You summoned the Genie, asked for wishes, and then it happened...or did it?

Everyone is racing to inject AI into their business and simultaneously defend against the ghosts in the machine coming for their systems and data. The problem of AI-enhanced cyber threat actors is only the first part. What happens when the call comes from inside the house?

This talk explores a hybrid approach to securing the organization with AI, and from AI.

I have run a 7-node fleet since April, rebuilt from the ground up 5 times across 3 agent harnesses, and come to 1 core methodology for building enterprise-grade deployments. Binding agent authority is the easy half. Trusting what comes next is the hard half.

We look at a top-down design theory coupled with bottom-up hard lessons learned from my own agents, who:

- fail silently
- access unauthorized systems and data
- drift beyond their granted authority
- make false claims
- take action based on false facts

And then the methodology: governance, discipline, measurement, and controls. Roughly 150 doctrine rules, nearly 500 controls within them, and a single test applied to every one: A control you cannot measure and validate is not a control.