Trusted2Act

Gravitee

AI agents are already hard at work. They're moving money, touching customer data, all at machine speed. And CEOs want more of them, driving efficiency across the org—yesterday. But who owns these agents? Who sets the rules, makes sure they don't go rogue, and has a plan for when they do? Every deployment eventually runs into the same question: can these agents be trusted? So teams deploying AI agents are facing this dichotomy: ship fast enough to stay ahead, govern well enough to stay accountable. Trusted2Act brings both imperatives together. Each week, host Tim Tyler sits down with the platform leaders, security architects, and AI champions actually running agents in production. They dig into how those agents are deployed, where the boundaries are drawn, and how teams hold their agent workforce to the same standard as their human workforce. Join Tim each week as he explores how to build systems that create agents you can trust.

Episodes

  1. 3d ago

    Individual agents for individual controls | Dogan Akbulut, Co-founder and CTO, DSALTA | Ep. 4

    DSALTA’s customers keep asking for one button that writes their whole compliance documentation set. Dogan Akbulut tells Tim Tyler his team could build it, and that it wouldn’t be ethical: a certification says the company applied the controls itself, and a document the AI wrote reads as proof it didn’t. ㅤ Dogan is co-founder and CTO of DSALTA, so he sits on the shipping side. His job is to get agents doing compliance work faster. The pull from the other side comes from his customers’ buyers and investors, who need to believe the evidence came from the company. ㅤ His answer is narrow agents. DSALTA writes individual agents for individual controls. Each one works from a strict profile of the customer’s company, country and progress, and each is kept from doing anything beyond what it was asked. Dogan also explains why a $70,000 SOC 2 quote helped sink his previous startup, and why he tells founders to explain their AI use before an auditor asks. ㅤ 👤 Guest Bio Dogan Akbulut is co-founder and CTO of DSALTA. DSALTA is an AI compliance automation platform that prepares startups and growing companies for audits against frameworks including SOC 2, ISO/IEC 27001, HIPAA, GDPR and AIUC-1. He’s a Toronto-based software engineer. He built and exited a water ordering app, then founded Paillor, an AI employee knowledge base. He started DSALTA after compliance costs helped end that company. DSALTA is backed by İş Bankası Group’s Artificial Intelligence Factory. ㅤ 📌 What We Cover Why DSALTA writes individual agents for individual controls instead of running one model across every frameworkThe strict company profile each agent reads before acting: country, goal, vulnerability level, and whether employees finished their trainingTurning down the one-click documentation request, and why AI-written policies read as proof nothing was appliedThe customer job the team expected to take more than a week, which an agent finished in an hourHow a $70,000 SOC 2 quote helped end Dogan’s previous startupWhy compliance frameworks trail the technology by three or four years, and where AIUC-1 fitsDogan’s advice: explain your AI use to customers and auditors before anyone asks, and start compliance early ㅤ 🔗 Resources Mentioned DSALTAAIUC-1, the AI agent standard from the Artificial Intelligence Underwriting CompanySOC 2 Type 2, PCI DSS, GDPR, ISOClaude by AnthropicThe Agent Accountability Framework ㅤ Trusted2Act is presented by Gravitee.

  2. Oct 22

    How to give agents more autonomy and still know who acted | John Gren, Director of Product Management, Gravitee | Ep. 3

    John Gren wanted an agent to read Jira, compare product requirements against existing tickets, and find gaps in the roadmap. The API key he gave it could write. Soon colleagues were asking him on Slack why he was changing their priorities, and Jira showed every edit as his. ㅤ Tim Tyler and John work through why that happened and what delegation should look like instead. John came up through identity and access management, so his instincts come from the security side. Yet he sounds like the person shipping the agents when he calls limiting their autonomy “strictly counterproductive.” His fix pulls apart what the API key had fused together: the agent’s own identity, the authority John delegates to it, and a separate check on what it may do with that authority. The boundary he draws: if John can delete repositories in GitHub, an agent acting for him shouldn’t automatically be able to. ㅤ 👤 Guest Bio John Gren is Director of Product Management at Gravitee, where he has worked on product vision and strategy since 2022, moving from API management into event stream management and AI agent management. His recent focus is LLMs, MCP, agent-to-agent communication, and identity, access, and authorization for agents. Before Gravitee he held integration, identity and access management, and architecture roles. He gave a keynote on agent experience at the Nordic APIs Platform Summit 2025. ㅤ 📌 What We Cover The point where AI turns into an accountability problem: when agents get enterprise data and tools and start acting on someone’s behalfWhy John calls cost “an effect of something” and puts agent identity and visibility first, wherever the agent was builtThe Jira agent asked to read the roadmap that started reprioritizing tickets, and why nothing in the record could separate its edits from John’sImpersonation vs. delegation: why a static API key is worse than a handed-over OAuth token, and how OAuth Token Exchange (RFC 8693) produces a token naming both the user and the agentWho’s responsible when an agent acts: the user who delegated, plus an internal sponsor who can revoke the agent’s accessHow authorization has “always fallen between the cracks” in identity and access management, and a policy that lets John write a Jira ticket while refusing the same write to the agent acting for himGuardian agents for decisions too dynamic for a written rule, such as a support refund that needs a finance manager’s approvalLogging every authorization decision with the policy version that made it ㅤ 🔗 Resources Mentioned Model Context Protocol (MCP), including its authorization specificationOAuth 2.0 Token Exchange, RFC 8693OAuth Client ID Metadata DocumentSPIFFEOpenID Foundation AuthZEN Authorization APIMicrosoft PurviewJira ㅤ Trusted2Act is presented by Gravitee.

  3. Oct 15

    What expanding an agent pilot actually authorizes | Anita Ganti, Co-founder and COO, KAVIA AI | Ep. 2

    A team runs a pilot where an agent reads a codebase, generates a targeted change, and deploys it after a human reviews it. The pilot works, so the team asks to expand. Anita Ganti wants to know what that word covers: more engineers on the same use case, or engineers shipping without the human review that made the pilot safe to run. In her words, it doesn’t make sense to pilot one thing and then deploy something else. ㅤ Tim Tyler talks with Anita Ganti, who sits on both sides of the house. As a public company director, she asks management for evidence. As COO of KAVIA AI, she works with the teams shipping agent-written code. Co-host Cole Howard presses on the metrics. Where the shipping side counts saved engineering hours, Anita counts the reviewers, build runs, and production bugs that come with cheap code. Her boundary is the baseline. Measure an agent against the best realistic alternative, even when that’s a regex. Don’t let the system that wrote the code also write the tests that judge it. ㅤ 👤 Guest Bio Anita Ganti is co-founder and COO of KAVIA AI, a San Francisco company building an enterprise software engineering platform for complex codebases. She’s an independent director at Power Integrations, where she chairs the Cybersecurity Committee and sits on the Audit Committee. She’s also an independent director at Silvaco Group, where she chairs the Compensation Committee. Earlier, she was a senior vice president at Wipro, vice president of global technology at Flex, and a general manager at Texas Instruments. She holds an MBA in finance from Wharton and writes for NACD’s Directorship magazine on how boards evaluate AI investments. ㅤ 📌 What We Cover What “expand the pilot” authorizes: more engineers on the same use case, or the same use case without human reviewThe questions Anita asks before any guardrail goes in: which business constraint the agent addresses, what useful outcome it buys for the complete cost, and whether there are enough human reviewers for what it generatesWhy cheap generated code gets expensive once validation, build runs, test coverage, and production corner cases are countedTying permissions to the value of the task, through her Google sign-in example: the software probably doesn’t need all your photographsMeasuring an agent against the best realistic alternative, including conventional automation or regex, instead of an artificially weak baselineAgent-written code that passes tests but that people can’t review, and why DRY and packaging practices still applyTim’s shared Google Doc, where Claude, asked to shorten the draft, deleted a collaborator’s text and the comments attached to itExamining the evaluator: when one system writes both the implementation and the tests, its misunderstanding survives ㅤ 🔗 Resources Mentioned KAVIA AINACD (National Association of Corporate Directors)Anita’s NACD article: From Buzzword to Bottom Line: Is AI Working?WeAreDevelopers World Congress North AmericaDRY (“Don’t Repeat Yourself”) principle ㅤ Trusted2Act is presented by Gravitee.

  4. Oct 8

    Six questions to answer before an agent goes into production | Linus Håkansson, Chief Product and Technology Officer, Gravitee | Ep. 1

    Linus Håkansson asked his desktop agent to help with a busy week, and it deleted a bunch of his calendar invitations. It was allowed to. He'd connected it to Google Calendar over MCP and handed it his own rights to create, update and delete, so the agent acted as Linus with everything Linus could do. ㅤ In the first episode of Trusted2Act, Tim Tyler and Linus work through the six principles of the Agent Accountability Framework: identity, sponsor, role, authority, oversight and recourse. Linus speaks from both sides of the house. He argues against pulling the handbrakes on agents, then spends the conversation on what security and identity teams need answered before an agent acts. ㅤ The boundary he draws is a default. A new agent gets its own identity, separate from the human it works for, and starts with no authority until a sponsor or owner grants it. Destructive actions go back to a human first. ㅤ 👤 Guest Bio Linus Håkansson is Chief Product and Technology Officer at Gravitee, which presents Trusted2Act. He joined Gravitee in 2021 and has served as VP of Product, Field CTO and Chief Product Officer. Before that he held architect roles at cloud and integration technology companies. He studied engineering at Lund University and is based in London. On this show he speaks for both sides of the house: the builder who wants agents in production and the person who has to answer for what they do. ㅤ 📌 What We Cover Why giving agents the same identity and credentials as humans is one of the most common mistakes Linus sees, and why every agent belongs in a registry recording who built it and who owns it.The corridor test: an agent should be able to answer "who are you?" with short-lived, machine-generated credentials, not a hard-coded API key.The sponsor, the human who answers for an agent's actions, its costs and whether it delivers, and why accountability runs in two layers.Putting budget into an agent's role, and the company that found daily weather checks on an expensive model had turned into a big financial issue.Authority across the three things an agent talks to: models, tools and other agents.Guardian agents, approvals granted "under this condition, for this period of time," and revoking the lanyard.Why twelve-month penetration tests and compliance cycles give way to always-on red teaming once agents try every combination of a URL. ㅤ 🔗 Resources Mentioned Agent Accountability FrameworkModel Context Protocol (MCP)Claude Desktop, Google Calendar, ChatGPTLangChain, Kubernetes, Workday, ServiceNowGuardian agentsSOC 2 and ISO certification ㅤ Trusted2Act is presented by Gravitee.

  5. Sep 1

    Welcome to Trusted2Act

    AI agents are already moving money and touching customer data at machine speed, and CEOs want more of them. But who owns those agents, who sets the rules, and who has a plan for when one goes wrong? ㅤ Trusted2Act is a weekly show about the tension every enterprise now faces: ship fast enough to stay ahead, govern well enough to stay accountable. Host Tim Tyler sits down with the platform leaders, security architects, and AI champions running agents in production. ㅤ First episode Wednesday, September 9. Subscribe wherever you listen, and visit trusted2act.com.

  • 1 Trailer
    4 Episodes

Trailer

About

AI agents are already hard at work. They're moving money, touching customer data, all at machine speed. And CEOs want more of them, driving efficiency across the org—yesterday. But who owns these agents? Who sets the rules, makes sure they don't go rogue, and has a plan for when they do? Every deployment eventually runs into the same question: can these agents be trusted? So teams deploying AI agents are facing this dichotomy: ship fast enough to stay ahead, govern well enough to stay accountable. Trusted2Act brings both imperatives together. Each week, host Tim Tyler sits down with the platform leaders, security architects, and AI champions actually running agents in production. They dig into how those agents are deployed, where the boundaries are drawn, and how teams hold their agent workforce to the same standard as their human workforce. Join Tim each week as he explores how to build systems that create agents you can trust.

Information

  • Creator
    Gravitee
  • Years Active
    2026
  • Episodes
    5
  • Rating
    Clean
  • Copyright
    © Copyright 2026 Gravitee
  • Show Website
    Trusted2Act