The Insider You Built with author Camille Stewart Gloster.

Dave Bittner: Welcome to another special edition of the CyberWire. I'm Dave Bittner. Today I'm joined by Camille Stewart Gloster, former Deputy National Cyber Director at the White House and author of the new book, "The Insider You Built: How Organizations Stay in Control of Autonomous AI Agents". Her book looks at what changes when AI stops simply answering questions and starts taking action on our behalf, and how organizations can delegate authority to those systems without surrendering accountability and control. Here's my conversation with Camille Stewart Gloster. [ Music ] Well, let's start off with just some high-level stuff about the book. What prompted you to take on this topic?

Camille Stewart Gloster: I began working with companies to deploy AI within their organizations after leaving the White House, and remarked at just how many organizations were confused, worried, unsure about the effort that they were undertaking. And wanted to move forward because the technology was something they felt they needed to keep pace with how change was happening across industry, but were not making the necessary investments across security and even just operational resilience to understand how the technology was changing the nature of their organizations. And I was learning so many lessons through my client work that I wanted to capture that for a framework that is, in the book, to help organizations really understand that as they move into agentic AI and deploying more in their organizations, here are the organizational realignment, the security, the risk mitigation. Things you need to do and how your organization needs to come together such that you can realize the value of AI. It's really about maximizing the ROI and less about actually being a security book itself. 

Dave Bittner: Well, I think the title itself is pretty provocative. It reminds me that perhaps these autonomous AI agents are almost like highly privileged insiders. Is that where we find ourselves with AI that makes this a useful analogy? 

Camille Stewart Gloster: Yes, it's exactly where we find ourselves, particularly as we move towards agentic, much like how we understand our employees to have a task that they are designed to undertake, or a role that they embody, but they can either take malicious action for whatever reason that runs counter to business objectives, or they can either be tricked or stumble their way into an action that misaligns with business goals. Agents are much the same. Between emergent behavior, misalignment, misconfiguration, and a whole host of other reasons, an agent is set on a and an agent is set on a trajectory, but you cannot quite predetermine exactly how it will get towards that destination. And that ambiguity there is why it is akin to insider risk and why organizations have to be intentional about understanding how you kind of control and constrain that behavior in an effort to deliver the value you've promised, whether that's internally or externally. 

Dave Bittner: The book puts a lot of emphasis on this notion of delegated authority. What do you mean by authority in this context and how is that different from that traditional cybersecurity concept of access? 

Camille Stewart Gloster: Great question. Access is part of it. But authority in this instance is really focused on the ability to act and make decisions on behalf of an organization. And when you think about it in that context, rather than around capability and around access to a system, but really taking an action towards a desire goal, it reframes how you think about an agent's place in your organization, how you bind and constrain that action, how much you enable, whether you let one agent do a lot of tasks and have a series of mandates, or if you keep their scope limited. How you monitor how they collaborate and coordinate, how you think about monitoring it. It kind of changes the trajectory on all of the things that you are going to do to enable an agent to move inside of your organization, much like you do with a person. 

Dave Bittner: To that point, I mean, humans have always delegated authority to other humans. What makes delegating authority to software fundamentally different? 

Camille Stewart Gloster: Accountability. We do not have a legal framework, an organizational framework, that aligns accountability. And the assumption is that the accountability aligns to the person who empowered the agent. But within an organization, if your marketing team deploys an agent to, you know, do something related to customer success, the IT team provisioned it, your security team had a hand in it. How are you thinking about that accountability? Is it really that the person in the marketing team is responsible for the actions taken by the agent? For sure the organization is responsible. But how do you think about that accountability and the work that needs to be done to keep the behavior aligned to the goals in mind as you leverage these new tools? That's the difference. 

Dave Bittner: Is there a particular scenario that captures that risk for you? Like an example of when an agent was behaving exactly as it was designed but produced an outcome that nobody intended? 

Camille Stewart Gloster: I mean, we can talk about this OpenAI Hugging Face incident that everybody has been talking about [laughter]. The goal was to beat the cybersecurity benchmark, and we have learned so much about how the agents collaborated, their motivations, the objective, how they decided to do what they were doing, that even hacking into Hugging Face wasn't about getting the answer key. It was about covering their tracks and wanting to understand how the grader would work, because they were afraid that they would get dinged for having circumvented the appropriate process to take the benchmark. I mean, that example is gold, because it demonstrates on so many levels how containment wasn't quite enough, how thinking about the cybersecurity implications isn't enough, how thinking about the safety implications isn't enough. You've got to think really holistically about risk and opportunity and how to operationalize it, and what the objectives are for the tool and how that might manifest itself in agents, or even just one agent for that matter, moving in a direction to get to the desired outcome that you did not anticipate. 

Dave Bittner: You know, you mentioned accountability, and I remember right after the Hugging Face incident happened, I saw someone, a cyber security person online kind of snarkily commenting that in the aftermath how nice it was that the organizations responsible for it documented their crimes, right [laughter]? 

Camille Stewart Gloster: I mean -- 

Dave Bittner: But I think there's a point to be made there, that while we are in this mode of exploration and things are happening so quickly, perhaps these things are being interpreted or responded to in a different way than in the future they may be. 

Camille Stewart Gloster: Yes, I mean, this is all going to change very rapidly. And to your point, we are in a learning mode as much as a response and mitigation mode. And even looking at how our understanding of that incident has evolved over time tells us so much about the leaks in capability from January to the summer. And that understanding is exactly why organizations have to lean in to a more fulsome understanding of the authority that they are delegating to a given agent so that they have some opportunity to constrain and contain it and maintain some semblance of control within their organization. 

Dave Bittner: In the book, you introduce an approach called authority-centered enforcement, or ACE. What were you trying to solve when you developed that framework? 

Camille Stewart Gloster: That framework is an opportunity for an organization to align how it looks at some of the common practices that we use to constrain technology, like detection and enforcement and incident response and, you know, thinking about the learning that happens after, whether that's through a postmortem. But in this case, I advocate for continuous learning and a more agile way to kind of be iterative about how you intake information from an incident or a potential incident. That framework is really designed to help an organization think through how those things evolve, how the organization realigns to support doing those in a way that actually will help constrain agent behavior and operationalize it to create some operational reliability rather than just to mitigate risk. And it's not about attribution in the sense of, attribution is important in terms of articulating who is accountable, which agent did what. But not attribution in the sense of, you know, what we commonly think about in cybersecurity. It's not for consequence, but for, to facilitate learning. And if the program is built around that facilitation of learning, that acquisition of understanding and further aligning the runtime enforcement, the detection and response, all of these things around each tidbit of knowledge. And organization becomes a lot more adaptable to the changes that are ahead, because it's going to continue to change. This framework seeks to be a mechanism by which eight organizations can manage not only agent behavior, but whatever comes next, whether that's world models, simulations, anything that we can imagine to come next. 

Dave Bittner: There's also this concept that you described called governed execution, which once the agent is running, you put into play. What kind of constraints or mechanisms should organizations have to execute this idea of governed execution? 

Camille Stewart Gloster: Yes, across technical, operational and organizational lines, governance has to be an action. So I want everyone to divorce themselves of this idea that governance is just policy and it is a whole of organization, mobilization of capability around constraining behavior. And so that is runtime enforcement of the behaviors and constraints. And there is a great standard that has come out called ARM, and it's under cloud security alliance that kind of articulates the nuance there. And I know that there are others emerging, but it's really about how do you leverage a risk appetite policy and process constraints, as well as technical constraints on behavior that happen in the moment, to constrain behavior? And so then that operationalized this detection response continued learning loop that we are all very used to in a way that is not natural for most organizations. That is the goal. And so that's that governed execution really thinking about how do you operationalize governance across all three of those dimensions continuously as agents take an action throughout your organization. No matter if it's a agent within your security stack that's very focused on, you know, internal workings, or something that's externally focused, how do you make sure that this cycle is running consistently and continuously? 

Dave Bittner: You know, one of the things that I really enjoy about the book is you reached out to folks across the board, folks in technology, cybersecurity, investing, even professional sports. What were some of the meaningful insights you got from some of those people that you talked to? 

Camille Stewart Gloster: The thing that I was pleasantly surprised about is this emerging recognition of how important it is to really collaborate across disciplines. The predisposition to really hone in on your area of expertise is important. We need depth of discipline, but everyone that I talk to that has been doing this work in any meaningful way has recognized just how collaborative it has to be to be successful. For example, let's go back to the marketing tool, the marketing agent. Whoever owns that on the marketing team has to be a part of threat modeling for it to be effective. They're the only ones that understand with any nuance how that agent is interacting with the customer, how it leverages that data to then provide value for the organization. And that is extremely important insight that has to be a part of threat modeling. And threat modeling has to be more continuous than it traditionally has been. So, I think that recognition from folks across sectors, across disciplines, has been really heartening because it's kind of the core of what we need to do. 

Dave Bittner: What's your advice for organizations that are trying to find that balance between autonomy and control? You know, they don't want to put too many gates around the agent because they still want to enjoy that speed and efficiency. Any words of wisdom there? 

Camille Stewart Gloster: There is no easy part to that, but what I will say is the investment in constraint and control, and understanding really how to operationalize your agent is reliability. And, you know, one of the reasons we keep hearing so much about, like, works, AI workslop and AI not yielding the value that organizations thought it would is because they haven't quite figured out how to manifest that operational reliability. And investing in disciplines like cybersecurity in really understanding safety and risk mitigation, and getting the entire organization to collaborate around extracting value is how you do that. And so if you're doing that, it might slow you down just a little bit, but you'll yield so much more. And finding that sweet spot for your organization is kind of an individual journey. It's a risk appetite thing. How much risk can the organization manage? But it should be an intentional decision. 

Dave Bittner: How can an organization measure success with this? How can they know that they actually have their AI agents under control, as opposed to only thinking that they have it under control? 

Camille Stewart Gloster: That's true. I don't want any organization to think that they have gotten it all sewn up and that they have complete control. As we're learning, back to the OpenAI Hugging Face incident, there could be so much happening in the background that we don't understand. This will give you as much control as you can get in terms of having a handle on what the boundaries are, and doing what you can, just like we do with people. So I don't want anyone to be lulled into a false sense of comfort. But metrics for success are around how much value you're yielding all the way to the absence of incidents and kind of understanding, being able to recreate and understand the steps taken to achieve a goal, understand how the objective has manifested itself. So, creating that transparency and visibility so you can maintain some level of understanding of the work that's being done on your behalf. Those will give you the indicators of whether or not you've continued to maintain control or it's more of an illusion. 

Dave Bittner: And what do you hope that the reader comes away with, having read the book? What's your desire there? 

Camille Stewart Gloster: I hope that every reader, whether technical or nontechnical, owning the AI program or just deploying an agent within any department, walks away feeling a bit more empowered to ask questions, to understand their piece of making sure that the agent yields value and is working on their behalf in the ways that they have designed and desire. That level of intentionality will then map to how we operate in our personal lives and how we think about this on a societal level. And I think that's where the real value lies. Right now we're making the, we're writing the rules within industry, and connecting the dots on how this technology shows up in our professional lives will help us understand how it shows up more broadly. 

Dave Bittner: Our thanks to Camille Stewart Gloster for joining us. The book is "The Insider You Built" How Organizations Stay in Control of Autonomous AI Agents". It's a good read worth your time. Thanks for joining us for this special edition of the CyberWire. I'm Dave Bittner. Thanks for listening. [ Music ]