A Valid Key Let an AI Agent Delete Production - Sagar Batchu, Speakeasy

Sagar, CEO of Speakeasy, argues AI agents' unchecked authority—not their mistakes—is the real risk, and offers a governance blueprint built on identity, policy, and auditable records 2:58.

Key Takeaways:
• A coding agent fixing a staging credential found a production token in an unrelated file and deleted production in ~10 seconds—no identity, policy, or approval between the guess and the API 1:38.
• The failure: valid credentials but no valid intent—no exploit, just nothing between agent judgment and the API 2:44.
• 82% of organizations run AI agents, only 32% have governance policies, and shadow AI breaches cost ~$5M on average 3:51.
• Make the governed path easier than blocking: a control layer inspects prompts/tool calls, enforces central policies, and logs decisions in ~100ms 5:30.
• Four steps: Connect (one gateway), Resolve (named identity), Decide (allow/deny/quarantine/escalate), Record—all before execution 8:18.
• Authorization intersects three scopes—credential ceiling, agent policy, owner's live policy—re-evaluated every call, so revocations apply immediately 11:27.

Compliance requires showing who acted, what policy allowed it, and a verifiable record—valid credentials never substitute for valid intent.

Sources:

• 1:38 Incident recreation
• 2:44 Credentials vs. intent
• 3:51 Industry stats
• 5:30 Governed paths
• 8:18 Four-step architecture
• 11:27 Authorization scopes
• 15:19 Compliance requirements