Speaker A
[Music]
Explore securing AI agents with Sierra's approach, covering autonomy, risks, guardrails, and enterprise-grade platform solutions.
Key Takeaways
- AI agents are becoming the primary interface for customer interaction across multiple industries.
- New risks from autonomous agents require advanced security guardrails and shared responsibility models.
- Sierra provides an enterprise-grade platform with SDK and no-code tools to securely build and manage AI agents.
- Explainability, auditability, and continuous testing are critical for compliance and trust in AI agents.
- Robust platform design ensures reliability, security, and scalability for production-grade AI agents.
What the video covers
- Introduction to the rise of AI agents and their adoption across industries like retail, healthcare, and financial services.
- Discussion on the evolution from rule-based software to autonomous AI agents capable of complex workflows and actions.
- Identification of new risks such as nondeterminism, prompt injections, and the need for explainability and auditability.
- Overview of shared responsibility models in securing agentic AI involving customers and AI providers.
- Sierra's approach to security, privacy, and reliability in managing AI agents through platform-level solutions.
- Deep dive into the anatomy of an AI agent, including autonomy, tool calls, and decision logic management.
- Introduction of Sierra's Agent OS platform, featuring a model constellation, agent SDK, and no-code Agent Studio.
- Agent SDK capabilities include declarative agent definition, extensibility, guardrails, and supervisor agents.
- Importance of reliability, accuracy, performance, and continuous testing including red teaming and regression tests.
- Strategies for zero downtime, latency reduction, and comprehensive security policies to protect AI agents.
Chapters
- 00:00Introduction and Overview of AI Agents
- 02:37Evolution of Customer Interaction: Internet to AI Agents
- 04:19Industry Use Cases for AI Agents
- 05:50Risks and Challenges of Autonomous AI Agents
- 07:27Customer Questions and Security Concerns
- 09:03Deep Dive into Agent Anatomy and Platform Security
- 10:16Agent SDK and Guardrails
- 11:38Reliability, Testing, and Security Practices
- 14:32Advanced Security Measures and Threat Mitigation
- 17:44Ensuring Zero Downtime and Performance Optimization
Full Transcript — Download SRT & Markdown
Speaker A
[Music]
Speaker A
[Music]
Speaker A
[Music]
Speaker A
Hey everyone, I'm Akila Chid Brolu. I manage the security and compliance function here at Sierra. I'm joined by Kevin Ga, our head of platform engineering. We'll share today the rise of agents, how they came to be, who is using these agents, and how.
Speaker A
We'll also share a number of opportunities and challenges that come with the use of agents. We'll share Sierra's own approach to how we handle security, privacy, and reliability of these agents. Kevin will also walk us through the anatomy of an agent, what guardrails to place, and how to manage a large scalable conversational AI platform.
Speaker A
If you remember the age of the internet, where every business launched a website to basically interact with their customers, in the mobile era, we saw that every company then built mobile apps to interact with customers.
Speaker A
In the same way, in the age of AI and LLMs, every company is and is going to use agents as the primary interface to interact with their customers.
Speaker A
Being in the security industry, we've already seen the shift from when we went on-prem to cloud and started using the cloud security providers. We've learned to use shared responsibility models, and security primitives and guardrails evolved with the cloud infrastructure.
Speaker A
In the same way, we expect that in the agentic AI world, there will be responsibilities across customers and the various providers, whether those are large language model providers or the agentic AI providers.
Speaker A
A little bit of Sierra, where we see that customer experiences can be greatly improved through humanlike experiences, where a typical chatbot that can answer or look up an order for you can now chat with you, send an email, message you on your phone, or even speak to you.
Speaker A
And these are all different ways in which agents are already interacting with consumers. What's more exciting is that these agents are already adopted across a range of industries.
Speaker A
For example, if you see the retail industry in a chatbot way, it could only look up an order. But today, an agent in the retail industry can be used to not just look up an order, but to actually place that order, change shipping information, or even troubleshoot any delivery issues.
Speaker A
In a healthcare situation, a patient can check up on their latest claim update, can ask questions explaining what benefits they have or not. It can also help with billing questions that a patient might have.
Speaker A
In the same way, in financial services, the agent can now look up account information, help dispute transactions that you may have.
Speaker A
And these are only the start of how different industries are looking at solving consumer-facing problems through sophisticated workflows.
Speaker A
As we just spoke about agents solving sophisticated workflows, it just means that the responsibilities that these agents have are pretty broad and pretty complex.
Speaker A
Clearly, agents can think, reason, and take action, which the traditional software we all grew up with that was rule-based couldn't do.
Speaker A
This means there are new forms of risks that arise with the use of agents. Take the example of nondeterminism. Since we're no longer using rule-based software, there is no same answer that you can expect from that agent.
Speaker A
But this just means we'll have to apply additional guardrails to see where determinism is absolutely required versus not. And these are the flexibility that the agent should provide by default.
Speaker A
Same with autonomy. We talk about agents being able to take action autonomously, and they can make tool calls and give output to the end user.
Speaker A
This means we have the responsibility to add need-to-know access and appropriate authentication to these agents.
Speaker A
And these are just some examples, right? So let's talk about explainability. This is something we would need, especially in the world of security and compliance, to backtrack how the agent came about the decision that it did, how it brought out the output that it did.
Speaker A
And this is also especially useful. It goes back to auditability and even for forensics. But this is not all. This is just the beginning of how many risks that agents will bring, and those are continuously evolving in today's industry of agentic AI.
Speaker A
We talk to hundreds of customers every day. AI security leaders are asking all the right questions. How can I monitor my agent's performance? What if the agent goes off script? How do you handle prompt injections? And also, how do you manage the agent decision logic and many more?
Speaker A
And these are the right questions that we should be asking and building security and responsible AI guardrails around.
Speaker A
We talked about agents being able to think, reason, and take action, which at the tip of the iceberg means as long as we have an LLM, a RAG, and are able to make a tool call, an agent can be deployed. With the commoditization of the RAG tools with MCP, it's easier than ever to launch that first agent.
Speaker A
But that's just the basics of an agent, and that's just the user-facing layer for that agent. As we think deeply about our customer needs and as we deploy these agents across the various industries and especially in the regulated industries, questions come up around intent-based routing.
Speaker A
How are we doing handoffs? Where is human in the loop? How do I test that my agent is working appropriately? What does voice support look like? If I deploy for chat, does it equal deploying for voice also? What additional work do we need?
Speaker A
And this just means we should think more deeply about how the agent might work in real time, and this is exactly what Sierra is doing to enable enterprise-grade agents that are more supported at the platform level, at that enterprise level, and not just calling an LLM and making a tool used to take that action.
Speaker A
This is where Kevin is going to deep dive into the autonomy and anatomy of the agent and also speak about how we think deeply at the platform level on security, responsibility, and reliability of managing AI agents.
Speaker A
Thanks, Akila. And yeah, as Akila alluded to, just doing LLM calls, tool calls, and using RAG is just the tip of the iceberg. But we want to make it as easy as possible for our customers to adopt agents securely and run them in production reliably.
Speaker A
And so that's why we built Agent OS, our platform. And if we start at the base of the platform, all our agents are based on a constellation of models that we govern to ensure that we're meeting security and compliance requirements, but at the same time, we're still providing the sort of best-of-breed performance for agents out of the box for customers.
Speaker A
And then the next layer up, we have a pretty core piece of our platform and foundation, which is our agent SDK. So the agent SDK allows you to declaratively and in an introspectable way define your agents.
Speaker A
This allows you to build sophisticated agentic workflows that can take very complex actions, very long trajectories. So sessions lasting, you know, 20, 30 minutes with a user, and allows you to also importantly inject determinism where you need it.
Speaker A
So if you need to be able to enforce a critical policy or you need to handle a sensitive action, you can do that all with good old-fashioned programming and give you the assurances that you need that we're not leaving it up to chance because an LLM thought it would be a good idea.
Speaker A
Additionally, the SDK ships with guardrails out of the box. We call some of these supervisor agents, and so we'll go into this in more depth in a little bit.
Speaker A
But the SDK is also very extensible, allows you to define your own custom supervisors, and also allows you to extend and define your own guardrails as well.
Speaker A
We do realize, however, that not everyone who wants to develop an agent is a technical person or engineer.
Speaker A
And so we also provide our Agent Studio, which allows nontechnical folks to build just sophisticated agents in a no-code way using natural language.
Speaker A
And what's really powerful about this is it's built on top of the SDK as well and it works.
Speaker A
development life cycle. And so taking a step back, wanted to just talk through again what the principles are when we think about deploying agents. So one is security, being responsible as we deploy AI, which is a new technology. And third
Speaker A
is reliability. Reliability here is not just reliability in the business continuity sense also accuracy, performance and being able to use sort of uh best models available while still uh maintaining uh uptime as well. On the security front, this is where we're
Speaker A
going to do a deep dive. uh we take a very defense in-depth approach to security starting with the foundations of our uh secure agent development life cycle and then I'll also go through and walk through in a more general way how
Speaker A
we think about agents walking through all the sort of threat vectors that we see with agents uh and because of this new software paradigm and then also talk through mitigations as well starting again with that foundation of the secure
Speaker A
agent development life cycle first is actually defining and building the agent maybe from the for the first time and So, uh, what we want our agent developers to care about is defining the goals and importantly the guardrails for
Speaker A
their agents. And these are the things that help determine like agent behavior as well as safety mechanisms to make sure the agent's not veering off course.
Speaker A
And then once you have the initial version of the agent built, uh, we before you even release it to production, again, we want our users to build out that suite of simulations. You can uh use the platform to also help you
Speaker A
generate those scenarios and simulations and regression tests. And this is uh to ensure that before any release your agents are robust, not regressing and performing well. And we also recommend here including things like red teaming exercises. So including uh malicious
Speaker A
prompts if you will to make sure that those agents are staying robust to those as well. We incorporate into the product a very structured change management life cycle which mirrors what you might think about in a software development life
Speaker A
cycle. And so you can cut new releases that are hermetically sealed uh point in time release them, roll them out slowly, roll back. And we want to make sure that our customers have all the control to be able to do this uh if they do see any
Speaker A
issues or uh want to have full control over their change management. And lastly, I'll just briefly touch on uh your agent should be you should be constantly evaluating your agents performance. Uh and so this is done using a mix of analysis reporting and
Speaker A
also just proactive insights that we surface to our customers. And lastly, uh you use this analysis in order to restart the loop, optimize your agent performance, and improve your agent over time. And so now I just want to go
Speaker A
through the anatomy of how we think about an agent in the modern day. uh and you know agents are actually not a new concept. There's a lot of literature in academia on them. The academic definition is an entity that's capable
Speaker A
of acting on an environment and doing that uh autonomously. And so if you think about that in the modern day and I think uh in the industry what people have come to think about agents really I think there are some core components
Speaker A
here. So the environment that agents are interacting with are your external business systems uh as well as uh things like your data stores, knowledge bases, etc. There's also uh they're usually acting on behalf of an external user.
Speaker A
And so there's some semblance of input and output involved as well. And then the sort of like core piece of what we think about the agent is oftentimes powered by an LLM or large language model. And oftentimes these LLMs provide
Speaker A
capabilities such as planning and also reasoning. Um, and the last sort of component here I'll just briefly touch on is memory. Uh, one of the powerful features of sort of the best modern day agents is these this idea of memory. You
Speaker A
can use that to personalize experiences and also just uh keep track of things that worked didn't work uh to uh improve performance over time. And of course with all this and this new paradigm agents brings a lot of new threats. Uh
Speaker A
and so essentially every component of this uh anatomy or architecture is uh a new threat vector essentially. And so we'll start with uh maybe the most obvious one which is uh inputs and outputs. And from the perspective of
Speaker A
users being potentially untrusted or oftentimes untrusted uh it opens you up to uh an attack uh known as prompt injection which Aquila had mentioned.
Speaker A
Prompt injection is where a malicious input is used to cause unintended behavior for the agent. That may be either taking action uh trying to leak information or exfiltrate data. uh it could also be trying to overwrite the system prompt in order to essentially
Speaker A
take over the agent or even affect the output in a way that causes reputational harm. And so the first thing we would suggest here is implementing uh what would be called an input guard.
Speaker A
Essentially what this is is a classifier or set of classifiers that runs over the input before passing it along to the core piece of the agent in order to classify to see is this potentially abusive or a threat or malicious and
Speaker A
then if so determine what action you want to be able to take whether it's ending the session, blocking the user, escalating to a human. Uh these are all uh valid examples of what you could do upon detecting that. Um, and an often
Speaker A
forgotten piece of this as well is being able to do output filtering. Uh, because of the non-deterministic nature of LLMs and this whole system as a whole, agents have the ability even if uh, an input passes your input guards, it could have
Speaker A
the ability to produce some output that may, you know, cause reputational harm or just generally be not be good or uh, leak data, etc. And so it's still important uh, as a next step to also include that output filter. So you have
Speaker A
those same protections even if something happened in between the input and outputting the data. The next piece I want to talk about is protecting your trusted systems. And so here I'll highlight two your business systems are definitely within the trust boundary
Speaker A
that you want to protect. Your knowledge base as well should also be within a trust boundary. And I'll start with the business systems here but the principles apply across the board. Um so you want to leverage uh you know your existing
Speaker A
best practices around identity and access management. Make sure that your agents have a clear identity uh and that uh they're not overly scoped in access and you're using secure communication uh authentication that follows best practices and uh standard protocols as
Speaker A
well as uh authorization that minimizes scope and access. I also want to talk through a slightly more advanced technique here. Uh one of the nuances with agents is they often have service account level access to some of these
Speaker A
systems. And uh one of the more advanced techniques you can implement is to actually downscope the level of access they have based on the context whether that's the user, the session, the intent of the session to limit the blast radius
Speaker A
of what could happen within that agent and protecting it with traditional access controls. In addition, uh having more guard rails and we implement these in our SDK and our uh agent studio as policies and standard operating procedures that protect the agent from
Speaker A
taking the wrong action or doing something that goes against your policies is very important. And as I alluded to before, four very critical processes or uh systems or policies. Uh you may actually just want pure uh deterministic logic to handle these.
Speaker A
Take for example uh refunding a user uh money from a order or uh for example making account changes. Those are very sensitive operations. You don't want to leave that up to an LLM to determine what tool to call when, what data to
Speaker A
pass where. And so being able to fall back and inject that determinism where you need it is super important. And the next area I want to talk about is knowledge itself. So LMS have essentially been trained on the entire
Speaker A
archive of the internet especially for companies that have a relatively large presence. A lot of the knowledge about a company may be in that latent training data uh from the pre-training period of LLM. And so it's really critical that uh
Speaker A
you are leveraging trusted knowledge sources and grounding your data in that knowledge uh and ensuring that your retrieval augmented generation uh pipeline that rag pipeline uh is being leveraged well and that you're not hallucinating answers and there are
Speaker A
various techniques uh to do that. Um and lastly, I think uh even if you are using a trusted knowledge base, which we highly recommend, you still are prone to some uh threat vectors such as you can imagine a uh insider threat or a
Speaker A
disgruntled employee who has access to the knowledge base because of their role. Inject some malicious knowledge that attempts to overwrite a system prompt uh attempt to wreak havoc or just excfiltrate data. uh any of those examples uh is possible and uh I
Speaker A
definitely recommend uh putting in essentially sanitization and validation when you are reading this knowledge. Um and you can also implement outofband processes to essentially audit your knowledge bases. I would also uh recommend here having uh change management and versioning for those
Speaker A
knowledge bases and we sort of incorporate all of these into our agent development life cycle and that release process for agents. The uh last piece I'll talk about as far as something to consider here and this is not an
Speaker A
exhaustive list is for highly sensitive actions uh you may want to consider a user experience where uh if the agent wants to take a very sensitive action say for example drop a database and you may want to actually include a human in
Speaker A
the loop there to review and approve the action that the agent wants to take before actually allowing the agent to execute it. And we talked a lot about the agent anatomy itself, threat vectors, how to mitigate them. There's
Speaker A
also so much more that are outside of the agent anatomy uh and the agent runtime that you should consider. We talked about evaluations. Uh there are companies and firms that do red teaming now and also internally you should be
Speaker A
doing your own red teaming. We talked about regression tests being super critical to make sure that as you're developing your agent over time, it's not uh falling behind in performance or safety. talks quite a bit about change management. Um, so incorporating that in
Speaker A
the best practices you've learned from say software development is extremely key. And uh, an interesting principle as well is to not forget about your traditional infosc practices and controls. A lot of the same threats actually apply or the the way that
Speaker A
threats are uh, explore and apply. For example, when people are trying to do prompt injection, there's now automated tools to essentially try all the new techniques. And so if you actually invest in uh traditional techniques such as rate limiting that can be extremely
Speaker A
helpful for making your u agents more resilient and secure. Uh lastly here make sure you're monitoring your agents and once they're in production uh to be be responsible in your deployment of AI you want to make sure that your agents
Speaker A
are traceable uh there's explanability in why the agents did what they did and you also have audit trails for all the actions the agent took. And to talk about what I mean by explanability here, for example, is just a simple user
Speaker A
inquiry uh talking about wanting to cancel their subscription. But when our demo agent here receives this, it actually goes through does a lot. It receives the context of who the user is, grabs data about the user, uh it looks
Speaker A
at, you know, what offers they're eligible for. It will update some systems of record. It'll try to detect abuse that's happening. um and then take in uh some input and essentially decide like what to do next. Even though this
Speaker A
is just a very simple oneline uh query, if we see the response, we want to be able to know why that response is generated. And the last piece here, hopefully if you're adopting agents, you're adopting them because it's going
Speaker A
to make an impact on your business. And because of that, it's not just about security, it's also about business continuity and making sure that your agents are actually up and available because presumably you put them into pretty critical paths. And so, uh, one
Speaker A
of the things that we found LMS are very new piece of infrastructure. And because of that, uh, we've found historically in recent time that, uh, model providers can go down and can have less uptime than would be desirable for a mission
Speaker A
critical application. And so we've invested a lot into essentially building an adaptive router layer which can in real time be monitoring the health and latency of all our providers. And we will adaptively shift traffic over to fail over in real time to essentially
Speaker A
have zero downtime. And how we achieve that zero downtime as well is through uh a mix of other strategies such as retries or we reduce latency uh for tail latency by hedging requests. And so these are all systems techniques that uh
Speaker A
are very applicable and especially because LMS are such a new piece of infrastructure. Thank you Kevin for that detailed agent anatomy and architecture overview. I'm sure our u audience appreciate the details. And to recap really we learned that agents are here to stay. Agents are
Speaker A
multimodel omni channel. They can speak many languages. They can interact with the end users through chat, email, messaging and voice. And companies across the various industries are quickly adapting these agents and like Kevin mentioned the business purpose of
Speaker A
uh why that agent is enabling your business is important and that also directly translate to the kind of AI agent tech vendor that you may choose to build with or even if you're building the AI agent internally. We've learned
Speaker A
that it takes quite a bit of platform level thinking and not just what's on the tip of the iceberg. We should also dig into as security experts into the architecture of the agent, the anatomy, what kind of models are being used and
Speaker A
how those decision-m and deployment paths look like. So that we're not just looking at the security at the top layer but actually looking deeper for those defense and depth controls and where required have that flexibility for the agent to either be deterministic or
Speaker A
non-deterministic to determine the level of autonomy that agent needs. And going back to basics on security, we should evolve our first principles on how we think of um secure by design or uh privacy principles or shared responsibilities. But in the world of
Speaker A
agent tech um AI capabilities because today to build enterprise grade agents we cannot just quickly launch an agent because it's easy to do so but we should be doing that to be sca to scale the agents in a responsible and secure
Speaker A
manner. Thank you. [Music] [Music] [Music]
Topics:AI agentsagentic AIsecurityprivacycomplianceSierraAgent OSSDKenterprise AIAI guardrails
![[YTP] Jordan Peterson: Rat King — Transcript](https://i.ytimg.com/vi/0qUoznGIe1M/maxresdefault.jpg)
![Nick & Charlie ‣ their story [+heartstopper forever] — Transcript](https://i.ytimg.com/vi/p4TiW1TZM3w/maxresdefault.jpg)
