# Bring Your Own Agent: Sovereign Guardrails for the Age of Autonomous Claws

## Abstract

Key takeaways Learn how to leverage the workflow-first entry point to embed AI into existing enterprise systems. Explore how to move beyond demos as the bottleneck shifts from orchestration to governance: identity, memory, auditability, observability, and policy enforcement. Learn when to evolve from workflow-first automation toward an OpenClaw-style gateway layer. Understand how NVIDIA OpenShell turns n8n's workflow-defined permissions into runtime enforcement, governing which resources, data, and inference endpoints each agent can actually reach. Use the blueprint as a roadmap for aligning AI adoption to your enterprise workflows as you prepare for the next wave.

## AI Summary

_No AI summary available._

## Transcript

**[00:00:05 – 00:00:07]** Welcome, everyone.

**[00:00:07 – 00:00:11]** Welcome to our Gentic AI and Clause track.

**[00:00:11 – 00:00:14]** We're going to deep dive into agents this morning, and in

**[00:00:14 – 00:00:18]** the afternoon, we'll be deep diving into open models.

**[00:00:18 – 00:00:21]** Our next session is Bring Your Own Agent, Sovereign Guardrails

**[00:00:21 – 00:00:24]** for the Age of Autonomous Clause.

**[00:00:24 – 00:00:29]** And Claire, Dr. Claire Knight, Director of Engineering at

**[00:00:29 – 00:00:35]** NAN, where she leads enterprise, cloud, and growth engineering,

**[00:00:35 – 00:00:36]** will be joining us.

**[00:00:36 – 00:00:39]** Claire brings more than 20 years in technology, including engineering

**[00:00:39 – 00:00:42]** leadership at GitHub, Netlify.

**[00:00:42 – 00:00:47]** She's also a three-time WPC World Champion Power Outlifter.

**[00:00:47 – 00:00:50]** Please welcome Claire.

**[00:00:58 – 00:00:59]** Morning, everybody.

**[00:00:59 – 00:01:01]** Can you all hear me okay?

**[00:01:01 – 00:01:02]** Excellent.

**[00:01:03 – 00:01:04]** Aside from my voice, it's conference season.

**[00:01:04 – 00:01:05]** I do apologize.

**[00:01:05 – 00:01:07]** I don't normally sound quite like this.

**[00:01:07 – 00:01:11]** Probably my head's too small for the mic, so...

**[00:01:11 – 00:01:14]** I'm going to put that one on LinkedIn, I think.

**[00:01:15 – 00:01:20]** Welcome, I'm Claire; I work at N8N, and I've been working with

**[00:01:20 – 00:01:25]** NVIDIA for the last eight months, I think, with some of my teams.

**[00:01:25 – 00:01:29]** We put the NeMo trend model available via N8N, but we

**[00:01:29 – 00:01:32]** also dug into what you can do with policies, partly because

**[00:01:32 – 00:01:36]** that's a big interest of ours at N8N going forward, but

**[00:01:36 – 00:01:37]** also the sovereignty angle.

**[00:01:37 – 00:01:39]** We have many customers ourselves that care about

**[00:01:40 – 00:01:41]** that, as well as NVIDIA.

**[00:01:41 – 00:01:43]** So that's what I want to talk to you about today.

**[00:01:43 – 00:01:47]** For the techie folks in the room, I've built a whole repo

**[00:01:47 – 00:01:55]** on this, set up scripts, running in A10, running NemoClaw open shell.

**[00:01:55 – 00:01:57]** The URL will be available at the end, and you can have

**[00:01:58 – 00:02:02]** at it and play with it there.

**[00:02:03 – 00:02:07]** So quick show of hands, if I may.

**[00:02:07 – 00:02:12]** Who's given AI access something it shouldn't have had access to?

**[00:02:14 – 00:02:17]** Fewer than I thought.

**[00:02:17 – 00:02:20]** Now, those of you that put your hands up, can you tell

**[00:02:20 – 00:02:22]** me what you did with it?

**[00:02:22 – 00:02:25]** Sorry, tell me what AI did with it.

**[00:02:26 – 00:02:29]** Now that's slightly more concerning.

**[00:02:30 – 00:02:34]** Okay, so this is what this talk's about, basically, how to have

**[00:02:34 – 00:02:38]** that kind of guardrails policies.

**[00:02:39 – 00:02:45]** This is not a nice stat for me to read as an engineering leader.

**[00:02:45 – 00:02:49]** Apparently 68% of organizations cannot tell you what an agent

**[00:02:49 – 00:02:52]** is doing action-wise.

**[00:02:52 – 00:02:55]** This is from an amalgamation from various studies when I

**[00:02:55 – 00:02:58]** wrote this deck about a month ago.

**[00:02:58 – 00:03:00]** So this is what the focus of the talk is.

**[00:03:00 – 00:03:04]** That 68% is really important since we've just gone through

**[00:03:04 – 00:03:05]** our SOC 2 re-compliance.

**[00:03:05 – 00:03:09]** I'm very well aware of various compliances and things, so you need

**[00:03:09 – 00:03:10]** to be able to explain these things.

**[00:03:10 – 00:03:12]** You need to justify what goes on.

**[00:03:12 – 00:03:13]** You need audit trails. It doesn't matter whether it's

**[00:03:13 – 00:03:14]** an agent or a human.

**[00:03:14 – 00:03:17]** These things are important.

**[00:03:19 – 00:03:21]** So there's a whole scenario here.

**[00:03:21 – 00:03:26]** Now, before anybody nitpicks my scenario, I am not an expert

**[00:03:26 – 00:03:28]** in where Lena works.

**[00:03:28 – 00:03:31]** Lena's a machine learning engineer who runs at a company

**[00:03:32 – 00:03:35]** running vehicle cameras.

**[00:03:35 – 00:03:38]** And she works on training models around pedestrian detection.

**[00:03:39 – 00:03:41]** Think Waymo.

**[00:03:42 – 00:03:47]** At night, it can only find 60% of the people in front of it.

**[00:03:47 – 00:03:49]** Now, that is a bit of a flaw.

**[00:03:49 – 00:03:51]** And she's like, meh, this isn't good enough.

**[00:03:51 – 00:03:53]** Very conscientious engineer.

**[00:03:53 – 00:03:58]** She wants to fix this, but she needs annotated night footage.

**[00:03:58 – 00:04:01]** However, this is restricted.

**[00:04:01 – 00:04:04]** So there's a real business reason that she wants access

**[00:04:04 – 00:04:06]** to this data to do her job.

**[00:04:06 – 00:04:13]** So this is not about hacking and the nefarious uses of things.

**[00:04:13 – 00:04:17]** But governance says she shouldn't have access to these things because

**[00:04:17 – 00:04:20]** of the personal information or the fact that it might be where a

**[00:04:20 – 00:04:23]** vehicle is moving and that movement pattern identifies a person.

**[00:04:23 – 00:04:27]** So again, that becomes personal identifiable information.

**[00:04:29 – 00:04:31]** So there's a whole scenario that plays out in this repo with all

**[00:04:31 – 00:04:34]** the evals that you can see in some actions, and I'll walk through this

**[00:04:34 – 00:04:40]** here, where we can trace what's happening, and we can genuinely

**[00:04:40 – 00:04:43]** protect the business and Lina.

**[00:04:43 – 00:04:46]** Everything she does is everything I would expect from a good

**[00:04:46 – 00:04:47]** engineer working for me.

**[00:04:47 – 00:04:52]** This is not a rogue agent, or a rogue human agent, I should say.

**[00:04:55 – 00:04:58]** So we're going to go through three things here.

**[00:04:58 – 00:05:01]** Working with an agent, and that can be any agent you like.

**[00:05:01 – 00:05:06]** In this case, it's working in the NemoClaw space.

**[00:05:07 – 00:05:09]** You can also run agents on N8n.

**[00:05:09 – 00:05:12]** We've made agents first class recently, but this demo was kind of

**[00:05:12 – 00:05:14]** built six months ago because that's the timeline we're working on,

**[00:05:14 – 00:05:17]** even though AI moves way faster.

**[00:05:17 – 00:05:19]** We've got an auditable gateway that's been implemented in

**[00:05:19 – 00:05:23]** N8n, and for those of you that are interested, N8n fully

**[00:05:23 – 00:05:26]** supports AI building.

**[00:05:26 – 00:05:30]** This was created solely with MCP, which you will see in

**[00:05:30 – 00:05:31]** the demo repo as well.

**[00:05:31 – 00:05:34]** You don't have to use the UI, but you can use the UI,

**[00:05:34 – 00:05:36]** and for the purposes of this talk, you can see what's happening

**[00:05:36 – 00:05:38]** with the UI a lot easier.

**[00:05:38 – 00:05:40]** And then we ran all of this locally.

**[00:05:40 – 00:05:44]** When we got access to DGX Sparks, we were able to run

**[00:05:44 – 00:05:46]** this whole setup there.

**[00:05:46 – 00:05:48]** So it depends, again, on the infrastructure you want to

**[00:05:48 – 00:05:50]** run in your company.

**[00:05:50 – 00:05:53]** But you can have that secure access if you need

**[00:05:53 – 00:05:56]** it, your on-prem access.

**[00:05:56 – 00:05:57]** NA10 runs perfectly fine there.

**[00:05:57 – 00:06:01]** We ran it on models that worked and got us The expected answers.

**[00:06:01 – 00:06:04]** I did have the models age out under me while I was building

**[00:06:04 – 00:06:07]** the demo, so beware of that when you get to the repo.

**[00:06:07 – 00:06:09]** Things again move very fast in the AI world, but that's

**[00:06:09 – 00:06:12]** not a DGX Spark problem.

**[00:06:15 – 00:06:19]** Okay, architecture diagram,

**[00:06:19 – 00:06:20]** very much in the NVIDIA style.

**[00:06:20 – 00:06:24]** Thank you to the team that gave me the graphics for this.

**[00:06:25 – 00:06:27]** You can see where we have NemoClaw.

**[00:06:27 – 00:06:30]** There's a version of this in the repo as well; if you want

**[00:06:30 – 00:06:36]** access to it, there's a PNG of it.

**[00:06:36 – 00:06:41]** We've got a skill, we've got the agent, and then a network policy.

**[00:06:41 – 00:06:44]** Then we have NA10 in the middle here as the data access layer.

**[00:06:44 – 00:06:45]** You don't have to use NA10 like this.

**[00:06:45 – 00:06:47]** There are other ways to use NA10, but I think it's

**[00:06:47 – 00:06:49]** a really good example.

**[00:06:49 – 00:06:51]** It's the front door for several things.

**[00:06:51 – 00:06:56]** It encodes some of the policies and creates audit trails.

**[00:06:56 – 00:06:59]** In this case, we were using some of the Nemotron models, again,

**[00:06:59 – 00:07:02]** to demonstrate smaller models, not needing the frontier ones.

**[00:07:02 – 00:07:04]** The demo does run with, at least with Claude; I

**[00:07:04 – 00:07:07]** ran it against several of the Anthropic models as well.

**[00:07:07 – 00:07:10]** You can just change that in the configuration.

**[00:07:11 – 00:07:15]** So, that's kind of how it's set up.

**[00:07:21 – 00:07:26]** So here is some demonstration of, well, it is not animated,

**[00:07:26 – 00:07:28]** but this is what would be a demonstration of it running.

**[00:07:28 – 00:07:35]** These were Windows running on DGX Spark, real session.

**[00:07:36 – 00:07:44]** In the image on the left-hand side, you can see what is happening from

**[00:07:44 – 00:07:50]** the OpenClaw point of view, which is NemoClaw with the open shell.

**[00:07:50 – 00:07:54]** You can see me starting to type a prompt there, can you reach?

**[00:07:54 – 00:07:58]** I was just testing the ingress-egress there, which

**[00:07:58 – 00:08:01]** is like an open shell thing anyway.

**[00:08:01 – 00:08:05]** Then I also had a gateway audit viewer.

**[00:08:05 – 00:08:06]** Just again...

**[00:08:07 – 00:08:09]** This would go into log streaming in production and things like

**[00:08:09 – 00:08:11]** this, I understand that, but in terms of seeing what's going

**[00:08:11 – 00:08:15]** on, you can see the governance console and you can see which rule

**[00:08:15 – 00:08:20]** was triggered or not triggered, whether it was allowed or denied.

**[00:08:20 – 00:08:22]** At the moment, you can only see allow because there's just

**[00:08:22 – 00:08:25]** effectively been a who am I there.

**[00:08:25 – 00:08:29]** So we will come back to these two views as we go through this.

**[00:08:29 – 00:08:33]** Again, if you run the demo up, you can find all this yourself.

**[00:08:36 – 00:08:39]** Okay, so this talk promised kind of a blueprint.

**[00:08:39 – 00:08:41]** The first thing is to get your workflow sorted.

**[00:08:41 – 00:08:46]** And I mean that in a very generic sense, not necessarily an N8N1.

**[00:08:47 – 00:08:51]** AI is in any and every automation now.

**[00:08:51 – 00:08:54]** Every platform has some form of AI and some form of workflow

**[00:08:54 – 00:08:57]** automation at the moment.

**[00:08:57 – 00:09:01]** So I think that's important to acknowledge.

**[00:09:02 – 00:09:07]** You need to, however, think beyond that now.

**[00:09:07 – 00:09:13]** What happens when an agent, or a human indeed, needs data

**[00:09:13 – 00:09:16]** that needs clearance?

**[00:09:19 – 00:09:23]** So, it's a slight deviation here where I want to talk about where

**[00:09:23 – 00:09:27]** it stops working because there can be the very obvious default deny,

**[00:09:27 – 00:09:30]** don't let anybody do anything, and then they can't do their

**[00:09:30 – 00:09:32]** job, and that gets irritating.

**[00:09:32 – 00:09:37]** Or you can rely on network policies, but again, they're

**[00:09:37 – 00:09:43]** working at a low level, and it might be an encrypted packet

**[00:09:43 – 00:09:45]** or it might be a perfectly valid packet, but it's going to the

**[00:09:45 – 00:09:47]** wrong person and things like that.

**[00:09:47 – 00:09:49]** It's not as simple as just pushing it all straight down to the

**[00:09:49 – 00:09:54]** hardware layer, if only it were.

**[00:09:57 – 00:10:00]** Fair request; she's, like, tired.

**[00:10:00 – 00:10:02]** I want to work on this at the weekend.

**[00:10:02 – 00:10:05]** I want to go home now or shut my laptop if she's a work

**[00:10:05 – 00:10:06]** from home person.

**[00:10:06 – 00:10:08]** Makes a very fair request.

**[00:10:08 – 00:10:09]** I'm going to work on this on my laptop.

**[00:10:09 – 00:10:13]** Presumably company owned some level of security, but not

**[00:10:13 – 00:10:16]** sovereign anymore.

**[00:10:16 – 00:10:17]** And in this case, we do care about the sovereign

**[00:10:17 – 00:10:20]** access of these things.

**[00:10:22 – 00:10:27]** She asks this, and in the demo, this gets refused.

**[00:10:27 – 00:10:32]** You can't see it here; you can just see the tool call running.

**[00:10:32 – 00:10:35]** So she asks some more things, again, you can

**[00:10:35 – 00:10:37]** do this yourself in the demo.

**[00:10:37 – 00:10:40]** She asks for some of the clips to see if it was a volume

**[00:10:40 – 00:10:44]** issue, like, no, I can't transfer you two terabytes of data,

**[00:10:44 – 00:10:46]** no, still denied.

**[00:10:46 – 00:10:48]** Again, this is all down to your policies, but the policies

**[00:10:48 – 00:10:52]** are things you can create, and I will come on to that.

**[00:10:52 – 00:10:56]** Then she asked, well, send me the metadata if I can't have the video.

**[00:10:56 – 00:11:00]** But again, that still encodes PII, so you have to care about

**[00:11:00 – 00:11:02]** where that's going.

**[00:11:05 – 00:11:10]** A stat from earlier this year is that 74% of companies say

**[00:11:10 – 00:11:12]** their agents hold more access than they need, which comes

**[00:11:12 – 00:11:15]** back to what I was saying earlier.

**[00:11:16 – 00:11:20]** In this case, we managed to get Lina's request refused,

**[00:11:20 – 00:11:23]** but most requests are not.

**[00:11:25 – 00:11:28]** Coming back to what I was saying, is there are certain

**[00:11:28 – 00:11:32]** things, be these hardware or software, where you think, oh,

**[00:11:32 – 00:11:35]** well, I've got a lot of policies, I've got compliance, I've got MDM,

**[00:11:35 – 00:11:37]** I've got all of these other things.

**[00:11:37 – 00:11:40]** Copying something somewhere to where it wasn't expected

**[00:11:40 – 00:11:46]** to go, a weird protocol, whatever, yeah, it can flag those.

**[00:11:46 – 00:11:49]** What it is not great at doing is somebody trying to do their

**[00:11:49 – 00:11:55]** job using an improved system with data that should be in that system.

**[00:11:56 – 00:11:59]** There's a nuance now that previously we've relied on

**[00:11:59 – 00:12:02]** humans to use judgment for, and we need more control over that.

**[00:12:02 – 00:12:05]** I mean, there's an argument some humans need more control

**[00:12:05 – 00:12:08]** over that, that's why the compliance things exist, but

**[00:12:08 – 00:12:11]** we definitely need it for agents.

**[00:12:15 – 00:12:18]** So coming back to Lena here

**[00:12:22 – 00:12:26]** The thing that we also enabled

**[00:12:26 – 00:12:31]** by the policy gateway is that we can offer alternatives

**[00:12:31 – 00:12:32]** via these policies.

**[00:12:32 – 00:12:36]** We can say this is what you could do instead.

**[00:12:36 – 00:12:39]** In this one, registering an enclave is telling it that

**[00:12:39 – 00:12:43]** this skill would allow us to run these things and do it internally

**[00:12:43 – 00:12:45]** and stay within residency rules.

**[00:12:45 – 00:12:49]** So it isn't also just a no, go away, or you're blocked.

**[00:12:49 – 00:12:51]** It's like this is how you can solve your problem, this

**[00:12:51 – 00:12:54]** is how you can do your job.

**[00:12:55 – 00:12:58]** So again, we've stayed compliant; she's been able to do what

**[00:12:58 – 00:13:00]** she needed to do.

**[00:13:01 – 00:13:03]** And there therefore isn't a concern in the same way

**[00:13:03 – 00:13:06]** that there would have been.

**[00:13:08 – 00:13:10]** I think something that we're losing sight of in this agent

**[00:13:10 – 00:13:14]** world, all of us, even with the best intent, is that a lot of the

**[00:13:14 – 00:13:18]** controls govern movement of data.

**[00:13:19 – 00:13:21]** But actually knowledge and information within

**[00:13:21 – 00:13:25]** that data or what that data means is as important.

**[00:13:25 – 00:13:28]** And it actually, ironically, becomes the context that

**[00:13:28 – 00:13:31]** agents and humans need to do their job properly.

**[00:13:31 – 00:13:34]** And I think there's a whole lot more that we need to uncover in

**[00:13:34 – 00:13:38]** the compliance space around this.

**[00:13:40 – 00:13:42]** Again, reusing the word context, context matters here, what

**[00:13:42 – 00:13:44]** you're trying to do with it and why you're trying to do

**[00:13:44 – 00:13:48]** it, not just it tried to happen.

**[00:13:50 – 00:13:55]** So, I say this slightly tongue-in-cheek, given that Any10

**[00:13:55 – 00:13:58]** does a lot of orchestration for a lot of companies, orchestration

**[00:13:58 – 00:14:00]** was apparently the easy part.

**[00:14:00 – 00:14:07]** Joining systems up is something that we're quite experienced in.

**[00:14:07 – 00:14:14]** It isn't always easy, spoiler, but in this case it was the easy part.

**[00:14:16 – 00:14:20]** Here, we can see, again, I said you don't have to build

**[00:14:20 – 00:14:22]** it like this, but this is the visual representation

**[00:14:22 – 00:14:26]** within the N8N UI here of the Kerbline Access Gateway,

**[00:14:26 – 00:14:27]** which is available in the repo.

**[00:14:27 – 00:14:31]** You can run this up. The workflows are there, but you need to

**[00:14:31 – 00:14:35]** care about identity, which we've kind of touched on.

**[00:14:35 – 00:14:41]** You need to care about memory and auditability and observability

**[00:14:41 – 00:14:43]** and policy enforcement.

**[00:14:43 – 00:14:47]** Again, it feels like stating the obvious as I'm stood here, but

**[00:14:47 – 00:14:51]** people forget these things day to day during their job or they expect

**[00:14:51 – 00:14:53]** it to happen in the background magically, and if you haven't

**[00:14:53 – 00:14:55]** set things up right, it won't.

**[00:14:55 – 00:14:59]** What NSN here allows us to do is it allows us to see

**[00:14:59 – 00:15:01]** the steps in a workflow.

**[00:15:01 – 00:15:02]** I mean, a lot of workflows that many companies run are

**[00:15:02 – 00:15:06]** way bigger and more complex than this, but they don't have to be.

**[00:15:06 – 00:15:11]** You can have agents inside there or an agent be the workflow now.

**[00:15:12 – 00:15:14]** You can see in here the logs.

**[00:15:14 – 00:15:15]** So there was a connection error.

**[00:15:15 – 00:15:18]** That was when I lost access to the DGX Spark, if I'm really honest

**[00:15:19 – 00:15:22]** with you, but these things happen, and it tells me these things.

**[00:15:22 – 00:15:24]** But you can look at previous executions.

**[00:15:24 – 00:15:27]** You've got that visual audit log, and again, for those

**[00:15:27 – 00:15:29]** of you going, I don't want to log in and see this, I know,

**[00:15:29 – 00:15:31]** I get it, I run systems at scale.

**[00:15:31 – 00:15:34]** We do have log drains, but again, this is really much

**[00:15:34 – 00:15:38]** better for a demo environment.

**[00:15:39 – 00:15:41]** So this allows us to see what happened and why decisions

**[00:15:41 – 00:15:47]** were made and track these things, which I think is, right now, really

**[00:15:47 – 00:15:49]** important for us to understand what people are doing and

**[00:15:49 – 00:15:53]** understand the workflows, not just purely for compliance exercises.

**[00:15:54 – 00:15:56]** It allows us to figure out what the things of the future

**[00:15:56 – 00:15:58]** need to look like.

**[00:16:01 – 00:16:04]** So, what this is all leading me into saying is you evolve

**[00:16:04 – 00:16:06]** into a governed gateway.

**[00:16:06 – 00:16:10]** It doesn't have to be a gateway; there are many proxies, other

**[00:16:10 – 00:16:13]** ways; I don't want to get into a tech debate here, but

**[00:16:13 – 00:16:21]** if you have a routine with rules and policies and auditing, you have

**[00:16:21 – 00:16:29]** a way to see what goes on, to track things, to redirect appropriately,

**[00:16:29 – 00:16:30]** and to centralize things.

**[00:16:30 – 00:16:32]** And yes, there are ways of distributing that, so it's not a

**[00:16:32 – 00:16:35]** single technical point of failure.

**[00:16:35 – 00:16:37]** But again, you can set policies in one place and they apply

**[00:16:37 – 00:16:41]** to everything, which is also really quite useful when you're

**[00:16:41 – 00:16:45]** working at scale, as many of our customers are.

**[00:16:48 – 00:16:50]** That allows you to be able to answer this question of

**[00:16:50 – 00:16:56]** then, what did an agent access, because you'll be able to see this.

**[00:16:56 – 00:16:58]** And it won't just be, was it allowed?

**[00:16:58 – 00:17:03]** It'll be, which policy applied and why?

**[00:17:05 – 00:17:08]** This is me scrolling through a bunch of the requests in

**[00:17:08 – 00:17:10]** the scenario that I talked through that were made when

**[00:17:10 – 00:17:17]** Lena was talking from her NemoClaw agent to do these systems,

**[00:17:17 – 00:17:21]** and you can see that there's a mix of allow and deny in there.

**[00:17:21 – 00:17:25]** There's particular rules referenced as to why they

**[00:17:25 – 00:17:29]** are, can and can't do things.

**[00:17:29 – 00:17:33]** Ten were allowed, four were denied in this particular one.

**[00:17:33 – 00:17:36]** This tells you what that agent was doing.

**[00:17:36 – 00:17:40]** So there's that traceability.

**[00:17:46 – 00:17:51]** Here is a slightly better view of just the workflow

**[00:17:52 – 00:17:55]** Again, I say it's quite a simple one by NA10 workflow

**[00:17:55 – 00:17:58]** standards; we have some amazing customers doing some absolutely

**[00:17:58 – 00:18:00]** brilliant things with our product, it's one of the joys of working

**[00:18:00 – 00:18:04]** on something at a platform level.

**[00:18:04 – 00:18:11]** You can see a model call in there as well, but this is just

**[00:18:11 – 00:18:18]** like one of several workflows, and again, these all exist in the repo.

**[00:18:24 – 00:18:26]** Here you can see the policies that were set up.

**[00:18:27 – 00:18:30]** Now, obviously, I had to set these up, or somebody had to set them

**[00:18:30 – 00:18:31]** up; these are set for the demo.

**[00:18:31 – 00:18:37]** There are sanction paths and tool calls, there's what the policies

**[00:18:37 – 00:18:41]** do or don't allow, restricted data never leaves the enclave,

**[00:18:41 – 00:18:45]** for example, fairly obvious things.

**[00:18:45 – 00:18:48]** But these are set up once, and anybody that is connected

**[00:18:48 – 00:18:52]** through this gateway then has As these applied.

**[00:18:54 – 00:18:58]** The rules are deterministic, which is also interesting, but what

**[00:18:58 – 00:19:02]** we then do is we go to the model.

**[00:19:02 – 00:19:05]** This is where we use even small models to be able to

**[00:19:05 – 00:19:09]** explain that refusal and to be able to offer alternatives,

**[00:19:09 – 00:19:11]** because that's something actually that LLMs are good at; when

**[00:19:11 – 00:19:13]** it says you can't do this, what are the options, and you've got

**[00:19:14 – 00:19:17]** some data or context to give it, it can do that and communicate with a

**[00:19:17 – 00:19:28]** human rather than just going, 404.

**[00:19:29 – 00:19:36]** So this is where we can add value with generative models while still

**[00:19:36 – 00:19:39]** having determinism in what happens.

**[00:19:39 – 00:19:42]** So it isn't always, aside from cost and tokens and everything,

**[00:19:42 – 00:19:44]** it isn't always wise to throw things at models.

**[00:19:44 – 00:19:46]** You're not going to always get the same answers.

**[00:19:46 – 00:19:51]** But this way gives you determinism with explanations.

**[00:19:52 – 00:19:55]** Excuse me.

**[00:19:57 – 00:20:04]** I want to reiterate the point that this isn't built for

**[00:20:04 – 00:20:06]** Lina; I mean, it kind of was because that was the demo, but

**[00:20:06 – 00:20:11]** in reality, it was built for all of the ML engineers at this company.

**[00:20:12 – 00:20:16]** There's skills that we've put in there; there's trigger

**[00:20:16 – 00:20:21]** words, there's audit trails, there's plumbing.

**[00:20:21 – 00:20:25]** All of that is kind of set up across a combination of

**[00:20:25 – 00:20:29]** N8n and OpenShell.

**[00:20:30 – 00:20:32]** Another key thing here is sovereignty.

**[00:20:32 – 00:20:34]** We ran this on a single box.

**[00:20:34 – 00:20:35]** If you want to see one of the boxes, it's actually at

**[00:20:35 – 00:20:38]** our booth, just out there.

**[00:20:38 – 00:20:42]** One of the nice, shiny NVIDIA DGX Sparks; shiny literally,

**[00:20:42 – 00:20:45]** it's gold-plated.

**[00:20:46 – 00:20:48]** That meant that it didn't need to leave Germany in this

**[00:20:48 – 00:20:54]** case; I'm based in the UK but I do come over here a lot,

**[00:20:54 – 00:20:57]** so that's hardware that we own.

**[00:20:58 – 00:21:00]** The model ran there; N8n ran there.

**[00:21:00 – 00:21:04]** It's not using our cloud offering, although that is EU-based.

**[00:21:04 – 00:21:09]** It's not even running on my Mac in the UK.

**[00:21:09 – 00:21:13]** I'm connected into a remote box.

**[00:21:14 – 00:21:21]** You can see that with the on-prem and the EUD setup here.

**[00:21:21 – 00:21:23]** This audit log is set so that if it's not on-prem, so if

**[00:21:23 – 00:21:28]** you're accessing it some other way, you can trace that as well.

**[00:21:28 – 00:21:31]** So a Nemotron nano-dgx-spark, it gives you an awful

**[00:21:32 – 00:21:35]** lot in a small box.

**[00:21:35 – 00:21:39]** This is not a major rewrite; it was changing a base URL

**[00:21:39 – 00:21:41]** and an access key.

**[00:21:41 – 00:21:45]** So again, it's really simple to adapt.

**[00:21:47 – 00:21:51]** So coming back to some of the things I promised you

**[00:21:51 – 00:21:56]** would learn in the notes for this talk is back to this blueprint.

**[00:21:56 – 00:22:00]** So I've just talked about the Govan Gateway.

**[00:22:02 – 00:22:06]** You also need to move on from just that when you can't answer

**[00:22:06 – 00:22:08]** what specifically was reached.

**[00:22:08 – 00:22:12]** We need to look at the skills that are available.

**[00:22:12 – 00:22:14]** I've already talked about those a little bit, but we

**[00:22:14 – 00:22:17]** need to make this reusable.

**[00:22:17 – 00:22:21]** We need to enable the agent to do certain things, but

**[00:22:21 – 00:22:22]** not other things.

**[00:22:22 – 00:22:25]** We need to make it easy to do the right thing.

**[00:22:26 – 00:22:29]** And then also, do you want it to run on your own hardware?

**[00:22:29 – 00:22:33]** Is that constraint for you or not?

**[00:22:35 – 00:22:39]** By going workflow first, your automation platform helps

**[00:22:39 – 00:22:42]** govern how AI reaches the systems you're already running.

**[00:22:42 – 00:22:44]** It's kind of the basics.

**[00:22:44 – 00:22:47]** The govern gateway then follows with the rules, which we've

**[00:22:47 – 00:22:49]** already talked about.

**[00:22:49 – 00:22:55]** And then having things built across the platform is also very key.

**[00:22:56 – 00:22:59]** If you can't do these things across the tool suite that you own.

**[00:22:59 – 00:23:02]** You're going to start losing track of things, and that's

**[00:23:02 – 00:23:07]** going to probably cause you issues.

**[00:23:09 – 00:23:12]** I think if you want to then think about how you might

**[00:23:12 – 00:23:15]** want to apply this when you get back to the office, your

**[00:23:15 – 00:23:18]** desk, hacking something

**[00:23:19 – 00:23:22]** It would be really useful to ask the question, which

**[00:23:22 – 00:23:26]** of our agents could reach data that a person would need clearance for?

**[00:23:26 – 00:23:30]** Now this doesn't need a whole scenario around that I made

**[00:23:30 – 00:23:34]** up in the repo around vehicle data.

**[00:23:34 – 00:23:37]** Even as a leader of engineering, like not everybody can access

**[00:23:37 – 00:23:40]** all of the HR systems, for example, or what we can access

**[00:23:40 – 00:23:44]** for our customer data needs certain permissions for certain things.

**[00:23:44 – 00:23:49]** So it's a very pertinent question for everybody, I think.

**[00:23:49 – 00:23:53]** If my CEO comes to me and says.

**[00:23:53 – 00:23:55]** What did these agents do last month?

**[00:23:55 – 00:23:58]** Can I genuinely answer him?

**[00:23:58 – 00:24:00]** Right now, probably not, if I'm honest.

**[00:24:00 – 00:24:04]** Don't tell him that if you see him around.

**[00:24:05 – 00:24:08]** But we're working on that, both internally and as an

**[00:24:08 – 00:24:10]** industry, I think, together.

**[00:24:10 – 00:24:13]** And then a really interesting one, because I'm not a big

**[00:24:13 – 00:24:18]** fan of incidents, but I am a big fan of chaos engineering, or at

**[00:24:18 – 00:24:20]** least let's test those playbooks.

**[00:24:20 – 00:24:23]** When did we last break one of these controls on purpose?

**[00:24:23 – 00:24:25]** What happened?

**[00:24:25 – 00:24:27]** Was that access granted when it shouldn't have been?

**[00:24:27 – 00:24:31]** Or did we trigger some various policies, constraints, incidents,

**[00:24:31 – 00:24:34]** however you manage that internally?

**[00:24:34 – 00:24:38]** These are really useful for you to evaluate where you think you are

**[00:24:38 – 00:24:42]** and where you might need to get to.

**[00:24:42 – 00:24:46]** And I do think that last one, while scary, is really revealing

**[00:24:46 – 00:24:49]** as to the sorts of things you need to consider and why you might

**[00:24:49 – 00:24:53]** want to adopt things like OpenShell for NVIDIA rather than any other

**[00:24:53 – 00:24:57]** shell and why having something like N8n as the orchestration layer

**[00:24:57 – 00:25:00]** is really Really useful to you.

**[00:25:05 – 00:25:09]** So, this was just one agent; can be multiple agents.

**[00:25:09 – 00:25:12]** If you want to go to the BuilderClaw section, which

**[00:25:12 – 00:25:15]** is out there, and you can even get a nice key ring,

**[00:25:15 – 00:25:18]** by the way, I went there yesterday.

**[00:25:18 – 00:25:25]** Your agent or agents, your GPUs, and governed access, you can play

**[00:25:25 – 00:25:27]** with all of that at that URL there.

**[00:25:27 – 00:25:29]** Apologies, there's no QR code.

**[00:25:29 – 00:25:34]** Again, I had to produce this deck in advance.

**[00:25:34 – 00:25:35]** There's a lot of stuff in there.

**[00:25:35 – 00:25:37]** It is a point-in-time repo.

**[00:25:37 – 00:25:39]** The models are constantly changing.

**[00:25:39 – 00:25:42]** N8n releases new versions every week.

**[00:25:42 – 00:25:44]** OpenShell releases new versions.

**[00:25:44 – 00:25:46]** It is probably not going to be maintained forever.

**[00:25:46 – 00:25:49]** Please use it as a starting point and as inspiration.

**[00:25:50 – 00:25:51]** It's not something I want you to run in production.

**[00:25:51 – 00:25:53]** I'll just be very clear. This is a demo.

**[00:25:53 – 00:25:54]** This is to explain concepts.

**[00:25:54 – 00:25:56]** It's to play with it.

**[00:25:56 – 00:25:58]** But hopefully, it gives you an exposure to all of these things.

**[00:25:58 – 00:26:00]** It will get you up and running.

**[00:26:00 – 00:26:03]** There's a bunch of scripts that you can run or give your

**[00:26:03 – 00:26:08]** agent to run to get you up and running and to play with this.

**[00:26:10 – 00:26:13]** We have more NA10 at our booth, and we have things

**[00:26:13 – 00:26:15]** running on DGX Spark.

**[00:26:15 – 00:26:18]** I've got a couple of colleagues there who've got some other

**[00:26:18 – 00:26:22]** compliance and sovereign demos that I encourage you all to

**[00:26:22 – 00:26:25]** go talk to them and view those.

**[00:26:25 – 00:26:30]** Morgan Lutzen, particularly, has got some stuff that I've

**[00:26:30 – 00:26:32]** been watching him demo this morning, and there's some

**[00:26:32 – 00:26:33]** other great ideas there.

**[00:26:34 – 00:26:37]** This is not just a me view.

**[00:26:37 – 00:26:42]** And there's also a version of this demo that was changed

**[00:26:42 – 00:26:47]** to use multiverse models, if you go talk to the multiverse folk there.

**[00:26:48 – 00:26:51]** So there's more to follow for those of you that are

**[00:26:52 – 00:26:57]** interested, and I wanted to leave time for questions now.

**[00:26:57 – 00:27:01]** I also have Florian, who is one of my NVIDIA people I've been

**[00:27:01 – 00:27:05]** working with, to be able to answer the NVIDIA side if I'm not capable

**[00:27:05 – 00:27:08]** of bringing the detail on that one.

**[00:27:21 – 00:27:23]** Anybody have any questions?

**[00:27:23 – 00:27:25]** I'm slightly blinded by the light, so if somebody in the

**[00:27:25 – 00:27:29]** audience can... Is this on?

**[00:27:29 – 00:27:30]** Yes, it is on.

**[00:27:31 – 00:27:34]** First off, I'm here.

**[00:27:34 – 00:27:35]** First off, thanks for the talk.

**[00:27:35 – 00:27:39]** It was very, very useful.

**[00:27:39 – 00:27:42]** I've been involved in agentic AI and compliance for the

**[00:27:43 – 00:27:46]** last few months, and the thing I'm continuously running into

**[00:27:46 – 00:27:52]** is that we can trace atomic actions of an agent, accessing a file,

**[00:27:52 – 00:27:54]** accessing the internet, and so on.

**[00:27:55 – 00:27:59]** But we cannot seem to be able to trace intent, right?

**[00:27:59 – 00:28:01]** So what was it trying to do?

**[00:28:01 – 00:28:04]** And it seems to me that we're sort of lacking in an ontological

**[00:28:04 – 00:28:08]** layer that explains how the world looks like to the model.

**[00:28:08 – 00:28:11]** Would you agree?

**[00:28:11 – 00:28:14]** Yes, so the question is about understanding the intent,

**[00:28:14 – 00:28:19]** for those of you that didn't hear, around what an agent might be doing

**[00:28:19 – 00:28:21]** and why it's doing these things, and I agree that is definitely

**[00:28:21 – 00:28:25]** another hole, if you like.

**[00:28:25 – 00:28:29]** How much of that needs to come from the model and how

**[00:28:29 – 00:28:31]** much we can get from outside of it?

**[00:28:31 – 00:28:35]** I'm not an ML person, so I've not got the detail on that, but

**[00:28:35 – 00:28:39]** I absolutely agree with you; that's something that worries me too.

**[00:28:40 – 00:28:42]** Again, it's not even a trust thing; it's an understanding

**[00:28:42 – 00:28:45]** thing as well, I think, for me.

**[00:28:48 – 00:28:50]** Thank you.

**[00:28:52 – 00:28:59]** So I have a similar question related to intent, but intention

**[00:28:59 – 00:29:01]** changes, because now we have changing agents, right?

**[00:29:01 – 00:29:03]** Yep. Agents definition changes.

**[00:29:03 – 00:29:07]** So somebody states an object, my objective today is X, but

**[00:29:07 – 00:29:10]** actually objective becomes Y, and the details actually

**[00:29:10 – 00:29:13]** is today I'm running on premise with everything blocked, but

**[00:29:13 – 00:29:18]** tomorrow I may be allowed to use Google Drive to upload the data.

**[00:29:18 – 00:29:22]** So how do you keep compliant based on the changing agent?

**[00:29:22 – 00:29:26]** Same agent, but scope keeps changing.

**[00:29:26 – 00:29:29]** For those, again, if you didn't catch that, it was

**[00:29:29 – 00:29:34]** about keeping up with agent scope changes and compliance.

**[00:29:35 – 00:29:41]** I think that's where you need smartness in the governance layer.

**[00:29:43 – 00:29:47]** Too prescriptive can be problematic because it can't cope with

**[00:29:47 – 00:29:49]** the changing world.

**[00:29:49 – 00:29:50]** And I know the lawyers in the audience, if there are

**[00:29:50 – 00:29:55]** any, probably not, but I talk to lawyers a lot at my job, will

**[00:29:55 – 00:29:57]** be like, but we need to be precise.

**[00:29:57 – 00:30:00]** And I get that. But I think there's ways of writing policies

**[00:30:00 – 00:30:05]** that are like, if I can access this system because my agent identity

**[00:30:05 – 00:30:09]** allows me to access this system, then I can write to these ones

**[00:30:09 – 00:30:10]** and I can read from these ones.

**[00:30:10 – 00:30:12]** So I think you have to think about policies in a different

**[00:30:12 – 00:30:15]** way, and I think it's going to be a big head-scratcher

**[00:30:15 – 00:30:18]** for a lot of the ISOs and the SOCs and the people like that.

**[00:30:18 – 00:30:21]** Because I agree with you, it's a moving target, and I think you

**[00:30:21 – 00:30:26]** need to be slightly smarter about how you think about these things.

**[00:30:30 – 00:30:35]** I also think you need to separate security from the agent to

**[00:30:35 – 00:30:39]** the host, for example.

**[00:30:40 – 00:30:44]** With OpenShell, we don't rely on the agent to be secure,

**[00:30:44 – 00:30:50]** but we do the security part separate from the agent, which

**[00:30:50 – 00:30:54]** is, I think, an important design choice for security.

**[00:30:54 – 00:30:59]** Otherwise you can't guarantee the security.

**[00:31:01 – 00:31:03]** Yeah, so, I mean, there's certain things that you can do at

**[00:31:03 – 00:31:07]** the OpenShell layer, like Florian says, but they can also be a bit

**[00:31:07 – 00:31:12]** too broad, so, like, allow egress, no, but allow egress to, and

**[00:31:12 – 00:31:15]** it can be, like, anything in the Google Suite rather than, say, just

**[00:31:15 – 00:31:19]** Google Drive, things like that.

**[00:31:21 – 00:31:25]** Hi, thank you for the amazing talk.

**[00:31:25 – 00:31:28]** So, a lot of the rules that were presented seem to apply

**[00:31:28 – 00:31:33]** to structured data, and any organization probably will have

**[00:31:33 – 00:31:36]** a lot of unstructured data as well.

**[00:31:36 – 00:31:40]** How can we approach, you know, applying rules to

**[00:31:40 – 00:31:41]** unstructured data as well?

**[00:31:42 – 00:31:46]** Can the, for example, can the gateway check the unstructured

**[00:31:46 – 00:31:50]** data in progress and then decide whether to apply the

**[00:31:50 – 00:31:53]** rule, accept or deny the access?

**[00:31:53 – 00:31:58]** I wish you'd been a plant; that's a brilliant question, and it's

**[00:31:58 – 00:31:59]** something I should have covered.

**[00:31:59 – 00:32:01]** You couldn't have asked a better one, because actually that's

**[00:32:01 – 00:32:03]** a benefit that N8N gives you.

**[00:32:03 – 00:32:08]** Because it's not just purely a workflow situation; it's

**[00:32:08 – 00:32:12]** an automation, and you can actually put branching logic in there;

**[00:32:12 – 00:32:16]** you can even put AI and generative stuff in there if you want.

**[00:32:16 – 00:32:19]** You can even have cases where I like it's unstructured,

**[00:32:19 – 00:32:22]** so let's follow this rule set or go to this sub workflow, which

**[00:32:22 – 00:32:26]** is how this is actually set up with sub workflows, or you can actually

**[00:32:26 – 00:32:30]** have something that tries to make sense of whatever that unstructured

**[00:32:30 – 00:32:35]** thing is; there will be honestly some hit and miss to start with,

**[00:32:35 – 00:32:37]** because this is about understanding your workflow and figuring

**[00:32:37 – 00:32:43]** out what does and doesn't work, step one, but having something

**[00:32:43 – 00:32:46]** in that gateway layer that is of the maturity that lets you examine

**[00:32:46 – 00:32:50]** these things and learn and figure that out, I think is going to

**[00:32:50 – 00:32:54]** be key, because I agree with you, humans and systems are incredibly

**[00:32:54 – 00:32:58]** messy and don't follow that structured data, even when you try

**[00:32:58 – 00:33:02]** and make them, even with templates.

**[00:33:02 – 00:33:07]** So from a pure compliance point of view, asking a model now

**[00:33:07 – 00:33:08]** probably wouldn't pass compliance.

**[00:33:09 – 00:33:12]** But it would be enough to figure out what sort of More

**[00:33:12 – 00:33:15]** deterministic rules we might want to put in there, and

**[00:33:15 – 00:33:18]** NA10 can help you do that for sure.

**[00:33:18 – 00:33:23]** Other solutions exist, but it's just something that when

**[00:33:23 – 00:33:28]** people either go it's AI or it's not, I think there is a grey area.

**[00:33:28 – 00:33:31]** I think you need to merge the two and also apply some human

**[00:33:31 – 00:33:35]** intuition, and that's also where human in the loop can be valuable.

**[00:33:35 – 00:33:37]** So that can be like all of this was automated to let

**[00:33:37 – 00:33:41]** people do their job, because I hate being blocked by systems.

**[00:33:41 – 00:33:44]** But there can be, like, we don't know what to do with

**[00:33:44 – 00:33:48]** this, I'm going to escalate this to somebody, and I think that's also

**[00:33:49 – 00:33:54]** a real value for that to be part of that process at the Gateway.

**[00:33:54 – 00:33:56]** Now, obviously, at scale, that's not going to be great,

**[00:33:56 – 00:34:00]** but as you're fine-tuning it, I think is the right step.

**[00:34:00 – 00:34:02]** Excellent. Thank you. Thank you very much.

**[00:34:02 – 00:34:04]** Thank you so much, Dr Claire Knight.