TL;DR: Every security control you run today assumes the actor behind an action is either trustable or predictable. On The Non-Human & AI Identity Podcast, C1.ai CEO Alex Bovee laid out why agents are neither, and what replaces trust when trust isn't available.
- Bovee's taxonomy: "Pure play software is kind of deterministic, mostly trustable. Humans, non-deterministic, trustable. Agents, non-deterministic, non-trustable."
- Why humans earn trust despite being unpredictable: moral compass, reputation, consequences. Agents have none of the three.
- Agents "goal max": give one a goal and it will find whatever way it can to complete it, with no internal sense of which ways are off limits.
- This is already live: asked whether agents are being deployed into production without security guardrails, his answer was "100%."
- The replacement for trust: what Bovee calls the digital background check, scoping an agent's mission and intent, then authorizing its individual actions against that scope at runtime.
Put in the hot seat on The Non-Human & AI Identity Podcast, Alex Bovee was asked whether AI agents behave more like employees or like software. "It's both," he answered, "and that's actually what makes them so hard."
That answer deserves unpacking, because it explains why so many agent security programs feel like they're reaching for tools that almost fit. Every control we have was built for one of two kinds of actor, and agents are a third kind.
Why do we trust humans when they're completely unpredictable?#
Humans are non-deterministic. Give the same task to the same person on two different days and you may get two different approaches, which should terrify a security team, except that it doesn't, because human unpredictability comes bundled with something that bounds it. As Bovee put it, "humans have a moral compass and they have a reason to not do things. They have reputation, they don't want to get fired."
His supporting evidence is a piece of industry history worth sitting with: insider threat detection products "never really took off in any sort of mass way," precisely because the insider threat, while real, stayed rare. The social contract did most of the security work, quietly and for free. The entire orchestration-era identity stack, standing permissions, periodic cleanup, trust-but-verify, was built on that foundation.
Why do we trust software when it has no judgment at all?#
Software earns trust the opposite way. It has no moral compass, but it doesn't need one, because it's deterministic. It does exactly what its code says, every time, which means you can test it, reason about its failure modes, and know that a workload with broad permissions will still only ever run the procedures it was written to run. Predictability substitutes for character. That's the foundation under the service account playbook: trust the code, protect the credential.
What makes agents the worst half of each?#
Agents break both foundations at once. "What's really different about agents is that they are non-deterministic," Bovee said. "So that's not like software. But they kind of goal max and try to complete the task at hand, and not necessarily with a moral compass. If you just give them a goal, they're going to try to accomplish that goal and find whatever way they can to complete that goal."
Goal-maxing without a moral compass is the crux. A human given an ambiguous task fills the gaps with judgment about what you'd want. An agent fills them with whatever reaches the goal, and the episode's cautionary tales all share that shape: the agent that finds a stray API key and uses it, the coding assistant that deletes production data in pursuit of a clean state. No vulnerability was exploited and no attacker was present. The agent simply took a path no one thought to fence off.
Hence the taxonomy: "Pure play software is kind of deterministic, mostly trustable. Humans, non-deterministic, trustable. Agents, non-deterministic, non-trustable." And lest this sound like a future problem, the host asked Bovee directly whether AI agents are being deployed into production without security guardrails today. His full answer: "100%."
If you can't trust the actor, what do you trust?#
Here the conversation turned practical, because non-trustable doesn't mean unusable. Asked whether agents need background checks the way employees do, Bovee rejected the analogy, and what he offered instead is the design principle: "What you do need to understand is what is the mission intent and goals that are scoped to an agent. If anything, that's kind of like the digital background check you should be doing to authorize actions."
A background check tries to establish that an actor is trustworthy in general. The digital background check gives up on that question and answers a better one: is this specific action consistent with this agent's scoped mission, right now? Enforced at runtime, that looks like four controls working together. The agent authenticates as itself, so every action is attributable even when behavior is unpredictable. Its tool access runs through a governed gateway where each action is authorized against the agent's mission and scope. Its credentials are vended at the moment of use rather than held, so a goal-maxing agent has nothing durable to misuse. And everything lands in a record that ties the action back to the agent and the human behind it.
None of this requires the agent to be trustworthy, which is the point. The hot seat's final question was whether Bovee would trust an AI agent to make a decision impacting his own personal security. His complete answer: "No." From the CEO of an AI access company, that's not pessimism. It's the design brief: build the system so that trust in the agent is never load-bearing.
How does C1.ai secure actors you can't trust?#
C1.ai is built on the premise the episode lays out. Agents get real identities through agent SSO, every tool call passes through the MCP Gateway where access is decided per action against mission and scope, secrets live in Vault and reach the agent only at the moment of use, and every action is attributable end to end. Security becomes the engine of the agent rollout rather than the brake, because a bounded agent is an agent you can keep saying yes to.
The agents in your production environment aren't employees and aren't software. Secure them like the third thing they actually are.
Hear the full hot seat on The Non-Human & AI Identity Podcast, then see how C1.ai governs agents at runtime.
