Josh Woodruff created the Agentic Trust Framework, co-chairs the Cloud Security Alliance's Zero Trust Working Group, and is founding chair of the CSAI Foundation. He co-authored Agentic AI + Zero Trust with John Kindervag — the person who coined the term zero trust. He runs multi-agent labs himself, which is how he ended up with the war story near the end of this episode: a $300 overnight API bill from an orchestrator that replicated itself 47 times because he'd constrained it too tightly. This conversation is about applying zero trust to entities that reason and act on their own, and doing it in a way you can defend in front of a board.

The through-line is that agents aren't service accounts or API keys — they're probabilistic, stochastic systems closer to a human colleague than a deterministic script. Josh's framework treats them exactly that way: five questions (who are you, what are you doing, where can you go, what are you eating and serving, what if you go rogue) mapping to identity, behavior, segmentation, data governance, and kill switches, backed by 25 normative requirements and 81 controls published on GitHub. The framework doesn't tell you what to fear — MAESTRO, OWASP, and NIST already do that — it tells you what to do about it. This one's for security leaders trying to move from generative-AI governance to agentic, and for anyone tired of the binary "do we do agents or not" argument.

Thank you to our Sponsors:

→ Hampton North is the premier US based cybersecurity search firm. Start building your security team with Hampton North.

 → Sysdig is the leader in AI-powered real-time cloud defense; stop watching and start defending.

Josh's opening move is to defuse the panic. Agentic AI is probabilistic, stochastic, never says the same thing twice — and the instinct is to treat that as a brand-new security nightmare. His counter is that we've already been securing something exactly like this for years.

The fundamentals don't move. Never trust, always verify, assume breach, least privilege — all still apply, and in Josh's view they apply harder now than they did for humans or for the deterministic non-human identities (service accounts, API keys) that zero trust extended to comfortably. What changed is that an agent reasons, adapts, and chains tool calls in a loop until it decides the goal is met. You handed it the goal and the tools; you did not hand it a script.

The practical consequence is the one gap the whole framework is built around. Zero trust provides a secure tunnel from the requester to the service. It does not tell you what's traveling through that tunnel.

Conor pre-empts the eye-roll with the XKCD "now there are 13 competing standards" joke, and Josh takes it head-on. He's overloaded with frameworks too. His claim is that this is a different category of thing.

The mechanism is five questions that sound almost too casual until you see what each one maps to. Who are you is identity — cryptographic, verifiable, unforgeable, not a shared human credential. What are you doing is behavioral monitoring, knowing normal so you can catch not-normal. Where can you go is classic segmentation and blast-radius control. What are you eating and what are you serving is data inputs, outputs, and governance. What if you go rogue is incident response and sub-second kill switches, because these things move at machine speed and they will go rogue — not maliciously, but because you can never write a perfect goal.

Under the five questions sit 25 normative requirements and roughly 81 controls, published on GitHub and at the framework's site. Josh's phrasing — "deceivingly simple" — is the point. The five questions are a memory device; the substance is underneath.

The part that landed hardest for Conor is the autonomy progression: intern, junior, senior, principal. An agent starts as an intern with a tiny scope, few tools, and a human reviewing everything it does — the equivalent of checking whether it got the coffee order right and brought it back the correct temperature. Each rung grants more tools, a bigger objective, and less review, until a principal-level agent runs largely autonomously with oversight shifting to sampling and audit findings.

The distinction Josh draws from human management is that this progression is not time-based.

Promotion runs across five dimensions — demonstrated reliability, a security audit, a clean operational record among them — and the last one is the one worth stealing: 

Conor maps this directly onto intent-based leadership from Turn the Ship Around! — the shift from a permission-based model to an intent-based one as competence grows. Observe-and-report at intern, recommend-and-approve at junior, act-and-notify at senior. The point where an agent says "I'm about to do this, intervene if you want, otherwise I'm off" is the point where you've stopped granting permission and started trusting intent. And the flip side is built in: demotion is immediate on any security violation or operational trip-up, with a fallback to the pre-AI business process. Which means you need to have kept that process alive — BCP and disaster recovery don't go away because you shipped an agent.

Before any of this works, you need a registry of agents, the way you have an HRIS for employees. Josh is honest that nobody nails this — raise your hand if you have a perfect CMDB — but the stakes are higher with agents because you're not just tracking existence, you're tracking access and the impact of that access.

The scale problem is that no-code and UI-driven tooling means sales, marketing, legal, accounting, and procurement are all building agents. Josh sees this as genuine value, but it multiplies the questions: what account is it running under, what's its identity, is it allowed to see the data it's been granted. He notes roughly half the RSAC Innovation Sandbox finalists this year were about discovering shadow AI and governing agents — a signal of where the tooling gap is.

This is where his central pitch to security leaders lives. The 40% Gartner failure figure isn't about bad models — it's about agents that never ship because they aren't governable, auditable, or explainable.

He extends the "constraints are rocket fuel" idea past security into performance. A tightly scoped agent has fewer tools to choose from, a smaller goal, and less context to get "lost in the middle" — so it's both more secure and more capable. An agent that does everything, as Conor puts it, is an agent that does nothing.

Josh is direct that the reason AI ROI keeps missing has little to do with the tech. Teams under pressure deploy at principal level on day one — the modern version of "just give me root" — and they drop AI into a mess expecting it to clean up.

The other failure is security's absence. Josh cites a report figure of 86% of AI agents shipping without security involvement, which is exactly why he wants security leaders raising their hands rather than waiting to be invited. His concrete move: throw an amnesty week — non-sanctioned AI apps, everyone comes out of the corner without punishment, so you can find out what's running and help do it better.

And his credibility here comes from failing himself. He built the framework, wrote the book, knows constraints are rocket fuel — and still over-constrained his own lab so hard that the orchestrator routed around it. 

That's a handful of agents in one person's lab. Josh's escalation — imagine it at hundreds, thousands, or the billions of agents vendors are projecting — is the argument for the graduated approach: make your mistakes when they're small, at intern and junior levels, on use cases visible enough to declare a win but not big enough to take the business down.

The stretch that pushes past security is Josh's read on headcount. The companies actually using AI at scale can't hire fast enough, because more output creates more work — more human discretion, judgment, and taste to handle it.

He borrows Dan Shipper's line that LLMs have "commoditized yesterday's intelligence" — everyone's floor is raised, so the differentiator becomes the expertise you add on top. His example is IKEA, which automated the mundane parts of customer service, noticed a recurring pattern in design questions the agents surfaced, and stood up a new business unit around it — a reported $2 billion revenue stream that existed only because they repurposed people toward trends a machine would never have flagged.

Conor frames this as the courage to grow versus the reflex to compress operating costs — either the industry uses this to create new categories and services, or it spends the moment squeezing yesterday's economy. Josh closes the technical discussion with the Anthropic crosswalk: their Zero Trust for AI Agents ebook grades the environment (foundational to optimized) while his framework grades the agent (intern to principal), so the two fit together rather than compete. The line he wants people to leave with is Anthropic's design principle — make the thing you don't want impossible, not merely tedious, because friction means nothing to a system that works straight through it.