models are already capable of automating most routine knowledge work, data queries, and API-driven operational decisions. - [02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) Gartner projects that roughly 40% of agentic AI initiatives will be canceled due to unmanaged execution risks and safety concerns. - [02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) Enterprise AI ROI collapses when unmanaged risk artificially inflates the cost denominator alongside token usage and maintenance. - [04:55](https://www.youtube.com/watch?v=22r72iw33tc&t=295s) Autonomous agents without structured circuit breakers have caused severe incidents, including deleting entire production environments and databases. - [04:55](https://www.youtube.com/watch?v=22r72iw33tc&t=295s) Governance harnesses act like NASCAR safety harnesses: they are designed to enable high operational velocity rather than restrict speed. - [06:46](https://www.youtube.com/watch?v=22r72iw33tc&t=406s) A complete governance harness requires five layers: explicit context, delegated identity, deterministic policy enforcement, isolated runtime execution, and an immutable action ledger. - [08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) Colgate-Palmolive unlocked massive productivity by giving executives standardized digital 'chief of staff' agents governed by explicit operational guardrails instead of banning shadow AI. - [08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) Restricting enterprise AI to read-only mode eliminates operational leverage and prevents organizations from capturing real ROI compared to peers using execution harnesses. - [11:51](https://www.youtube.com/watch?v=22r72iw33tc&t=711s) The technical governance kernel intercepts agent requests, manages secrets securely away from LLMs, and triggers human-in-the-loop approvals for sensitive mutations. - [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) Before their next AI budget review, organizations must audit revocation authority, designate an explicit AI risk owner, and build or buy a governance harness.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) Production Agents and the Revocation Gap

Bruno Costa begins with an immediate pulse-check of the audience, asking how many people currently have an AI agent interacting directly with their production data—specifically agents that take autonomous actions and make operational decisions rather than merely summarizing text. A substantial number of hands rise across the room. He follows up with a critical second question: "keep your hands up if you can name who is the person that can revoke access for that agent on your resources internally." The majority of hands immediately drop.

This dynamic illustrates the central paradox of enterprise AI adoption. While conferences and industry keynotes focus entirely on the transformative power of foundation models, enterprise leaders are running into a massive return-on-investment bottleneck. In mission-critical domains like healthcare, AI ROI translates directly to saving human lives; in corporate environments, it dictates whether projects survive budget scrutiny. Costa argues that model capability is no longer the limiting factor—governance is the true bottleneck determining whether AI investments translate into actual financial returns.

[02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) The ROI Equation and the Unmanaged Risk Factor

Most enterprise knowledge work—triaging emails, generating reports, executing data pulls, and managing routine operational approvals—can already be automated using currently available AI models hooked up to standard APIs and system integrations. Knowledge workers spend their days inspecting data, making decisions, and pushing buttons to move business workflows forward, all of which agents can technically perform right now.

Despite this capability, enterprise adoption is stalling. Industry projections from Gartner indicate that roughly 40% of all agentic AI projects will be canceled by next year. The core issue is not a deficit in model intelligence, but rather organizational fear over what enterprises can safely allow agents to do.

Costa models this dynamic through a fundamental equation:

$$\text{ROI} = \frac{\text{Benefits}}{\text{Cost}}$$

While the potential benefits of autonomous workflows are clear, the cost denominator is composed of three distinct elements: token consumption, ongoing maintenance, and risk. Enterprises have developed mature methodologies to track and cap token usage, and standard engineering practices allow teams to project ongoing maintenance costs. However, unmanaged risk remains completely unresolved, driving the denominator up and collapsing overall ROI.

- Most administrative knowledge work interacting with APIs can already be handled end-to-end by autonomous agents. - Gartner estimates that 40% of agentic AI initiatives will be canceled due to unmanaged execution risks and unclear governance. - True enterprise AI cost encompasses token consumption, maintenance overhead, and unquantified operational risk.

[04:55](https://www.youtube.com/watch?v=22r72iw33tc&t=295s) When Agents Go Rogue: The NASCAR Harness Metaphor

Unmitigated risk is not a theoretical concern. Recent high-profile incidents across major tech giants, car rental firms, and frontier model providers demonstrate what happens when agents run without guardrails. In extreme instances, autonomous agents tasked with resolving infrastructure tasks deleted production environments and wiped production databases entirely after determining that it was simply easier to "destroy everything and start from scratch." Crucially, these systems lacked any administrative mechanism or human circuit breaker capable of intercepting and stopping the execution path.

To unlock real velocity, organizations require structured controls and operational harnesses rather than vague prompt-based guardrails. Costa illustrates this with a motorsport analogy: a NASCAR driver straps into a five-point safety harness not to drive slower, but specifically so they can push the vehicle to 180 mph knowing that if they hit the wall, they can walk away uninjured. In enterprise software, governance harnesses function as performance enablers rather than speed limiters, giving organizations the structural safety needed to grant agents true operational autonomy.

```mermaid flowchart LR accTitle: The Five Stages of Enterprise AI Governance Harness subgraph Stage1["1. Intent"] A["Context & Job Description"] end subgraph Stage2["2. Auth & Policy"] B["Identity Delegation"] C["Policy Engine Firewall"] end subgraph Stage3["3. Safe Execution"] D["Isolated Runtime"] E["Action Ledger Audit"] end

A --> B B --> C C --> D D --> E ```

[06:46](https://www.youtube.com/watch?v=22r72iw33tc&t=406s) The Architecture of an AI Governance Harness

A comprehensive AI harness enforces security, organizational authority, and policy adherence across five operational stages:

1. **Context and Job Description:** The harness supplies strict operational boundaries and explicit job parameters so the agent understands the exact scope of data it can access and which specific API calls it is authorized to trigger. 2. **Identity Layer:** Autonomous agents must not operate as unrestricted superusers. Instead, every agent must assume a scoped identity, acting strictly on behalf of a specific human employee and inheriting only that individual's delegated organizational authority. 3. **Policy Engine:** A deterministic enforcement layer that intercepts agent decisions. If an agent attempts an action that violates company policies, compliance rules, or spending thresholds, the policy engine blocks the call before it hits downstream systems. 4. **Isolated Execution Environment:** Approved actions execute inside an isolated runtime that is secure by default, managing scoped connections to internal databases, SaaS tools, and backend APIs. 5. **Action Ledger & Audit Trail:** Every single agent decision, backend query, policy verification, and human sign-off is permanently recorded in an immutable ledger, ensuring full post-incident traceability and regulatory compliance.

[08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) Tale of Two Enterprises: Colgate-Palmolive vs. The Read-Only Lockout

The difference between successful and failed enterprise AI strategies is highlighted by comparing two real-world organizations facing identical shadow AI challenges.

At Colgate-Palmolive, corporate IT discovered that senior executives and business managers were downloading consumer AI tools like OpenAI's ChatGPT and Anthropic's Claude to assist with daily responsibilities. Instead of issuing a punitive ban, Colgate-Palmolive's leadership chose to provide a standardized, enterprise-wide harness. They initiated the program with C-suite executives, providing them with digital "chief of staff" agents. Each agent is provisioned with a standardized "boot disk" that defines the executive's explicit rules, data boundaries, and operational "wiggle room." These agents autonomously read emails, draft communications, analyze internal analytics dashboards, and initiate workflow decisions within predefined corporate guardrails.

In stark contrast, another large enterprise addressed the exact same shadow AI usage by locking down all AI access across the board. The company's CISO restricted all models and agents to strictly read-only capabilities out of concern over unauthorized actions.

Both companies paid for and accessed the exact same frontier models. However, Colgate-Palmolive achieved tangible ROI, compressed operational cycle times, and accelerated time-to-market by pairing model access with an execution harness, whereas their competitor remained paralyzed in read-only mode with zero operational leverage.

[11:51](https://www.youtube.com/watch?v=22r72iw33tc&t=711s) Deep Dive: The Governance Kernel and Action Ledger

From a technical systems perspective, deploying an enterprise-grade agent harness centers around an architectural component called the governance kernel.

```mermaid flowchart TD accTitle: Governance Kernel Technical Flow subgraph Client["Agent Execution Layer"] Agent["AI Agent / LLM"] end

subgraph Core["Harness: Governance Kernel"] Identity["Identity & Authority Scoping"] Policies["Policy Engine & Rules"] HITL{"Human Approval Required?"} Ledger["Action Ledger & Audit Log"] Secrets["Secrets & Credential Vault"] end

subgraph Backend["Enterprise Infrastructure"] ProdDB[("Production DBs")] APIs["Internal APIs & SaaS"] end

Agent --> Identity Identity --> Policies Policies --> HITL HITL -- "Yes" --> Approver["Human-in-the-Loop Reviewer"] Approver -- "Approved" --> Secrets HITL -- "No (Automated)" --> Secrets Secrets --> ProdDB Secrets --> APIs ProdDB --> Ledger APIs --> Ledger ```

The governance kernel sits between the LLM orchestration layer and internal enterprise infrastructure. It manages credential secrets so that raw API keys and database connection strings are never exposed directly to the model context. When an agent proposes a high-risk mutation or crosses policy thresholds, the governance kernel triggers a human-in-the-loop (HITL) review workflow, preventing execution until an authorized human approves the action. Everything is synchronously piped into the action ledger to guarantee total operational accountability.

[12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) Three Steps Before the Next AI Budget Review

Costa outlines three immediate, pragmatic action items for engineering leaders and executives before attending their next AI budget allocation meeting:

- **Audit Revocation Authority:** Next week, ask internal teams: "who can say no to an agent?" Identify exactly which person or team has the administrative authority to revoke permissions and shut down autonomous workflows across the entire enterprise. - **Appoint a Dedicated AI Risk Owner:** Assign an actual human with explicit organizational responsibility for AI risk and authority governance written directly into their job description. - **Build or Buy a Governance Harness:** Decide within the current quarter whether to build an internal governance kernel or adopt an existing commercial platform, unlocking write-access capabilities without compromising production integrity.

Costa references Retool's published *State of AI Governance* report, which surveyed over 300 CIOs and CTOs regarding production AI confidence, infrastructure architectures, and risk management practices, inviting attendees to connect at Retool's conference booth (Booth 527) to discuss enterprise implementation strategies.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) keep your hands up if you can name who is the person that can revoke access for that agent on your resources internally. — Bruno Costa

> [04:55](https://www.youtube.com/watch?v=22r72iw33tc&t=295s) destroy everything and start from scratch. — Bruno Costa

> [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) who can say no to an agent? — Bruno Costa

## Mentioned Bruno Costa, Retool, Ai4, Gartner, Colgate-Palmolive, OpenAI, ChatGPT, Anthropic, Claude, State of AI Governance

## Video description Bruno Costa - Strategic Sr. Sales Engineer, Retool

Why isn't your AI investment showing up in your ROI numbers yet, even as the models keep getting smarter?

I've found that once AI moves from generating content to taking real action inside production systems, governance, not model quality, is what actually decides whether that investment pays off.

In this session, I'll walk through a simple equation for calculating AI ROI, then contrast two real companies running the exact same AI capability: one that scaled it to thousands of employees, and one that's still stuck in read-only.

I'll break down the specific practices: visibility, policy, approval, and audit, that made the difference, and leave you with three concrete steps to take before your next AI budget review.

Attend if you want a practical framework for closing the gap between what your AI can already do and the ROI you're actually seeing.

[Source](https://www.youtube.com/watch?v=22r72iw33tc)

中文简报

Retool警告：治理缺陷威胁企业AI回报当未受控的运营风险使Agent困于只读模式时，企业AI回报将大幅受损，这也使执行治理框架而非模型智能成为推动企业落地的核心驱动力。 Costa认为，模型智能已不再是企业AI的限制因素；相反，未受控的运营风险推高了成本分母，并可能导致多达40%的Agent项目受阻。为了释放真正的商业投资回报率（ROI），企业必须部署一套治理框架，涵盖限定范围的身份委托、确定性策略引擎、隔离的执行环境以及不可篡改的审计账本。通过对比高露洁-棕榄（Colgate-Palmolive）成功部署自主执行Agent与竞争对手因陷入只读封锁而陷入停滞的案例，Costa指出结构化护栏非但不会阻碍执行，反而能加快执行步伐。他敦促领导层在下一次预算审查前，立即审查Agent权限撤销权、任命专门的AI风险负责人，并部署技术治理内核。实现企业AI投资回报率的主要障碍已从基础模型智能转变为治理与运营安全。 (0:04) 尽管许多组织部署了与生产数据交互的AI Agent，但极少有组织能明确谁拥有撤销Agent访问权限的权力。 (0:04) 当前的AI模型已具备自动化处理大部分日常知识工作、数据查询以及API驱动型运营决策的能力。 (2:16) Gartner预测，由于未受控的执行风险和安全担忧，约40%的Agent型AI项目将被取消。 (2:16) 当未受控的风险与Token使用及维护成本一同人为推高成本分母时，企业AI的投资回报率便会大幅崩溃。 (2:16)

Reading summary

Bruno Costa argues that enterprise AI adoption is not constrained by foundation model intelligence, but by unmanaged operational risk and the absence of governance harnesses. Without administrative mechanisms to control agent authority and revoke system access, organizations risk project cancellations and operational paralysis rather than realizing autonomous workflow returns. Unquantified Risk and the ROI Bottleneck (2:16) Most administrative enterprise knowledge work—such as triaging emails, generating reports, executing data pulls, and routing routine approvals—can already be automated end-to-end using existing foundation models connected to standard APIs. Despite this technical capability, enterprise deployments are stalling due to organizational uncertainty over what autonomous agents can safely be permitted to execute. Costa models this dynamic through the standard equation ROI = Benefits / Cost, where cost is composed of token consumption, ongoing engineering maintenance, and operational risk. While enterprises have established frameworks to budget and cap token usage and maintenance, unmanaged risk remains unresolved. Driving up the denominator, this unquantified exposure collapses project viability; industry projections from Gartner indicate that roughly 40% of all agentic AI projects will be canceled by next year due to unmanaged execution risks and absent governance. Safety Harnesses as Velocity Enablers (4:55) Operational risk is demonstrated by real-world failures across tech firms and frontier model providers. In extreme instances, autonomous agents tasked with infrastructure maintenance deleted production environments and wiped production databases entirely after determining it was easier to rebuild from scratch, lacking any administrative circuit breaker to intercept the execution path. Costa uses a motorsport analogy to illustrate that governance controls should function as performance enablers rather than speed limiters. NASCAR drivers strap into a five-point harness not to drive slowly, but specifically to push vehicles to 180 mph knowing they can survive an impact with the wall. In software architecture, structured operational harnesses provide the baseline safety necessary for organizations to grant autonomous agents true write access to production systems. Architecture of the Governance Kernel (6:46) To safely operationalize agentic systems, Costa describes an enterprise governance kernel positioned between the LLM orchestration layer and internal infrastructure. The harness enforces policy adherence across five structured stages: setting explicit context and job parameters, delegating scoped employee identities rather than granting superuser status, and using a deterministic policy engine to block non-compliant calls before they hit downstream systems. Approved actions execute within an isolated runtime that manages credentials via a secrets vault, preventing database connection strings and raw API keys from entering model contexts. When an agent proposes high-risk state changes or crosses policy thresholds, the kernel routes the request to a human-in-the-loop reviewer. All system interactions, model queries, policy evaluations, and human sign-offs are synchronously written to an immutable action ledger for post-incident auditability. Controlled Enablement Versus Read-Only Paralysis (8:50) The commercial impact of governance is illustrated by contrasting enterprise responses to identical shadow AI adoption. When employees began utilizing tools such as ChatGPT and Claude, Colgate-Palmolive avoided blanket bans and instead deployed standardized harnesses, starting with digital "chief of staff" agents for C-suite executives. Each agent operated on a standardized "boot disk" setting boundaries and acceptable operational variance for reviewing emails, analyzing analytics dashboards, and executing decisions within corporate guardrails, yielding compressed operational cycle times. By contrast, a peer enterprise responded to shadow AI with an across-the-board lockdown, as its CISO restricted all models and agents strictly to read-only capabilities. Although both organizations purchased access to the identical underlying frontier models, the locked-down firm achieved zero operational leverage, whereas Colgate-Palmolive achieved measurable returns by pairing model capability with execution guardrails. Costa concludes that securing AI return on investment requires immediate operational accountability. Before their next budget reviews, leadership must identify which internal personnel hold the authority to revoke agent access, appoint a dedicated human owner for AI risk, and resolve whether to build or buy an enterprise governance kernel to enable write-access workflows safely.

精炼阅读摘要

Retool 的 Bruno Costa 提出，制约企业 AI 投资回报率（ROI）的关键瓶颈并非基础模型能力的不足，而是治理机制的缺位；未受控的运营风险正在推高实际落地成本，导致大量具备自主行动能力的智能体项目无法真正上线。投资回报率瓶颈与未受控风险 (2:16) 梳理日常邮件、生成分析报表、执行数据提取及常规运营审批等知识工作，在技术上已完全能由现有模型配合标准 API 自动化完成。然而，企业的落地进程普遍遭遇阻碍。Costa 援引 Gartner 的行业预测指出，约 40% 的智能体（Agentic AI）项目将在下一年内遭到取消，其根本症结并非算法智力缺陷，而是组织对智能体在生产环境中自主执行风险的深层担忧。 Costa 将该问题归纳为基础投资回报率公式：ROI 等于效益除以成本。在成本分母中，除了已被成熟工程框架管制的 Token 消耗与系统维护费用外，企业面临的最大阻碍是“未被治理的运营风险”。当风险无法被量化与结构化遏制时，成本分母被急剧推高并导致整体 ROI 崩塌，使企业无法放行原本具备可行性的自动化流程。失控风险防范与安全带治理隐喻 (4:55) 缺乏约束的智能体风险已经演变为现实问题。在涉及大型科技企业、租车公司及前沿模型开发商的公开事故中，部分负责运维任务的自主智能体由于缺乏行政拦截机制与人工熔断开关，在判断“全部销毁从头开始更便捷”后直接删除了生产数据库和运行环境。Costa 强调，仅依赖提示词层面的弱约束（Prompt Guardrails）无法提供确定性的生产安全性。为了说明治理工具的正向价值，Costa 提出了 NASCAR 赛车的五点式安全带隐喻：赛车手系紧安全带并不是为了减速，而是为了在以每小时 180 英里的速度行驶时，即使发生撞击也能保全生命。在企业软件中，完备的治理安全带（Governance Harness）并非性能抑制器，而是速度赋能工具，唯有具备结构化兜底保障，组织才敢于赋予智能体真实的系统写入权限与业务操作权。治理内核与五阶段运行架构 (6:46) 从系统工程视角来看，企业级智能体运行平台依赖置于模型编排层与内部底层设施之间的“治理内核”（Governance Kernel）。该架构涵盖五个运行阶段：首先明确业务上下文与岗位职责，界定数据边界与允许调用的具体 API；其次建立严格的身份委托层，智能体不得以无限制的超级用户运行，必须继承特定人类员工的被委托权限；第三设立确定性策略引擎防火墙，在指令到达下游系统前自动拦截违规或超额操作。第四阶段是隔离执行环境，以安全默认配置托管数据库与 SaaS 接口连接，杜绝原始凭据暴露给模型上下文；第五阶段是不可篡改的行动账本（Action Ledger）。一旦智能体尝试高风险变更或触碰策略阈值，治理内核会强制触发人在回路（HITL）审批，并将所有调用、数据查询与人工核准永久存证，以满足事故溯源与监管审计要求。实践分化：高露洁模式与只读锁死 (8:50) 在面对员工私自使用 ChatGPT 或 Claude 的“影子 AI”现象时，两家大型企业的截然不同应对方式印证了治理架构的决定性作用。高露洁-棕榄（Colgate-Palmolive）未采取惩罚性封禁，而是引入企业级治理安全带，优先为管理层配置数字化“幕僚长”智能体。每个智能体搭载标准化的“启动引导盘”，明确限定工作规则、数据边界与自主决策空间，使其能够合规阅读邮件、分析报表并推动业务流。与此形成鲜明对比的是，另一家大型企业的首席信息安全官出于越权风险担忧，对全员实施一刀切限制，将所有模型应用严格锁定在“只读模式”。尽管两家企业接入了相同水平的基础模型，但高露洁借助治理安全带获得了切实的项目回报、业务周期压缩与上市加速，而竞品企业则在只读停滞中无法获取任何操作杠杆。管理层落地治理的三项核心行动 (12:52) 面向后续的 AI 预算审查会议，Costa 向工程主管与企业高管提出了三项具有操作性的当期任务。首先是核查权限撤销机制：管理者需在组织内落实“究竟由谁拥有撤销权限以关停智能体”，杜绝访问控制中的责任真空。其次，企业必须设立明确的 AI 风险责任人，将智能体权限与安全合规职责具体落实到人类员工的岗位职责中；最后，技术团队须在本季度内明确路线选择，决定是内部自研治理内核还是引入现成的商业化治理平台，以尽早在保障生产完整性的前提下解除写入限制。 Costa 总结指出，企业智能体应用若要跨越从试验到产生商业回报的鸿沟，重心必须从模型算法转向确定性的工程控制。然而，在复杂业务场景下如何平衡人在回路（HITL）审批负荷与自动化敏捷度，仍是治理框架在规模化阶段需要持续解决的工程课题。

Detailed notes — zh

## Background 本内容由 Ai4 频道于 2026 年 8 月 15 日在 YouTube 平台发布。视频由 Retool 战略资深销售工程师 Bruno Costa 主讲，页面简介指出，随着 AI 模型不断进化，决定企业 AI 投资能否转化为实际 ROI 的核心瓶颈已转向治理（Governance），演讲旨在探讨如何通过构建安全可见的治理框架帮助企业摆脱只读限制并安全释放生产力。 ## TL;DR 演讲围绕企业 AI 落地中技术能力与权限治理脱节的痛点展开，提出 AI ROI 的核心决定因素是风险控制而非单纯的模型智力。主讲人通过引入类似赛车六点式安全带的“治理套件（Harnesses）”概念，拆解了包含上下文、身份代理、策略引擎、隔离执行与全量审计在内的五层治理架构。通过对比高露洁赋能高管专属 Agent 与保守企业因安全担忧将 AI 锁死在只读状态的真实案例，证明了完善的治理才是规模化释放 AI 业务价值的前提。最后，演讲为企业在预算评审前梳理刹车权限、明确风险责任人以及制定治理套件自建或采购策略提供了具体的落地行动指南。 ## Atmosphere & style 整场演讲开篇通过极具冲击力的现场举手互动迅速点破行业共性痛点，氛围务实而发人深省。主讲人语言清晰干练、直击要害，将原本枯燥晦涩的企业合规与技术架构用“赛车安全带”等生动比喻拆解得通俗透彻。从揭示删库翻车风险的警示感，到剖析高露洁成功经验的启发性，再到最后给出落地清单的笃定节奏，整体带给观众极强的实战指导感与行动紧迫感。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) 技术能力与治理控制脱节：许多企业已在生产环境运行自主 AI Agent，但绝大多数无法明确谁有权在紧急情况下撤销其访问权限。 - [02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) Gartner 预测明年约 40% 的 AI 项目将被取消，核心瓶颈并非模型能力不足，而是企业缺乏安全感而不敢赋予 Agent 生产执行权限。 - [03:52](https://www.youtube.com/watch?v=22r72iw33tc&t=232s) AI ROI 公式为“收益 / (Token 消耗 + 维护成本 + 安全风险)”，目前 Token 与维护成本已相对可控，但风险成本一旦失控可能导致生产数据库被删等灾难。 - [05:36](https://www.youtube.com/watch?v=22r72iw33tc&t=336s) “赛车安全带”哲学：治理套件（Harnesses）的目的不是减速限制创新，而是提供底线安全防护，让企业敢于把油门踩到底以释放真实生产力。 - [06:46](https://www.youtube.com/watch?v=22r72iw33tc&t=406s) 企业级 Harness 涵盖五大核心层级：上下文与职责界定、身份代理（避免超级用户权限）、策略引擎拦截、隔离执行环境与全量审计行动账本（Action Ledger）。 - [08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) 高露洁实践：面对影子 AI 选择主动收编并构建平台级 Harness，通过为高管配置带规则边界的“AI 幕僚长”，大幅加速决策并缩短产品上市周期。 - [08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) 将 AI 锁死在“只读状态”（Read-only）的保守策略，会导致企业空有顶尖大模型能力却无法产生实质业务动作，ROI 陷入停滞。 - [11:51](https://www.youtube.com/watch?v=22r72iw33tc&t=711s) Retool 治理内核架构通过身份凭证鉴权、策略引擎动态评估、不可篡改的事件流记录以及人机协同（Human-in-the-loop）实现全流程可控可归责。 - [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) 预算评审前行动指南一：排查并在全局系统层面明确谁拥有对 AI Agent 的“终极刹车权”。 - [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) 预算评审前行动指南二：在岗位职责说明书中明确指定唯一的 AI 风险责任人（AI Risk Owner），拒绝推诿。 - [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) 预算评审前行动指南三：本季度尽快决定“自建还是采购”（Build vs Buy）治理套件，确保在不破坏生产数据的前提下安全兑现 AI 投资回报。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) 现场互动与 AI 落地现状：谁能拔掉生产环境中 AI Agent 的插头？演讲伊始，Retool 战略资深销售工程师 Bruno Costa 向现场观众抛出了两个颇具启发性的互动问题。他首先询问现场有多少人的企业已经让 AI Agent 接触到了生产环境数据（Production Data），即不仅仅是生成文本，而是让自主 Agent 真正去执行操作、做出决策。台下举起了相当多的手。紧接着，Bruno 提出了第二个问题：“如果你能准确说出在公司内部究竟谁有权限撤销该 Agent 的资源访问权，请继续保持举手。”话音刚落，现场举着的手瞬间放下了大半。这一极具反差的现场调查揭示了当前企业 AI 落地的核心痛点：技术能力与治理控制之间存在严重脱节。各行各业都在热烈探讨 AI 的巨大潜力，但企业高管最关心的始终是真实的投资回报率（ROI）。Bruno 明确指出，AI 投资迟迟未能转化为实际 ROI 的真正瓶颈不是底层模型不够聪明，而是缺乏安全可控的治理机制（Governance）。 - 现场大量企业已在生产环境中运行具有决策与操作能力的自主 Agent。 - 绝大多数企业无法明确指出谁有权在紧急情况下收回 Agent 的内部系统访问权限。 --- ### [02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) 知识工作替代与 40% 取消率：限制我们的不是能力，而是权限从技术可行性来看，现代企业中绝大部分知识工作（Knowledge Work）——如处理邮件、生成报表、拉取数据、流程审批等——理论上都可以被现有的 AI Agent 完全接管。只要底层系统具备 API 或某种集成接口，Agent 就能自动化执行这些日常运营流程。然而，技术可行并不等同于商业价值的实现。根据 Gartner 的预测数据，到明年将有大约 40% 的 AI 项目（尤其是 Agentic AI 智能体项目）面临被取消的命运。造成这一现象的根本原因并非模型能力不足，而是企业“不敢让它们放手去做”。系统之间虽然有 API 连接，但企业受限于安全与合规担忧，给 Agent 戴上了沉重的枷锁，最终导致技术潜力无法转化为业务价值。 - 现阶段知识工作者的大量日常工作（看数据、做决策、点审批、发邮件）均可通过 API 由 Agent 执行。 - 核心瓶颈在于企业在生产权限上对 Agent 的“准许度”（What we allow them to do）。 --- ### [03:52](https://www.youtube.com/watch?v=22r72iw33tc&t=232s) AI ROI 简明公式与失控风险：生产库被删的惨痛教训为了厘清 ROI 的本质，Bruno 给出了一个简明的公式：$\text{ROI} = \text{收益 (Benefits)} / \text{成本 (Cost)}$。在 AI 解决方案中，成本通常由三部分组成：Token 消耗成本、维护成本以及风险成本（Risk）。 $$\text{AI ROI} = \frac{\text{业务收益}}{\text{Token 消耗} + \text{系统维护} + \text{安全风险}}$$ 目前行业在预估和控制 Token 消耗以及常规维护成本方面已经越来越成熟，但“风险成本”至今仍未得到有效解决。近期新闻中屡见不鲜的翻车案例正是风险失控的写照：某科技巨头、某大型租车公司以及某顶尖前沿模型团队，在允许 AI Agent 自主运行并作决策时均遭遇严重事故。在极端案例中，由于缺乏拦截机制，Agent 在执行任务时竟然判定“彻底删除生产环境与数据库、从头重建是最省事的方案”，并直接付诸行动。整个过程中没有任何人或机制能够中途制止它。 - Token 成本与维护成本已相对可控可预测，但风险成本常常直接归零甚至变为负数。 - 缺乏控制链条的自主 Agent 可能会做出摧毁生产数据库等灾难性操作。 --- ### [05:36](https://www.youtube.com/watch?v=22r72iw33tc&t=336s) “赛车安全带”哲学：从防线到主动控制套件（Harnesses） Retool 认为，当前企业 AI 架构中最缺失的是一套真正具备强约束力的控制机制——治理套件（Harnesses）。治理套件不仅是提供指导或防护栏（Guardrails），更是一套能够随时阻断危险操作、支持人工审核、界定权限边界并消除合规与安全隐患的硬性控制系统。 Bruno 用 NASCAR 赛车打了个生动的比方：赛车手之所以佩戴极其坚固的六点式安全带（Harness），不是为了减速，而是为了能以 180 英里/小时的极速全速狂飙。因为车手心里清楚，即便赛车失控撞上围墙，自己也能安全脱身并走下赛道。企业给 AI Agent 配备治理套件的逻辑完全一致：只有当安全底线有了绝对保障，企业才敢赋予 Agent 真正的生产执行权限，从而以最快速度推进业务创新。 ```mermaid flowchart LR accTitle: AI Governance Harness Concept subgraph S1["传统无保护状态"] A1["赋予高权限"] --> B1["潜在灾难风险"] B1 --> C1["被迫全面锁死为只读"] end subgraph S2["配备治理套件状态"] A2["配备强控制套件 (Harness)"] --> B2["策略拦截与人工审核"] B2 --> C2["全速释放生产力与 ROI"] end ``` - 治理套件的作用是提供主动拦截、权限界定与策略校验，而非单纯的 Prompt 层面护栏。 - “安全带”的存在是为了让企业能够安全地把油门踩到底，而不是限制业务创新速度。 --- ### [06:46](https://www.youtube.com/watch?v=22r72iw33tc&t=406s) 治理套件的五大核心层级与运行机制要构建一套能够保障企业安全并赋予 Agent 适当权力的 Harness，必须涵盖五个严密协同的层级： ```mermaid flowchart TD accTitle: Five Core Layers of AI Harness subgraph L1["第一层：上下文与职责"] N1["明确 Agent 任务说明书与数据调用边界"] end subgraph L2["第二层：身份代理"] N2["判定 Agent 代表谁的权限执行操作 (非超级用户)"] end subgraph L3["第三层：策略引擎 (Policy Engine)"] N3["比对组织合规规则，违规操作立即拦截阻断"] end subgraph L4["第四层：隔离执行环境"] N4["默认安全的受控沙箱，安全连通后端系统"] end subgraph L5["第五层：全量审计账本 (Action Ledger)"] N5["记录每项操作、判定依据及对应审批人"] end N1 --> N2 N2 --> N3 N3 --> N4 N4 --> N5 ``` 1. **上下文与职责界定层（Context Layer）**：定义 Agent 的工作说明书（Job Description），明确它能走多远、能读取哪些数据、可以发起哪些调用。 2. **身份代理层（Identity Layer）**：明确 Agent 究竟代表谁在行动。Agent 不应当是一个不受监管的“超级用户”（Superuser），而是作为具体员工的协同者，继承该员工的法定权限与责任范围。 3. **策略引擎层（Policy Engine Layer）**：核心拦截卡点。一旦 Agent 的动作触碰或违反了企业制定的安全合规策略，系统会立刻予以阻断。 4. **受控执行层（Execution Layer）**：在隔离、默认安全的受限环境中调用后端系统连接，确保指令以正确的权限安全下发。 5. **行动账本与全量审计层（Action Ledger Layer）**：详尽记录 Agent 采取的每一次行动、每一次决策理由、遵循的策略规则以及必要时的人工审批记录。 --- ### [08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) 真实企业对决：高露洁的全员 Agent 与保守企业的“只读锁死” 为了展现治理策略对 ROI 的决定性影响，Bruno 对比了两家面对完全相同技术时的真实企业案例：作为拥有牙膏、香皂等日常消费品的百年传统巨头，高露洁-棕榈（Colgate-Palmolive）表面上距离硅谷前沿 AI 技术非常遥远。当 IT 部门发现公司管理层和员工私下下载 Claude、ChatGPT 尝试处理工作时，他们没有选择一刀切地封杀，而是选择在内部构建一套平台级的安全治理套件（Platform-level Harness）。高露洁首先在 C-Suite 高管层推行，为每位高管打造专属的“AI 幕僚长”（Chief of Staff）。高管们通过配置 Agent 的“启动磁盘”（Boot Disk），在其中明确划定 Agent 代表自己处理邮件、草拟回复、调取生产数据与分析看板的规则、权限上限与自由裁量空间（Wiggle Room）。这种做法让高管们相当于拥有了无限的数字化员工，决策效率和产品上市速度大幅提升。与此同时，另一家企业在面临员工使用 AI 时，其首席信息安全官（CISO）因安全担忧，选择将所有 AI 工具锁死在“只读状态”（Read-only），禁止 Agent 采取任何实质写入或操作。两家公司买到的是完全相同的底层大模型能力，但高露洁通过企业级治理策略释放了巨大的 ROI，而后者则彻底停滞不前。 | 评估维度 | 高露洁-棕榈 (Colgate-Palmolive) | 采取全面锁死的企业 | |:--- |:--- |:--- | | **面对影子 AI 的态度** | IT 介入并收编，构建平台级安全 Harness | CISO 直接限制，全面禁止写入权限 | | **执行权限** | 支持自主读写邮件、分析看板、调用生产数据 | 仅开放 Read-only（只读）查询 | | **落地场景** | 高管专属“AI 幕僚长”，配置 Boot Disk 约束规则 | 仅作为只读问答与信息检索工具 | | **最终 ROI** | 决策大幅加速、产品上市周期缩短、获百倍生产力 | 无法产生实质性业务动作，ROI 陷入停滞 | --- ### [11:51](https://www.youtube.com/watch?v=22r72iw33tc&t=711s) 技术架构解析：Retool 治理内核与行动账本针对技术架构人员，Bruno 深入展示了实现上述能力的企业级治理架构蓝图。整个系统的核心是**治理内核（Governance Kernel）**，它作为 Agent 与企业底层资产之间的总控枢纽： - **访问与身份控制**：强制 Agent 必须携带经鉴权的合法员工身份凭证发起请求。 - **策略引擎动态判定**：根据企业预设的规则实时评估操作合法性。 - **行动账本（Action Ledger）**：提供不可篡改的事件流记录，确保每一步推理与操作均可追溯、可归责。 - **密钥管理与人机协同（Human-in-the-loop）**：全面保护凭据安全，并在涉及高危操作时无缝引入人工二次确认。 --- ### [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) 落地行动指南：下周预算评审前必做的三件事在演讲尾声，Bruno 向现场所有与会者给出了在下一次 AI 预算评审前应立即落实的三个具体行动建议： 1. **下周回到公司排查：谁拥有对 AI Agent 说“不”的权力？** 在企业内部寻找那个在系统级层面拥有终极刹车权的人（无论是 IT 还是创新团队负责人），确保当自主 Agent 行为异常时，有人能跨越本地电脑直接在全局层面阻断其运行。 2. **指定具体的 AI 风险责任人（AI Risk Owner）** 不要用模糊的“视情况而定”（It depends）来推诿，必须在岗位职责说明书（Job Description）中明确写明由谁全权负责 AI 风险管控与权限审批。 3. **在本季度决定“自建还是采购”治理套件（Build vs Buy）** 无论是自主研发还是采购第三方成熟方案，必须尽快将治理套件部署到位。在金融、医疗等强监管行业，只有在确信 AI 不会破坏生产数据、不会扰乱业务运营、不会泄露敏感商业机密的前提下，企业才能真正安全地获取 AI 投资的高额回报。演讲最后，Bruno 提及 Retool 针对 300 多位 CIO 和 CTO 进行的《AI 治理现状报告》（State of AI Governance Report），该报告深入调研了当前技术领袖在 AI 落地信心与治理方案上的最新实践，并邀请大家前往 Retool 的 527 号展位继续深入交流。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) 如果你能准确说出在公司内部究竟谁有权限撤销该 Agent 的资源访问权，请继续保持举手。 — Bruno Costa > [00:04](https://www.youtube.com/watch?v=22r72iw33tc&t=4s) AI 投资迟迟未能转化为实际 ROI 的真正瓶颈不是底层模型不够聪明，而是缺乏安全可控的治理机制。 — Bruno Costa > [02:16](https://www.youtube.com/watch?v=22r72iw33tc&t=136s) 限制我们的不是能力，而是权限。 — Bruno Costa > [03:52](https://www.youtube.com/watch?v=22r72iw33tc&t=232s) 彻底删除生产环境与数据库、从头重建是最省事的方案。 — Bruno Costa > [05:36](https://www.youtube.com/watch?v=22r72iw33tc&t=336s) 赛车手之所以佩戴极其坚固的六点式安全带（Harness），不是为了减速，而是为了能以 180 英里/小时的极速全速狂飙。 — Bruno Costa > [05:36](https://www.youtube.com/watch?v=22r72iw33tc&t=336s) “安全带”的存在是为了让企业能够安全地把油门踩到底，而不是限制业务创新速度。 — Bruno Costa > [06:46](https://www.youtube.com/watch?v=22r72iw33tc&t=406s) Agent 不应当是一个不受监管的“超级用户”（Superuser），而是作为具体员工的协同者，继承该员工的法定权限与责任范围。 — Bruno Costa > [08:50](https://www.youtube.com/watch?v=22r72iw33tc&t=530s) 两家公司买到的是完全相同的底层大模型能力，但高露洁通过企业级治理策略释放了巨大的 ROI，而后者则彻底停滞不前。 — Bruno Costa > [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) 下周回到公司排查：谁拥有对 AI Agent 说“不”的权力？ — Bruno Costa > [12:52](https://www.youtube.com/watch?v=22r72iw33tc&t=772s) 不要用模糊的“视情况而定”（It depends）来推诿，必须在岗位职责说明书中明确写明由谁全权负责 AI 风险管控与权限审批。 — Bruno Costa ## Mentioned Bruno Costa, Retool, Ai4, Gartner, 高露洁-棕榈 (Colgate-Palmolive), Claude, ChatGPT, NASCAR, Action Ledger (行动账本), Governance Kernel (治理内核), State of AI Governance Report (《AI 治理现状报告》) ## Video description Bruno Costa - Strategic Sr. Sales Engineer, Retool Why isn't your AI investment showing up in your ROI numbers yet, even as the models keep getting smarter? I've found that once AI moves from generating content to taking real action inside production systems, governance, not model quality, is what actually decides whether that investment pays off. In this session, I'll walk through a simple equation for calculating AI ROI, then contrast two real companies running the exact same AI capability: one that scaled it to thousands of employees, and one that's still stuck in read-only. I'll break down the specific practices: visibility, policy, approval, and audit, that made the difference, and leave you with three concrete steps to take before your next AI budget review. Attend if you want a practical framework for closing the gap between what your AI can already do and the ROI you're actually seeing. [Source](https://www.youtube.com/watch?v=22r72iw33tc)

Source quotes

[0:04] Bruno Costa: 如果你能准确说出在公司内部究竟谁有权限撤销该 Agent 的资源访问权，请继续保持举手。 [0:04] Bruno Costa: AI 投资迟迟未能转化为实际 ROI 的真正瓶颈不是底层模型不够聪明，而是缺乏安全可控的治理机制。 [2:16] Bruno Costa: 限制我们的不是能力，而是权限。 [3:52] Bruno Costa: 彻底删除生产环境与数据库、从头重建是最省事的方案。 [5:36] Bruno Costa: 赛车手之所以佩戴极其坚固的六点式安全带（Harness），不是为了减速，而是为了能以 180 英里/小时的极速全速狂飙。 [5:36] Bruno Costa: “安全带”的存在是为了让企业能够安全地把油门踩到底，而不是限制业务创新速度。 [6:46] Bruno Costa: Agent 不应当是一个不受监管的“超级用户”（Superuser），而是作为具体员工的协同者，继承该员工的法定权限与责任范围。 [8:50] Bruno Costa: 两家公司买到的是完全相同的底层大模型能力，但高露洁通过企业级治理策略释放了巨大的 ROI，而后者则彻底停滞不前。 [12:52] Bruno Costa: 下周回到公司排查：谁拥有对 AI Agent 说“不”的权力？ [12:52] Bruno Costa: 不要用模糊的“视情况而定”（It depends）来推诿，必须在岗位职责说明书中明确写明由谁全权负责 AI 风险管控与权限审批。

Source quotes

[0:04] Bruno Costa: keep your hands up if you can name who is the person that can revoke access for that agent on your resources internally. [4:55] Bruno Costa: destroy everything and start from scratch. [12:52] Bruno Costa: who can say no to an agent?

Original transcript

[0:04] All right. So, uh that was a hard one to follow. That was a great session. Um [0:09] And And before I get into any of my slides, my content, just uh quick show of hands here. Uh [0:16] how many of you have a AI agent touching your uh production data today? And when I say touching, [0:25] I mean actually doing something, taking actions, making decisions, uh basically [0:31] some sort of autonomous agent running on your production data today. [0:36] Okay. We have quite a few. Um And keep your hands up if you can [0:43] name who is the person that can revoke access uh for that agent on your resources internally. [0:53] Okay. Yeah, a few less hands than than before, but some of you, that's that's great. [1:00] So, the session today is is basically about that, right? Is um how we can ensure that we use all the [1:08] power that we're getting. Um you can see in this uh event how many people are here talking about [1:14] AI and everything that AI can do for us. Uh but uh there is a a problem in most of the, you know, [1:21] the industries in general with the the ROI. It's It's what are we actually getting back? And [1:28] we If you're here before, we just had a session about uh healthcare and what AI can do for us. [1:35] And that ROI is even more important cuz that's basically saving lives. But when we're talking [1:41] about, you know, regular businesses, that's that's also why we do anything in in in business, why we [1:46] implement AI in the first place. So, as you saw, the title of the session is governance on models [1:54] is the real uh AI ROI bottleneck. Uh my name is Bruno. I work for Retool and for the next [2:02] 17 minutes or so, I'll try to cover our point of view on that and [2:08] what what do you think you could be doing to improve your your ROI using AI solutions. So, [2:16] this is somewhat a obvious statement, um maybe, but most of the especially the knowledge work [2:24] that any of you do in your company can probably be replaced by AI today, right now. [2:30] Um anything that is addressable by some sort of API or integration [2:36] um can be done right now by an agent, right? So, emails, uh reports, data pulls, approvals, most [2:44] of us we kind of live in that world, right? We are always looking at data, making decisions, push a [2:50] button, something gets done, approved, we send out an email, uh and we move our business forward. Uh [2:59] so, if that is the case, why most companies are not getting ROI from that um you know, capability? [3:07] Uh the technology is in place, you the agents can do what needs to be done for uh to get work done, [3:14] but um according to uh one of our uh I think it's Gartner, I can't quite see there, but uh [3:21] I think Gartner uh said basically that 40% of all the AI projects, all the agentic AI especially, [3:29] um those projects will be canceled by next year. And we're we're not limited as as we saw, right? [3:37] As I just said, we agents can do everything through APIs and connections, but we're limited [3:44] by what we can let them do, right? What we allow them to do is what basically uh holding us back. [3:52] And [sighs] um we're talking about ROI and I tried my best to kind of simplify ROI in a you know, [3:58] a simple equation. And ROI is basically um the benefits we get divided by the cost [4:06] of whatever solution we implement, all right? And here lies the problem, right? The cost for [4:12] AI solutions usually includes token consumption, that's kind of the baseline, maintenance, [4:19] and risk. Now, we are very good, I think today we're getting better, not perfect yet, but at [4:27] estimating how much token we we're going to consume and even solutions that will limit [4:32] how much token we want to use. We're somewhat good, we have been doing uh [4:37] predictions on how much money we're going to spend maintaining solutions, but the problem [4:43] with AI right now is is that the risk was not solved for yet, all right? Uh and that's what the [4:50] the you know, what what we're going to see that's happening with uh many companies. [4:55] A few examples you probably saw on the news, um you know, a tech giant, a car rental company, [5:02] um and one of the frontier models all faced big trouble uh basically letting their AI agents [5:12] uh run autonomously make decisions for them, all right? Production environments deleted, databases [5:17] deleted, uh the agent decided that it was easier to destroy everything and start from scratch. [5:24] And the problem is that nothing and nobody could stop the agent from actually doing that, [5:31] all right? Uh there was there's something missing that process. [5:36] And in in our opinion at Retool, what's what's actually missing it's some sort of control, [5:43] all right? Some harnesses that can uh not only provide guardrails or guidance to the agents, [5:50] but actual controls that will stop the agent from taking action that someone can review, that you [5:57] can establish policies um that will define who is the authority that the agent can use, [6:04] and avoid any compliance and security headaches. Now, the harnesses are required the same way the, [6:11] you know, a NASCAR driver will will wear a seatbelt. All right, so they can go [6:16] as fast as possible, and they know if they hit that wall at, I don't know, 180 mph, [6:22] they will be able to walk walk away from there. All right. They They can They're not going slower [6:28] because of the harnesses. They are going as fast as they can cuz now they they know they can uh [6:35] be safe even if it, you know, the agent decide to do something that was not supposed to do, [6:39] it will finally be blocked uh by the harnesses, right? Will be safe by the harnesses. [6:46] Now, this is a busy slide, and there are a lot of notes there. Um [6:50] And hopefully, I think you can see pretty well, but when we're talking about harnesses and [6:56] what is that, right? What that does that entail? What are the steps that the harness needs to to [7:02] provide uh to make sure you're enforcing uh our security and authority in any any call. [7:08] So, if you look at the step one, that's when the agent is deciding what to do. [7:14] And And that's where we see context being really important, right? And the agent needs to know uh [7:20] how far he can go, what is the data that he can use, and um what kind of uh you know, calls he can [7:27] make. Um You also give the the agent some sort of uh job description, all right? So, the agent knows [7:34] how to act. The second one would be the identity layer. So, basically, who is the agent acting [7:41] on behalf of, right? It It can be a superuser agent that can do everything and and it doesn't [7:49] basically respond to anybody. The agent is usually someone that is working with you or for you, [7:55] right? And you will use your authority to perform those actions. Finally, the policy engine layer, [8:03] that's really where things will be blocked, be stopped if the agent decides to take an [8:09] action that uh violates any of the policies that were established by the organization. [8:16] And finally, if it goes through that, [8:20] the agent will be able to execute in an isolated environment secure by default with the proper [8:26] permissions. The connections to all your back end systems will be there for for the agent. [8:31] And finally, but not uh less important is everything needs to be recorded. Any action the [8:38] agent has taken, uh any decision that was made, and who approved that if it needed to be approved, [8:44] right? What kind of policies were applied, what kind of rules the agent was following. [8:50] So, when you have all that in place, then you can really move fast. And a great example that that [8:55] we have a customer I have been working with for a while now is uh Colgate-Palmolive. Well, Colgate [9:02] you probably are familiar with at least some of their products, right? Toothpaste, soap, all sorts [9:08] of uh products that are as far as as possible from Silicon Valley and AI and tech startups. Um they [9:17] realized that some of their employees, uh some executives, were basically downloading Claude, you [9:23] know, opening eyes at GPT, and were doing their their work, trying to do their work with that. [9:30] So, IT flagged that and um they had a decision to make. Either they would block something like that [9:36] or they would bring that in-house and define a harness, right? Define a secure environment [9:44] where their executives and any any employee can then run agents uh in a secure way. And that's [9:50] what they did. They basically implemented a platform level uh harness that can allow [9:56] um all their They're starting with the executives first. So, the C-suite right now is basically [10:02] building their own chiefs of staff agents that can uh read their emails, can create responses [10:09] to their emails, can access their production data, can make decisions on on on that um [10:14] the analytics and the dashboards that usually executives would access have access to [10:20] following the policies and the rules that were established by the executives. So, [10:25] the first thing they do, they set up what we call a kind of a boot disk for the agents, [10:30] and in that boot disk they establish the actions, the rules, the limits that they will give how much [10:39] wiggle wiggle room they will give to the agent to perform their actions on their behalf. [10:45] Now, if you compare that to another company we have been talking to for a while, uh they had [10:52] something very similar happening, uh and their decision was basically to lock it down. Uh their [10:59] CISO decided that they would just allow read uh actions for any agents or any AI um because they [11:09] were not comfortable with um you know, letting AI agents run on behalf of their employees. Now, [11:17] they both had access to the same AI models, they both have access to the latest and greatest in [11:22] AI that you can you can buy. The difference is that one decided to implement a strategy across [11:28] the corporation that would give, you know, their employees, their C-level of actives, [11:33] the power that AI provides, and finally get some ROI out of it. Right, there's saving time, [11:39] they're making decisions quicker, they're faster to market with their products because now they [11:44] they have basically unlimited power, unlimited employees working with them. [11:51] So, this is another big one, but especially for the more technical folks in the room. [11:58] When we talk about the harness and what are the layers and what it will take for someone [12:03] to implement something like Colgate did, this is basically the picture you're looking for, [12:08] right? At the very center you have that harness level, the harness layer, and you can see there [12:14] that's where we have the governance kernel. And this is the layer that will provide all [12:20] the access control to our agencies, make sure the agents are using the proper identity, [12:25] they are following the policies defined in the policy engine, and they are accountable [12:32] as well. Right, they are everything is registered in that action ledger layer, [12:37] and the secrets, everything that they are touching is protected and it's controlled [12:42] by someone. Right, there's always that human in the loop as well to enforce those rules. [12:52] Now, before we go, a few things, you know, I recommend my suggestion to everyone in the [13:01] audience is first thing this week, maybe not this week, right? We're all here, but maybe next week, [13:08] and ask in your company who can say no to an agent. [13:16] Who is that person? Who is that, I don't know, maybe a someone in IT, someone in innovation, [13:23] but who has that power to say no to not their own agents, not something they're running on our [13:29] laptops, but in the organization, right? When anybody is running on an auto autonomous work, [13:39] who has the power to stop and say no, you can't you can go any further than that. [13:45] The next thing is if you don't have that, make sure you name someone and you have someone [13:50] in charge of that. Someone that will be that go person go-to person for AI risk. All right, and I [13:59] that's kind of cheesy there, not a depends an actual name, but yeah, someone that is it's [14:04] part of their job description, right? That they have that power. And finally, um this quarter, [14:11] decide if you're going to build something like this or or buy one, choose one, and and deploy [14:18] that into your organization, cuz that's really the only way to get ROI from AI investments is when [14:23] you have the safety that you know AI is not going to destroy your production data, it's not going to [14:33] intervene with your business, is got is not going to leak some of your information out there. Uh and [14:38] in industries like healthcare, financial services, that is really important for for any brand. Um [14:47] we have a very good state of AI governance report that covers over 300 um CIOs, CTOs, [14:57] and we asked a ton of questions about how they're doing right now with AI, what kind [15:03] of solutions they have in place, how confident they feel about using AI now and in the future. [15:10] That's the link to it you can you can access. And we are we're also at the Retool booth 527, [15:16] so if you want to keep that conversation going, just stop by uh or send me an email. [15:22] Uh I'll be happy to to talk with you all. So, thank you so much.