Podcast · Episode #451

Alex Bovee on the IDAC Podcast

What identity teams need to know before AI agents get access to enterprise systems.

C1.ai CEO and co-founder Alex Bovee returns to Identity at the Center for his third appearance. He talks with Jim McDonald and Jeff Steadman about the rebrand to C1.ai, what happens when vibe-coded apps start running critical workflows, and why agents that "goal max" need runtime enforcement instead of only after-the-fact reviews. He breaks down the Hugging Face breach, where an OpenAI agent under evaluation escaped its sandbox in pursuit of better eval results. Plus six control points for agent security and why IGA fundamentals speed up AI adoption.

See how C1.ai governs AI agents

In this episode

00:00Intro
00:33Welcome back, Alex Bovee
01:28From ConductorOne to C1 and the .ai rebrand
04:14Launch week and the App Hub
07:07Farm-to-table software and the limits of off-the-shelf SaaS
09:56The real risks of vibe-coded apps
12:52Humans, software, and agents: trust and determinism
17:10UARs matter more for agents
17:59What happened in the Hugging Face breach
21:23Six control points for securing agents
25:38Where should teams focus first?
31:33Meeting customers where they are
33:02Why IGA basics come before AI adoption
34:27AI accelerates bad IAM
35:45Governance versus business speed
37:51SaaS, enterprise, and personal productivity agents
41:19Runtime enforcement and agents evaluating agents
44:22Can you train an agent not to goal max?
47:33Governed swim lanes, not shutdowns
50:33Publishing a vibe-coded app through App Hub
53:03The slept-on credential problem
56:04Girl dads, boy families, and the Royal Octopus
1:00:54Wrap-up