Rethinking Zero Trust in the Agentic Era

Mark Callahan:

Hey everyone. My name is Mark Callahan. I’m a lead product marketing here at Strata. I’m joined by Aldo Pietropallo, who’s actually our field CTO. And Aldo, I’m thrilled to have you here because we’re just going to talk a little bit about Zero Trust Architecture and how this fits into the world of agentic identity. Welcome.

Aldo Pietropaolo:

Ooh, my favorite. Thank you, thank you. It’s glad to be here. Hello everyone out there, everyone that’s watching this series. Really appreciate your time. I hope it’s worth it.

Mark Callahan:

Absolutely. Well, you and I talk a lot about actually you’re one of the people that I look up to as a mentor. You’ve taught me a lot in your background. I’m gonna keep blushing this, but you’ve been in this industry for so long and you’ve had just, mean, you’ve been watching everything change and evolve, but right now we’re on the cusp of something really new, which is as we start thinking about agentic users, you know, and where they fit into the equation and

Aldo Pietropaolo:

Thanks brother.

Aldo Pietropaolo:

Yeah, that’s true.

Mark Callahan:

As a product marketer, I’m always listening to like what Gartner has to say. And a couple of interesting things I saw from Gartner were that, you know, in terms of adoption, they’re predicting that by next year, 30% of enterprises will have adopted autonomous AI agents to a degree. But I also was reading that on another report that they’re saying that by 2028, 90% of organizations that allow humans to share credentials with AI agents will have to make significant investment to undo this design.

Mark Callahan:

due to security and compliance issues, which both stand to reason, right? Zero trust architecture, you know this well. If I were to define it, I would say trust never verify always. That’s the oversimplified thing. You’ve got something a little different that you wanted to share.

Aldo Pietropaolo:

Mm-hmm. Yeah. Yeah.

Aldo Pietropaolo:

That’s pretty much it.

Aldo Pietropaolo:

Oh, interesting. You’re going to bring that up, right Mark? No, this is great. Yeah, zero trust. First and foremost, mean, Gartner’s research is always valuable, right? So I want to kind of clarify that. So the stuff you’re reading and even some of the stuff that I’m reading, you know, it’s eye opening. it’s first and foremost opening to me in particular, the fact that a lot of organizations are not

Mark Callahan:

I already! Alright, yes. Where are we?

Aldo Pietropaolo:

AI production ready, meaning that they are testing the waters, rightfully so. So they’re being very guarded as to how they’re implementing their agent tech platforms and the way they’re setting up their agents and doing a lot of research and development work and even test pilots and seeing what the agents can do on behalf of other agents, on behalf of users, et cetera.

Aldo Pietropaolo:

So I want to kind of clear the air first saying that it is very much in flux, especially in the identity industry. Standards are not even nowhere near being complete. In fact, they’re just starting. working groups are just starting to think about the agentic problem and how

Aldo Pietropaolo:

how to take advantage of the goodness that the industry and everyone, our colleagues in the identity and access management industry have provided in the past two decades and they’re asking, can we reuse some of this stuff? if so, can we reuse it and how do we make it applicable agents or agentic frameworks and AI frameworks that are geared towards the enterprise, which arguably you may make an argument that

Aldo Pietropaolo:

you know, is AI, you know, actually ready for the enterprise? Most implementations are very individual based or personal based, like us going to chat, GBT or Claude or interacting with different LLMs and doing research, doing coding, you know, if you’re a cursor user, a VS code user with copilot. But I haven’t seen major production ready AI business platform.

Aldo Pietropaolo:

So that makes sense where the AI where the and where I mean AI business platforms. I mean that the AI is fully aware of the of that particular business context, what the business does with the business operating environment, business applications, business infrastructure, business data. Data is a big thing. So let’s put a pin on that, right, because it deals with privacy and so forth. all this stuff.

Mark Callahan:

Okay.

Aldo Pietropaolo:

the architecture and infrastructure within a large enterprise. And I’m going back to your zero trust question, so I haven’t forgotten, but it’s going to be interesting because everything is in flux at the moment. And then on top of that, trying to rope in a ZTA or zero trust architecture model or approach into the agentic or AI world.

Mark Callahan:

Okay, yep, no, I gotcha.

Aldo Pietropaolo:

is going to be, in my opinion, a very difficult task to do because right now, AI uses trust-first architecture. right, TFA, there’s the hook.

Mark Callahan:

Ooh, there’s the hook. All right. I said trust never because that’s what we were taught. You know, the zero trust architecture or zero trust principles were trust never verify always, but you just suggest trust first.

Aldo Pietropaolo:

Trust first. Can you believe that? It’s a crazy concept. So the trust first approach would be trusting you until you give me a reason not to trust you. And that could look like in many different scenarios, permutations, et cetera. But know, ZTA zero trust is never grant access, always deny until…

Mark Callahan:

Ooh, spicy. like, okay, no, but say more, say more.

Aldo Pietropaolo:

you prove that you are authorized and authenticated and so forth to access that resource. Well, AI and agentic platforms were released in their first iterations with really trusting the user behind the interface. Meaning that, for example, if you go to cloud and launch integrated with an MCP server in the cloud client and you start prompting the LLM and so forth and if the LLM needs additional context, can…

Aldo Pietropaolo:

leverage the local MCP service, which by the way most of them are not heavily protected today, that’s going to change, right? So that’s one topic to keep in mind that that’s why people like me and many others like me in the identity industry are looking now towards how can we help customers be protected from rogue agents, right? But today, you could do a lot of damage. So that would explain why most projects are in research and development phases and they’re

Aldo Pietropaolo:

just being tested out in isolated infrastructures before a customer actually gets to the point where they implement that into production.

Mark Callahan:

And that experimentation also probably entails using homegrown, home rolled agents as well as opposed to agent platforms, external public platforms. Like that’s still a ways out even. Like right now it’s that experimentation with the things you can truly control and keep in bounds. Okay.

Aldo Pietropaolo:

yes.

Aldo Pietropaolo:

Correct. Correct. Correct. you know, so which is right, rightfully so, right? Because yeah, yeah, no, that’s awesome. Yeah. And that’s that’s important, right? Because you don’t want to bring in any rogue agents. It sounds like an interesting spy story, but any rogue agents into your environment, because it’s it’s really dangerous from a compliance perspective as well, from an audit perspective as well, which we’ll get into audit. But going back to

Mark Callahan:

I mean, it makes sense, right? Like we’re not saying anything. Yeah. People would be nodding their head in the audience right now saying, sure.

Aldo Pietropaolo:

trust first architecture, right? There’s cryptographic ways that you can establish trust within platforms. So it’s nothing new actually. And you can establish public key infrastructure methods of ensuring that things are encrypted, things are signed at rest as well as in transit. And when I say at rest, that’s also a critical piece to agentic platforms is

Aldo Pietropaolo:

Customers in the enterprise now need to take into account data at rest more than ever because data is what the LLMs need in order to establish context. And that’s how LLMs are useful to agents. And so when an agent is taking an action, it needs to understand the context and it needs to understand its role. It needs to understand what the intent of the action is.

Aldo Pietropaolo:

That is critical because the world is changing now from what does the agent have access to, what is its intent and what is its goal. And those are completely different paradigms from a static list of access control mechanisms or role-based access control or attribute-based access control. And add on top of that, that the agent right now is semi-autonomous.

Aldo Pietropaolo:

semi-autonomous because it still relies on the big brain, on the LLM, to do its job. It’s not that intelligent like the model is, if that makes sense. The agents do things, but it’s not a model in and of itself. So right now they’re not 100% autonomous. That’s another myth that’s out there. And by the way, they’re not 100% ephemeral if they’re actually going to be useful. Why? Ephemeral meaning temporary.

Mark Callahan:

going to repurpose it. I want a worker. I want to keep them around. Yeah.

Aldo Pietropaolo:

Right? Right. Right, Mark. So they need to remember, right? They need to have memory of what they what they were doing, what their role is, what the intent is and what the infrastructure looks like and what MCP servers are in the environment and all this other other stuff. Right. know, that’s kind of one one myth that I’ve been encountering in the wild as I talk to, you know, colleagues and

Mark Callahan:

memory.

Aldo Pietropaolo:

friends and customers and so forth. And then the other one is kind of a misunderstanding of what MCP servers do. MCP servers, from what I have researched, and again, big disclaimer audience, I don’t claim to be an expert on agentic platforms, but I have been digging deep in this. I know a bit, I know a bit, and that bit that I know is, for example, things like MCP servers.

Aldo Pietropaolo:

were created specifically to give LLM’s context of the environment so that the LLM is useful. It wasn’t created to be yet another proxy server abstracting APIs or anything else. It was strictly created so that the model can ask, I need more data or the agent says I need more data. Who has that data? Where do get the data? here’s a standard way of requesting data.

Mark Callahan:

Where do I get the pic?

Aldo Pietropaolo:

outside of the LLM so that I can create context around that data. So that’s literally what the MCP servers do. They go get data or they get some stuff to feed it back to the big brain, as I call it, to the LLM so that it then responds properly to the agent and then the agent takes it from there. And then in this case, the agent is semi-autonomous and says, okay, based on this dynamic response, I’m going to take this action with this

Aldo Pietropaolo:

with this other intent because it’s aligned to my overall goal, which my goal is reduce 10 kilowatt hours to five kilowatt hours in this span of time so that I don’t have to pay a significant light bill. Just to give an example, the other goal could be analyze the accounting numbers for the past three years, tell me where I can gain some efficiencies in my…

Mark Callahan:

Okay.

Aldo Pietropaolo:

Net income etc etc and that’s that’s my goal is to like make make the accounting practice more more efficient more effective so in in actuality what What’s happening here and what I see happening is that? AI in it of itself is now going through a big metamorphosis a big change from

Aldo Pietropaolo:

you know, just being personally used by you and I as kind of like assistants to do research development. Maybe I ask Cursor to write a function that would take me a couple of hours. It’ll do it like in a couple of minutes. And then I review it and I do a full code review. So, yep, that’s good. But it’s transitioning from that towards more like, OK, how do you apply AI and agentic platforms safely give them business goals?

Aldo Pietropaolo:

So you know how we use KPIs, some organizations use KPIs. It’s very similar. Instead of giving a KPI to a human, you give it to an agent. And then the agent takes it from there. But of course, it’s going to need a lot of information from the organization. And in order to have that adoption of the AI be received properly and adopted by businesses and actually used to achieve those goals and outcomes, they need to

Mark Callahan:

Sure.

Aldo Pietropaolo:

being a first stance, right? Because

Mark Callahan:

That’s so interesting. Again, I’m just trying to get my head around this trust first scenario because, so as I think about zero trust architecture and the way that it sort of progressed along, we got to this world where it was like, it was a model that was put against the existing state of identity. Like it was decades worth of identity. And then we got to this place where all of sudden it’s like the perimeter wasn’t good enough because if somebody was inside the perimeter and we let them just do whatever thing else.

Aldo Pietropaolo:

Yeah. Yeah.

Mark Callahan:

That was like where the zero trust really started to pick up steam was like, Hey, as long as they’re inside, we can trust them to do whatever they want to do. And then you realize if the bad person got inside, they would run rampant and that doesn’t work. So to get more and more granular with zero trust. Thinking about the architecture of agents and that’s trust first scenario. Like we have a chance to do this from the ground up. So instead of like trying to come in and put it, you know, old, a new model against old.

Aldo Pietropaolo:

Right.

Mark Callahan:

architecture or old design, we have a chance to do both in tandem. Are there things we learned from traditional IAM that we’re going to take forward here architecturally?

Aldo Pietropaolo:

Yep.

Aldo Pietropaolo:

Maybe, maybe, maybe, but artificial intelligence is a completely different computing paradigm altogether. So that’s going to be interesting in kind of transposing legacy identity and access management infrastructures and methods and protocols and et cetera, because it’s the whole operating model of the software that’s taking actions in the enterprise.

Mark Callahan:

Okay.

Aldo Pietropaolo:

is fundamentally different and it is dynamic in nature as well. So, not ephemeral, which is, know, spin up, spin down, spin up, it’s like, it’s dynamic, you know, it can actually, through very complex math, think, quotations, right, think, because it’s not sentient like a human, that’ll never happen, but it can reason, right, and it can take dynamic paths based on context, so.

Aldo Pietropaolo:

Current identity and access management paradigms are not as dynamic.

Aldo Pietropaolo:

Fairly static. current constructs will have difficulty with that dynamism, especially with that intent. Is it the right intent? So in my opinion, this is all the Pietro Paolo opinions, like role-based access control, attribute-based access control, that doesn’t even apply. It’s more like intent-based access control. Right? Yeah, it’s a completely different work.

Mark Callahan:

Hmm.

Mark Callahan:

Content-based access control.

Aldo Pietropaolo:

a world mark. Again, I will say I’m not an expert at that. just my juices are flowing around a completely different way of providing access control and access management and authentication authorization to agentic systems because they they look fundamentally fundamentally different. You know, I’ve written actually I’ve written an agent myself and MCP server myself and interacted with both. And I’m a student of the

Aldo Pietropaolo:

agentic platform protocols and so forth that are coming up to speed in the horizon and so forth and It’s it’s it’s different. It’s fundamentally different. You need somebody that That’s another thing from a career perspective for for my colleagues and everybody right? We’re all learning this stuff as Because we’re traditional identity and access management, you know people we we need to get up to speed on agentic platforms and

Mark Callahan:

Sure.

Aldo Pietropaolo:

And we’re learning how these agentic platforms operate. And the deeper you dive into agentic platforms and artificial intelligence, the more focused and nuanced you have to get when solving problems and use cases. you almost can’t pinpoint the problem per se, because a problem may manifest for two hours, Mark, not to mention three minutes.

Aldo Pietropaolo:

versus in today’s world if a problem manifests, the problem is always going to be there. Like I’ll give an example, like Mark doesn’t have the right attributes for access control. So he’s not authorized to access this resource. And we know that that’s a problem. It’s a static problem. could see it plainly, discover it, and it lasts. It’s permanent. In the AI world, the problem may only manifest under certain circumstance, certain prompts, certain intents, certain context. And you might see it once or twice a quarter.

Aldo Pietropaolo:

And for two hours. you can’t… How do you report on that? How do you audit that? How do you extract the telemetry, this fancy word for information that the system send to get normalized, transformed, gathered and reported on under a business context so that the business understands during these two hours we saw this problem manifest and we have the entire agentic chain built into that.

Mark Callahan:

Interesting.

Aldo Pietropaolo:

Including identity. Identity is a small piece.

Mark Callahan:

Can imagine?

Mark Callahan:

So you’re mentioning the chain of that, you know, there’s that, that problem that’s manifested was manifested because of Mark two dot O’s eight activities or Aldo two dot O’s activities. Like how do we make sure that I don’t know, like buying back to who flesh and blood Aldo is or flesh and blood Mark is like, how do we figure out that chain of custody for documentation? Like

Aldo Pietropaolo:

It’s very hard. We don’t know yet. We, or I don’t know yet. I don’t want to speak for my colleagues, but it’s a very difficult problem. Very difficult. And it’s the fundamental problem that is going to face our customers is trust, auditability in that agentic chain. And reminder, it’s not just identity in the chain. There’s other factors of trust, cryptographic trust.

Aldo Pietropaolo:

chain of custody, data lineage, agent lineage, outside of identity. Who’s the parent agent? Who are the sub-agents? What were the prompts? What was the context at that specific time when the agents evaluated the context? All that stuff. Because if the AI goes rogue, you’re going to need to prove

Aldo Pietropaolo:

that indeed you had the right controls in place and that the AI was constrained so that it cannot go fully rogue to the point where it’s going to disrupt somebody’s business.

Mark Callahan:

Hmm. You’re, you’re, mean, you’re, you’re putting adjuda in my stomach and our audience’s stomach and probably all the best ways. Like we’re all challenged with these problems. And I know that we hear from the private preview audience that they’re just being told, go figure this out. There, there isn’t one path in all of this. And I think you just hit on, you know, could you repeat again? So kind of those areas that you see as like where we need to start, like, they might start.

Aldo Pietropaolo:

Ha ha ha

Aldo Pietropaolo:

Yeah.

Aldo Pietropaolo:

yeah, outside of identity, like, I because I look at this, I look at this holistically. So it’s, you know, observability, what’s the agent doing? You have to be able to answer why the agent took an action, nevermind the, did it have access? Who the agent is working on behalf of? Who was the parent agent if it’s a sub agent, you know, in a flow? And how do you prove that in a moment in time that you have the right controls?

Mark Callahan:

the trust.

Mark Callahan:

Mm-hmm.

Aldo Pietropaolo:

to guard data and to runtime operations between agents, as well as, for example, between MCP servers and back-end resources and tools that the agent needs in order to achieve its role, its outcome. So all those things need to come together in a way that can be easily reportable on

Aldo Pietropaolo:

audit it on and that you actually have proof of the flow, the agentic flow, starting from the human all the way through the end of the transaction, whatever the agent or agents, because what I’m also finding out as part of my research is that enterprise agentics platforms and systems for any given role or outcome or goal, it may use tens of agents, even

Aldo Pietropaolo:

reaching 100 agents to do its job. If you have a action or goal to achieve, it may take multiple agents in an agentic chain, as I call it. And the key is, how do you instill the right security controls, the privacy controls, the governance controls, the observability and the identity controls, which is where Strata focuses.

Aldo Pietropaolo:

is on identity and so forth and some on the governance as well and some on the observability but fundamentally that’s going to be very critical to solve and it’s just starting. We’re all working on this together and colleagues in the industry are working on it hard including in the working groups and so forth so we’ll get there as a community of experts but it’s just starting.

Mark Callahan:

I mean, I’m gonna ask you a question then that I probably already know the answer to is that the systems of today probably just aren’t there to solve these challenges as you’ve outlined necessarily. Yeah, it’s.

Aldo Pietropaolo:

Yeah.

Aldo Pietropaolo:

Yeah. Yeah. Right. Right. mean, OAuth and OIDC, they’re very good at kind of identifying who the human actor is. And it can mint tokens, for lack of a better term, that you can use to transfer the context between one agent to another. if it were that simple, it would be phenomenal. But it’s not. And

Aldo Pietropaolo:

Maybe there’s better protocols that can be ingrained into that agentic flow that I’m talking about. Aside from OAuth and OpenID Connect, those frameworks were created for traditional applications in the pre-AI, pre-agentic world. So they’re going to have to evolve if they’re going to be implemented and adopted in a substantial production-like manner.

Aldo Pietropaolo:

within the next couple of years, four or five years, they need to evolve.

Mark Callahan:

slightly different angle here. So you’ve spent a lot of time and effort looking into CAPE and working with shared signals framework. And is there an intersection as we think, you know, from an architecture perspective, is there an intersection of that and agentic workflows? Okay, all right.

Aldo Pietropaolo:

yeah.

Aldo Pietropaolo:

Yeah, maybe, maybe. And big shout out to Atul. Hi Atul, love you. I’ve been talking to Atul, Tulsi Bagwali, the creator of about this. there may be an area for CAPE. the area would be, because remember that agentic chain that I was talking to you about and the observability and trust that you need to have within that chain. CAPE would be so fantastic because

Aldo Pietropaolo:

at any moment in that chain, you need the ability to, in real time, invalidate that and break that chain so that it doesn’t cause any harm based on a signal, right? Let’s say Mark was an adversary and Mark started the agentic chain and all the agents are doing Mark’s bidding and then all of a sudden, you know, we found out it was Mark, you know, yeah, yeah, yeah, yeah.

Mark Callahan:

giving me too much credit here but nevertheless I love it I’ve got my minions doing their thing yes

Aldo Pietropaolo:

Mark is like, oh no, you know, so we find out that you’re an adversary, you need to send a flare into the the agentic platform, right? And say, hey, Mark is actually an adversary, stop. Like, stop all the processing. So CAPE is perfect for that. Sending a shared signal into the agentic platform, says, Mark’s an adversary, halt. And so the agents, all of them, for that particular set of tasks, which by the way, in my mind,

Aldo Pietropaolo:

the tasks would be provable and cumulative across the agentic chain so that you could, no pun intended, chain all the agents together into one particular set of outcomes. then, again, no agent should be autonomous, really, in that model. But that aside, KAPE can be useful to send that flare in there to break that

Aldo Pietropaolo:

chain and then have all the agents halt and say, we have an adversary here, report the telemetry to the SOC, Security Operations Center, and I’m going to record my particular memory state and the whole chain state and write it into an audit log that it’s immutable and provable. That an auditor can quickly go boom, boom, boom, OK, when was the time period of that adversary?

Aldo Pietropaolo:

I see. Whoa, the agents were received a CAPE event and the whole chain stopped. And here’s the date and time, here’s the cryptographic proof, here’s the… at that moment in time, it’s critical, at that moment in time, these particular agents had elevated privileges across these MCP servers. The MCP servers then had elevated privileges for this, this and that.

Aldo Pietropaolo:

double check the data lineage to see what was exfiltrated, if anything, right? And have that whole process under control, for lack of a better term. That doesn’t exist today at all. And in order to really adopt AI, in my opinion, AI and agentic frameworks, is that whole problem set must be solved. It’s critical for it to be solved in order to

Aldo Pietropaolo:

go into production. I don’t see any enterprise customer really using agentic platforms in production unless all this has been well thought of and tested and executed and so forth. Because this could bring down an enterprise if not planned well.

Mark Callahan:

I know. And again, we didn’t warn our audience. This might be fear inducing, but hopefully they’re already thinking this exact same thing. I think you’re going to get a lot of nods agreement. kind of just going back to where we started the conversation and I want to bring it back around, you know, the traditional zero trust, definition of trust, never verify always you took us down a little different path here of, of trust first is, is, is a future state. Like when these problems get solved out.

Aldo Pietropaolo:

Yeah.

Mark Callahan:

come back around to trust never the agents that we don’t have the rogue things or is it, am I looking at through the long wrong lens? Is it always going to be a trust first with, with context trust first with intent.

Aldo Pietropaolo:

Yeah, think my opinion, I think it’s going to be more of a trust first with intent and context. Now, I want to clarify something for the audience. I’m not saying don’t implement security and guardrails and guidelines and policy and so forth. I’m saying that explicitly ensure that a agentic platform security and governance management program in the enterprise exists so that when

Aldo Pietropaolo:

new agentic platforms are procured and tested and so forth. They’re following certain trust frameworks and guidelines that make it easier to adopt the platform. So trust first doesn’t mean no security. It actually means hardened security. Like it’s got to be trust first. And the way we trust first is by having X, Y, Z in place. And if you

Mark Callahan:

Good, clarification. No, that’s…

Aldo Pietropaolo:

are audited and passed through the right controls and testing throughout the entire chain, then you come out as a trusted entity. At the end of the day, you are trusted. So if we vet, let’s say, Mark for six months through a series of controls, and you’ve passed every single one with flying colors, then I can consider you a trusted component in my infrastructure. So unless proven otherwise, but of course,

Aldo Pietropaolo:

there’s monitoring, there’s auditing, built in into how you’re going to be used in the enterprise or an agent or agentic platform is going to be used in the enterprise. So it’s a lot more business friendly without giving away on security controls. So that makes sense because ZTA is like, don’t even, don’t like stop. I’m not gonna give you any access. and there’s been cases where

Aldo Pietropaolo:

it’s not efficient for the business. So you have to find that mix.

Mark Callahan:

Well, with just a couple of minutes left, know, just thinking about the state that a lot of our private preview members and audience are in right now as everyone’s experimenting, you mentioned that you’re still learning yourself. You might have one or two tidbits of where our audience might go learn more themselves. there any particular resources that have been useful for you that you could share, you know, that they could go learn from as well?

Aldo Pietropaolo:

Yeah.

Aldo Pietropaolo:

Mm-hmm.

Aldo Pietropaolo:

yeah.

Aldo Pietropaolo:

Yeah, definitely. I would say…

Aldo Pietropaolo:

I would say first and foremost, go to the agentic platforms, like go to the GCP platforms, the AWS Bedrock, for example, is a very good platform to learn from. The Microsoft platforms as well, but even 8N for agent orchestration and so forth. And this is the way I learned.

Aldo Pietropaolo:

The way I learn is by actually getting my hands into code. So actually writing an implementation, actually write an agent and write an MCP server and orchestrate it together and include an LLM and go to your open AI subscriptions for access to the LLM, get an API key, do the same for Claude and so forth and implement something so that you can see all the different components in action.

Aldo Pietropaolo:

That’s what I would recommend because it’s the easiest way to learn. You’ll see exactly what the agentic platforms are doing. You’ll see what the LLM is, what the role of the LLM is in something like this. And you’ll quickly see the security gaps. You’ll quickly see the auditing gaps. You’ll see the trust gaps. You’ll see all the gaps that were introduced with these type of frameworks. And that’ll get you up in

Aldo Pietropaolo:

up and up and running. So my biggest piece of advice is get your learn by doing get your hands dirty and in the future as and I’m talking about in the very near future. You know, I would say involve your your advisors. So if I involve advisory agentic advisory, you know, AI advisory, cybersecurity advisory, identity advisory.

Mark Callahan:

Learn by doing.

Aldo Pietropaolo:

and bring everyone together as a kind of round table and surround yourself with advisors that have been there before you, kind of like trailblazing. If you want to have a walk, let’s say if you’re taking a hike, it helps if there’s five people in front of you with machetes that are encountering the jungle. They’re bringing down, they’re clearing a path, right? And then they’ll, hey, by the way, I learned this, like that snake with those colors.

Aldo Pietropaolo:

It’s venomous. Watch out for that snake. And you’re like, hey, thank you. I appreciate it. know, thanks for the advice. Right. So tread carefully, right. And always look for advisors. And I think that’s a key thing. I personally look for advisors everywhere I go. again, I don’t assume to be an expert at the agentic world. Fairly, I’m well versed, but not an expert. And I surround myself with advisors and I listen a lot.

Aldo Pietropaolo:

and community. Absolutely.

Mark Callahan:

And community too, right? in this, like, mean, that’s why we’re part of this private preview. Like we, there’s probably competitors who are in the private preview, you know, but at the same time we’re learning from each other because it’s all evolving at the same time together. all here. No one person is truly an expert yet because it changes every week.

Aldo Pietropaolo:

my goodness.

Aldo Pietropaolo:

Of course.

Aldo Pietropaolo:

Yes.

Aldo Pietropaolo:

That’s the thing. That’s the thing. Like, that’s beautiful. Like, I attend the OpenID Foundation Community Group for AI, for identity, agentic and AI identity. And there’s tons of wealth of professionals in there, know, seasoned subject matter experts that I learned from and that I engage with. And it’s a community group. It’s not a working group.

Aldo Pietropaolo:

So there’s no standards being developed or anything. It’s just literally, to your point, it’s a community. Experts coming together and saying, whoa, how do we solve this? How do we solve that? How do we solve this? do we?

Mark Callahan:

Who saw the poisonous colored snake before and learned from that and can share with somebody else? Yeah.

Aldo Pietropaolo:

Yeah, and share it. Yeah. So I think that’s the other big piece of advice before we break. Mark is listen more than you speak right now. Let’s just listen. And it’s amazing what the world will open to you. If you just sat back and just listen, you will learn so, so many things. That’s that’s but that’s just might be personal to me. You know me, you know, the way I work, I operate and and even this this this this podcast episode, right?

Mark Callahan:

I think it’s good advice.

Aldo Pietropaolo:

I talk a lot but I’d rather not talk a lot. I want to listen more. Yeah. But I love Mark. I love working with Mark.

Mark Callahan:

I made you, that was the point. So you’re allowed, there’s your, but I hope our audience learned a lot listening to you and enjoyed this. We don’t have all the answers, we’re learning, so.

Aldo Pietropaolo:

That’s right. That’s right. And it’s exciting, right? Because we don’t have all the answers. And I love it. I love it. And I love interacting with the community and with our customers and with everyone around us. It’s just awesome. It’s, yeah.

Mark Callahan:

It really is.

Mark Callahan:

Let’s keep the conversation going. Let’s use the Slack community to reach out to us. We want to talk more. We want to interact with everyone. Although thank you so much for the time. lots of disclaimers. It’s a discussion. We’re still learning. We’re still trying to shape everything and understand it and define it. But I think you gave us some real interesting food for thought here as everyone’s trying to learn, experiment by doing and learn from that. And hopefully we can give them some tools to help with that experimentation. So thank you all.

Aldo Pietropaolo:

You’re welcome.

Aldo Pietropaolo:

Yeah, definitely. OK, awesome.

Mark Callahan:

Hey everyone. Thanks for joining us. Please check for our next episode and we look forward to talking to you again soon. Take care.