智能体让用户的 Resy 账号被封：Keycard、JPMorgan Chase 与 AAuth 谈授权

简要说明Brief Description

An AI Agent Got Its User Banned From Resy — Keycard， JPMorgan Chase & AAuth

目录Table of Contents

• 为什么智能体仍然无法实现自主性
  Why agents still don't get autonomy
• 为什么 OAuth 不适用于智能体
  Why OAuth doesn't fit agents
• 像新开发人员一样引导代理入门
  Onboarding agents like new developers
• 银行在交易授权方面已经了解的内容
  What banks already know about authorizing transactions
• 为智能体设定任务
  Giving an agent a mission
• 智能体商务与“了解你的智能体”
  Agentic commerce & "know your agent"
• 网络并非为智能体而构建
  The web wasn't built for agents
• 开放协议与封闭生态系统
  Open protocols vs. walled gardens
• 被 Resy 封禁的智能体
  The agent that got banned from Resy
• 将大脑与双手分离
  Separating the brain from the hands
• 目前适用于生产环境智能体的方案
  What works for production agents today
• 安全软件工厂
  Secure software factories
• 机器人学的启示
  Lessons from robotics
• 为什么审计日志存储在智能体之外
  Why the audit log lives outside the agent
• P(doom) 真实存在吗？
  Is P(doom) real?

为什么智能体仍未实现自主性Why agents still don't get autonomy

嗯，大家好。欢迎来到 AI Engineer New York。今天能来到这里，我特别兴奋。呃，我叫 Ally，是 Keycard 的技术团队成员。嗯，今天我和几位非常棒的嘉宾一起参加讨论。Ian，Keycard 的 CEO；Michael Davis，摩根大通的全球首席安全架构师；还有 Dick Hart，AOTH 的创始人，也是 OOTH 的共同创作者。今天他们都来到了台上。我特别期待和大家聊聊基于意图的授权。嗯，首先我想强调的是，随着越来越多的公司希望赋予自己的智能体更高程度的自主权，他们开始借助运行时授权。运行时授权的做法是针对智能体的每次工具调用进行授权，而不是让智能体持有广泛且长期有效的访问权限，以免它最终滥用这些权限。Um, hi everyone. Welcome to um, AI Engineer New York. I'm super excited to be here today. Uh, my name is Ally. How I'm a member of technical staff at Keycard. Um, I'm here with some amazing panelists today. We have Ian, CEO of Keycard. We have Michael Davis, um, global chief security architect at JP Morgan Chase, and we have we have Dick Hart, the founder of AOTH and co-creator of OOTH with us on stage today. I'm super excited to talk to all of them about intentbased authorization. Um, and to set the stage, I want to bring to light that as more companies are looking to give their agents increased levels of autonomy, they're looking to runtime authorization to help. Runtime off is the practice of authorizing an agent per tool call rather than having the agent hold broadstanding access that it will eventually misuse.

然而，这是否属于工具调用，从来都不是一个简单的问题。这是因为许多 MCP 工具和 API 都是粗粒度的。人类很难编写出完美的策略，而且智能体运行时所处的环境也会不断变化。意图可以提供额外的上下文，帮助我们在运行时更好地判断智能体可以或不可以执行哪些操作。接下来，我想深入探讨一下，我们为什么一开始就需要基于意图的授权。模型已经有了显著进步，能够处理更大的上下文窗口。由于模型的视觉能力提升，它们也能够验证工作成果。在许多场景中，人们都在宣称通用人工智能已经到来。如果模型真的这么强，如果通用人工智能今天真的已经到来，那么为什么各个团队仍然难以赋予智能体更大的自主权？However, is this tool call or not is never a simple question. This is because many MCP tools and APIs are coarse grain. Humans struggle to write the perfect policy and the environment around the agent will change as it runs. Intent can help by providing extra context so that at runtime we can make better authorization decisions about what an agent is allowed or is not allowed to do. So to continue I would like to talk about um really dive into why do we need intentbased off in the first place. Models have dramatically improved. They have bigger context windows. They're able to verify work because model vision capabilities have improved. In many contexts, people are proclaiming that AGI is here. If the models are so good, if AGI is really here today, then why are teams struggling to give their agents more autonomy?

Ian，先从你开始吧。你在 Keycard 帮助男性和金融企业。你发现有哪些因素在阻碍他们？Ian, let's start with you. You're helping men and financial enterprises at Keycard. What are you seeing that's getting in the way?

主持人：嗯，我认为总体来说，企业，尤其是金融服务公司和受监管行业，几乎总是把安全放在首位。Host: Well, I think broadly speaking, enterprises, especially financial services firms, regulated industries are almost always security first.

这就是他们在业务中建立信任的方式。维护业务连续性是我们的首要任务，创新则排在第二、第三，甚至第四位。我认为，概括来说，在任何企业中，你都会看到各种不同的小孤岛、不同的小身份体系、不同的小系统，来自各个不同的领域。怎样才能真正把它们整合起来，让智能体能够在其中导航、申请访问权限，同时还能确保智能体的表现胜过用户或业务原本能做到的水平？遗憾的是，我们如今的大多数系统都是粗粒度的。Salesforce 就是个很好的例子：很长一段时间里，他们的 OAuth 只有一个范围，也就是 API。放在智能体的语境下，这没什么帮助。所以，概括来说，最重要的一点是：如今大多数系统的安全机制，都是为这样一个世界设计的——所有决策都由人来做，软件的行为也完全可预测；而不是为我们新发明的这种新奇“魔盒”设计的。它会进行推理，一遍又一遍地尝试寻找问题的解决方案。It's how they build trust in their business and maintaining the business continuity is by our first like the first priority then innovation is second third or fourth I think like broadly speaking in in any enterprise what you see is this like hodgepodge of different little islands of different little identities of different little systems of from across all different worlds and how do you actually tie that together in a way that an agent can navigate through that ask for access and then also ensure that the agent can outperform like uh something that was by the user or the business And the unfortunate situation is most of our systems today are coarse grained right I don't know Salesforce is a good example where a very long time they had a single scope which was API on their oath which is like in the context of an agent uh not very helpful so that's that's the broadly the first and foremost part is that most of the systems they have for security today were designed for a world where humans were making all the decisions and software is very deterministic not this new fangled magic box we've invented that basically reasons and tries over and over again to find a solution to a problem.

为什么 OAuth 不适用于智能体Why OAuth doesn't fit agents

主持人：Doug，OOTH 是如何成为问题的一部分的？OOTH 是如何造成阻碍的？为什么它不适合智能体？Host: Doug, how is OOTH part of the problem? How is OOTH getting in the way and why is it not the right fit for agents?

嘉宾：嗯，当人们开始思考如何授权智能体访问某些资源时，现成可用的工具就是 OAuth，于是大家拿起这个工具，说：“这就是工具，这应该能解决问题。”但 OAuth 并不是为这种场景设计的。它最初的设计目的是：如何让一个网站与另一个网站通信？你知道，在 OAuth 2 中，我们加入了作用域。在此之前，它能做的就是任何事情。嗯，不过它要求你提前注册。它假设有浏览器参与重定向。你知道，多年来，OAuth 也不断演进，以支持其他一些场景。但智能体世界完全不同。我们事先不知道智能体需要做什么。我们需要随着时间推移再做出这个决定。智能体的不同实例会需要不同类型的权限。Guest: Well, when people started looking at how do we authorize agents to access something, the tool that was sitting there on the shelf was OOTH and people grabbed that tool and says here's a tool. This is authorization. It should be able to solve the problem. But OOTH was not designed for this kind of world. It was designed originally for like how do I let this website talk to this website? You know in O2 we added scopes. Before that it was just do anything. Um but it required you to be pre-registered. It's expecting that there's a browser involved in a redirect. You know OOTH has evolved over the years to support some other things. But the agentic world is completely different. We don't know ahead of time what the agent needs to do. We need to go and make that decision over time. different instances of an agent are going to need different kinds of things.

正如 Ian 所谈到的，人们会说：“我们已经有适用于 OAS 的权限范围了，直接把它们映射到智能体上就行。”但对于智能体所做的事情来说，这种粒度实在太粗了。And you know, as Ian talked about, the granularity of the scopes that people says, well, we already have scopes for OAS. Let's just map those over to agents is far too coarse grain for what agents are doing.

主持人：戴维斯，你如何看待企业逐步迈向更高水平的自主化？Host: Davis, how are you seeing enterprises move towards higher levels of autonomy?

主持人：是的，我觉得关键在于，呃，你要如何处理这个粗粒度问题？Host: Yeah, I think the key piece is uh how do you deal with that coarse grain problem?

像培养新开发人员一样引导代理入门Onboarding agents like new developers

我看到，比较成功的企业会像引入开发者一样引入智能体：一开始不会在第一天就给你完整的提交权限，而是随着你逐渐成熟，逐步增加你的能力等级。因此，企业正在制定的定义是：什么样的上下文能让这个智能体安全？通常不能只看智能体自己怎么说。它可以对某些事情作出证明，但还要考虑周围的环境以及其他有助于了解其自主程度的信息。一个非常简单的例子是：沙箱运行在哪里？它是否运行在沙箱中？这类因素会影响获准的自主程度。And what I've seen the kind of more successful enterprises is they kind of board agents like they onboard developers right start with you don't get full you know commit access day one right you're actually having to go through and add the levels of capability as they mature right and so the definitions that enterprise are coming up with what is the context that makes this agent safe and it isn't just usually what the agent says right um it can you know attest to something but it's other things like the environment around it and other information that can help you understand levels of autonomy Very simple example would be where is the sandbox running is it in a sandbox right those type of things can change the level of autonomy that's allowed

嘉宾：当然，我们提到了核心的屏幕访问问题。为了让大家更好地理解，举个例子：通过 Notion 的 MCP 服务器，你可以说“获取这个页面”，也就是类似查看页面的工具，或者说“获取页面”；但你不能只说“获取这个页面上的这个数据库”。那么，基于意图的运行时授权为什么是更好的模型？这个问题开放给所有人。Guest: absolutely yes we mentioned that core screen access problem and to put that into perspective um to give an example um with notion's MCP server you can say fetch this page which is like the view page um tool or get page but you can't say just get this database on this page um how is runtime authorization based on intent a better model that's for anyone.

主持人：我来试着说说。对我来说，嗯，这是金融服务行业或许可以借鉴的东西，希望如此。Host: I'll take a shot at. So to me, um this is something that the financial services industry hopefully maybe we can learn

银行在交易授权方面早已掌握的信息What banks already know about authorizing transactions

从你了解的银行所经历的背景来看，嗯，银行很早以前就从对人进行授权和身份验证，转向对交易进行授权了，对吧？而交易是在什么时候发生的？是在运行时，对吧？嗯，所以我觉得，我们能够从过去经历过的那些挫折中吸取教训，并将其应用到这个全新的问题上。我还觉得，嗯，有一点是：当你了解意图时，在运行时调试某些东西会更容易，对吧？我想我们都还记得过去写支票的时候，对吧？不过，呃，或者现在大概是在电视上看到那些东西，这么说才对。嗯，但是，呃，你知道，写支票时上面有一个备注栏，对吧？那个备注栏实际上是用来说明这笔付款的意图的。from the background that you know banks have gone through. Um banks moved long ago from authorizing and authenticating humans to authorizing the transaction, right? And when is that transaction occurring? At runtime, right? Um, and so I think that, you know, runtime authorization is we're going to be able to learn from the kind of the scars of the past that we've had and apply it to this new new problem. Um, I also think that uh, you know, one thing is easier to debug something at runtime when you understand the intent, right? I think we've all remembered back in the day writing checks, right? But, um, or seen those things on TV now, I guess, is the right thing. Um, but, uh, you know, writing checks, there was a memo field there, right? That memo field was used to actually tell the intent of what this payment was.

但支票本身确实有一些限制，对吧？价格、付款、日期等等。对吧？我认为其中很多概念现在都在应用，也可以应用于帮助这个运行时。But the check itself did have limits, right? The price, the pay, the date, etc. Right? I think a lot of those concepts are now being applied and can be applied to help with this runtime.

嘉宾：意图算是那种，你知道，像很多词一样，说起来挺难的词。所以，你知道，接着这里进行一笔交易付款的例子来说，对吧？这不是一个范围问题，而是我能不能在特定情境下做这件事？嗯，就是这笔付款，但我觉得我们需要一个代理。Guest: Intent's sort of one of those, you know, like many words, words are hard. And so, you know, building on uh the example here of making a payment of a transaction, right? You know, that's not a scope. That's can I do this one thing in this particular context? Well, this one payment, but I think we need a an agent.

我们要做出任何决策时，智能体都应该能够做到这一点吗？你需要了解其余所有背景：我们为什么要进行这笔付款，之前发生了什么。比如说，我们是不是才刚刚在 5 秒前付过同一笔款，现在这就成了重复付款？仅仅因为眼下的情境看起来合理，并不意味着从更大的任务目标来看，这就是正确的做法。因此，在 AOTH 中，我们正在探索“任务目标”这一概念：从整体上看，我们希望智能体完成什么；然后，每一项决策都要结合当时发生的事情，以及整体目标和意图来做出。对于很多事情，你还需要在交易层面掌握足够细致的信息，才能确切知道正在发生什么，而不只是知道“我可以去付款”。我觉得，要理解为什么需要意图，一个很有意思的实际例子是：假设你同时开着两个 ChatGPT 会话，或者两个 Claude 会话。在一个会话里，我说：“嘿，帮我去买点东西。”在另一个会话里，我说：“嘿，帮我看看生产环境里是不是有 bug，以及为什么会有这个 bug。”we to make any decision should it be able to do it you need all the rest of the context of why are we making this payment what are all the things that happened before you know did we just make the same payment just like you know 5 seconds ago and now this is a double payment right you know just because this is right in context doesn't by itself doesn't mean it's the right thing within the broader mission and so you know in AOTH we're working on the concept of a mission that is what do we want the agent to accomplish big picture and then each of the decision decisions are made within the context you know the intent around what's happening big picture around doing that and you need granularity at the transaction layer for many of the things to know what exactly is happening not just I'm allowed to go and make payments yeah I think one of the most interesting things I think about like a practical example like to understand like why intents required is if you have two chat GPT sessions or two cloud sessions in one session I say hey help me go to do some shopping in the other session I say, "Hey, help me understand if there why there's a bug in production."

它们在配置上有很大差异，比如应该拥有哪些权限，以及什么时候应该让你重新介入——也就是什么时候应该让人类再次参与？所以归根结底，如果我们没有意图，或者没有能力传达用户或企业对这件事的意图，我们实际上就无法实现自主运行，对吧？因此，今天上午很多演讲都在说：“嘿，我们要用智能体来运营业务，我们要做这些事。”这听起来很棒。但如果发生了 Pocket OS 式的事故，比如它因为拥有粗粒度访问权限，而不是长期范围的访问权限，意外删除了生产数据库，而不是暂存数据库，那第一分钟会发生什么？所以，作为一个行业，我们想做的是利用我们创造出的这个“魔法盒子”来自动化我们的生活。Those have very different like profiles in terms of like like what permissions they should have and also when they should bring you back into the loop, like when should the human be involved again? And so at the end of the day, if we don't have intent or some capacity to like relay what is the user or the business's intent with this thing, we actually can't get to like autonomy, right? And so a lot of the talks this morning were, hey, we're going to run our business on agents, we're going to do all this stuff. It's like, well, great. But what happens the first minute like a pocket OS style instant happens where like it actually accidentally deletes a production database instead of staging because it has coarse grained access instead of long scoped access. And so we what we want as an industry is to leverage this like magic box we've created to like automate our lives.

当前的现实是，你可以这么做，并承担所有风险，然后观察由此产生的所有实例。因此，在我们真正解决这个根本问题、实现真正的自主性之前——也就是让业务能够实现运营自动化，让我们人类得以抽身，并将其规模化——我们必须先解决意图的问题。The current state of the world is that you can do that and take all of the risk and then you can see all the instance that come from it. And so until we actually solve that underlying problem, realizing true autonomy, so being able to operationalize our business and be able to step away as humans and scale that, we have to solve intent first.

主持人：当然。既然我们现在已经明白为什么需要意图驱动式 off，接下来就来谈谈它在实践中到底是什么。它有哪些基本构件？实际应用起来是什么样的？嗯，Dick 刚才通过 AOTH 任务这个概念提到了这一点。嗯，Dick，请详细讲讲这个任务。Host: Absolutely. And now that we understand why we need intentbased off, let's talk about what it is practically. What are the primitives? What does it actually look like in practice? Um Dick hinted at it with the concept of the AOTH mission. Um so Dick, elaborate on the mission.

为智能体赋予使命Giving an agent a mission

这个任务是基于什么制定的？是基于用户的意图、智能体的意图，还是两者兼有？What is the mission based off of? Is it based off of the user's intent? Is it the agent's intent? Or is it a combination of the two?

嘉宾：嗯，代理应该是代表某个人行事的。在 AOTH 中，我们将“人”定义为组织或自然人，因为代理可能代表其中任何一方行事。因此，代理需要以它所代表的人的最佳利益为出发点，因为最终要为代理的行为负责的就是这个人，对吧？代理本身不可能承担责任，对吧？所以，任务是由这个人交给代理去完成的。一个好的代理会与这个人协商，进一步讨论这项任务可能有哪些参数。举个好例子，回想一下以前——感觉就像三个月前——你想编写一些代码时，会先制定一个计划，然后代理就会执行这个计划。Guest: Uh well, the agent, you know, should be working on behalf of the person. And in AOTH, we define a person as either the organization or a human because it could be operating on either one of those. And so it needs to be acting in the best interest of the person that it's acting on because that is who's ultimately responsible for what the agent does, right? The agent agent can't be responsible, right? And and so the mission is something that the person is giving the agent to do. The agent uh a good agent is going to go and negotiate with a person to go and talk more about like what what could what are the parameters around that. You know a good example is when you think of back you know in the day which seems like 3 months ago when you would want to code something up and you create a plan and then the agent would do the plan.

现在你只要告诉它，它就能弄清楚所有事情。但关键在于“计划”是什么？你想做什么？然后你把这些告诉智能体。这样一来，当你之后做授权决策时，这些信息就构成了上下文。接着，这个任务标识符会贯穿整个过程。因此，你可以进行审计，查看发生过的所有事情，以及在这个任务的上下文中做出了哪些决策，对吧？而如今，你知道，并没有真正完善的智能体身份或任务概念，对吧？它只是在做某件事，而各方在做决策时，并不清楚究竟是智能体的哪个实例在执行，也不知道这项工作属于哪个任务的上下文。对吧？Now you just tell it and it figures everything out. But that whole concept of what's a plan? what are you trying to do? And you give that to the agent. So then that then is a context around your where you're making authorization decisions later on. And then that mission identifier tracks through everything. So you can go and you know audit and be able to see what were all the things that happened and what were the decisions that happened in the context of this one mission, right? Where today you know there isn't really a good concept of agent identity or the mission, right? It's just making something and and things are making decisions without really knowing which expl which instance of the agent's doing it or what's a context of what mission is this involved in. Right.

主持人：多跟我讲讲那个协商阶段吧。比如，如果用户正在和一个即时代理交谈，而这个代理又去跟另一个代理说：“我想让你去读一下 CEO 的邮件。”这就超出了那个代理的职责范围。那么，这个意图会被拒绝吗？嗯，应该会吧？所以我们知道，良好的职责分离很重要。我不确定我们之后会不会再谈到这一点，但关键是要把执行任务的代理和监督它工作的代理分开。也就是说，一个代理负责执行工作，我们认为应该由另一个独立的代理来监督它的行为。这样就能做到职责分离：监督代理本身不执行任何工作，但它可以决定执行代理能做什么。因此，如果用户说：“哦，我想让你去读一下 CEO 的邮件”，这很可能会立即被确定性策略拦截，对吧？Host: Tell me more about that negotiation phase because what happens if a user is talking to an instant agent and it talks to that agent and says I want you to go read the CEO's email. That's outside of the scope of that agent. So is that intent rejected from the user? uh should be right so we know with a good separation and I don't know whether I forget whether we're talking about this later but the separation concerns of the worker right there's an agent that's doing the work and we believe there should be a separate agent that's supervising what this one does and so that you have a separation of concerns where this one can't do any of the work but it gets decide what this agent gets to do and so if the user says oh I want you to go read the co's email, that's probably going to get caught in deterministic policies right away, right?

比如说，这不是一件模糊的事，对吧？读取、读取别人的邮件，我们对此有很好的控制措施。嗯，但是让代理去，你知道，把 CEO 的邮件转发到外部，这就比较模糊了。理想情况下，这类事情会交由监督代理处理，由它判断这可能不是个好主意，然后说不行，你不能这么做。Like that's not a vague thing, right? Reading reading somebody else's email, we've got good controls for that. Um, but telling the agent to, you know, send the CEO's forward a CEO's email to the outside world, that's a little more vague and that's the kind of thing that ideally comes back to a supervising agent says that's probably a bad idea and no, you can't do that.

嘉宾：当然。所以我觉得，这是另一种基于意图的基础要素，那就是政策。嗯，Keycard 的 Ian，当任务需要变更或政策需要更新时，你们会如何看待这种情况？当任务或政策需要更新时，Keycard 能如何帮助跟踪这些变更？Guest: Absolutely. So, I feel like that's another primitive two of intent based off is is policy. Um Ian at Keycard, how are you seeing that when a mission needs to change or a policy needs to update, how can Keycard help keep track of those changes as maybe the mission or policy updates need to be made?

主持人：是的，我觉得退一步来看，确实有这么回事：有段时间以前，Davis 和我坐在一个房间里，那时 AOTH 和生态系统里的其他一些东西还没有出现。我们当时重点讨论的事情之一就是同意疲劳。我觉得至少我们总会面临这样的权衡：系统要做得多安全，以及这会对人造成什么影响。你知道，关于 Keycard，我们对此的总体看法是，你要制定广泛适用的确定性策略，基本上明确哪些事情绝对不能发生，或者哪些事情总是需要有人参与。然后，在此基础上，你真正需要考虑的是：好，现在这些已经到位了。作为个人或组织，我可以写下各种策略，但这些策略与我针对某项具体任务真正希望采用的具体策略之间，还存在很大的差距。Host: Yeah, I think like taking a step back, there's like actually was Davis and I were sitting in a room some time ago and uh before like AOTH and and some of these other things actually had emerged in the ecosystem, one of the things we actually talked a lot about was consent fatigue. And I think like at the minimum like we you always have this like how secure do you make a system versus like the trade-off of like the impact of the human. And so you know a key card our broad view on this is you want to have like broad-based deterministic policy that basically says this is what must never happen effectively right or these are the things that always require a human be involved. And then from there, what you really want to think about is, okay, cool. Well, now that I have that in place, there's a big gap between all the policy I can write as a human or write as an organization and then what I actually want the policy to be in the specifics of a specific task.

所以，真正的挑战是，怎样把这两件事叠加起来，对吧？因为人类不可能把所有内容都写出来。所以，其中一种情况是用户与代理之间的交互，双方之间存在某种意图，也就是交易意图。除此之外，还有企业为什么要构建或采用代理的意图。比如，我们为什么要购买 Cloud Code？因为我们希望让开发人员更高效，或者希望实现其他一些目标。而在使用 Cloud Code 之类的工具时，我此刻为什么要用它？其实是为了修复预发布环境中的一个 Bug，对吧？这是两种不同类型的意图。如果我们能理解这两种不同的意图，并以某种方式把它们转化为代理能够执行操作的边界框，就基本上可以求出它们的交集，然后说，好，这就是你实际能做的事。And so the the ne the real challenge is how do I like layer over those two things, right? Because humans can't write it all. And so there's a version of that that is like a user or agent to agent interaction and they have an intent between those two of like transactional intent. And then there's also like the business's intent for why they build or adopt an agent. So why did we buy cloud code? Well, because we wanted to make our developers more successful or because we wanted to do these different things. And in the context of using cloud code or whatever, why am I working in this moment with cloud code? Well, it's actually to fix a bug in staging, right? And those are two different types of intent. And if we can understand those two different things and then convert that some way into into uh like a bounding box of what those agents can do, you can then basically calculate the intersection of that and say okay here's what you can actually do.

而对于任何构建这类系统的人来说，诀窍就在于：如何确保只有在绝对必要时才让用户介入，因为这将成为影响普及速度的问题。但这也是一开始要让智能体实现自主运行时面临的普及难题。And then the trick for anyone building these systems is how do I ensure that I don't bring the user into the loop except when absolutely required because that's what's going to be the adoption curve problem. But that's also the adoption curve problem when it comes to like enabling agents to be autonomous in the first place.

客人：有道理。Guest: That makes sense.

主持人：我喜欢你刚才谈到的交集。我觉得这是身份与访问管理领域里一个很独特、但我们讨论得还不够多的方面，对吧？通常你只能访问某一项内容，对吧？我看到这种基于意图的方法取得成功的例子。而让我更感兴趣的是，不同的意图实际上可以来自组织内不同的部门，对吧？这样一来，这些要素就能彼此解耦，各自独立存在，然后再汇聚起来形成一个决策。这个决策也不必是一成不变的，对吧？Host: I like what you were saying with the intersection. And I think that's a unique thing we don't talk about enough within identity and access management, right? Normally you get access to one thing, right? And so what I've seen successful kind of in this intentbased approach. Um, and where I get more excited is you can actually have that those different intents be from different areas of the organization, right? And so you have the decoupling of these things that they can kind of live on their own but then come together to form that, you know, decision. And that decision doesn't have to be static, right?

所以，如果我们以 CEO 的邮件为例，嗯，你知道，如果这个情境涉及的是行政助理，那么她可能确实应该能读这封邮件，对吧？或者也许只能看日历，对吧？所以我觉得，当我们看到并开始思考这些交叉组件时，嗯，我们就有了一种完全不同的方式来表达策略，同时也开始把等式中不止一方纳入进来。我们以前总是只谈其中一方，也就是应用在执行某项操作；而现在，我们实际上可以把整个生态系统纳入进来。因此，我越是看到组织开始意识到，维护这些其他元素的状态或上下文、以便帮助判断意图，能够彻底改变运行时授权的有效性。So if we use the example of the CEO's email, well you know if that context involves that's the administrative assistant then yeah maybe she is supposed to read the email right or maybe just the calendar right and so I think when we see and we start thinking about these intersection components um we have a totally different way we can start expressing policy but also starting to bring in not just the one side of the equation we always talked about before which was the app doing something now we actually have the ecosystem you can bring in and so the more I I see organizations starting to realize that you maintaining that state or that context of these other elements to be able to help with that intention can completely change the way you're effective at runtime authorization.

主持人：你们现在在企业中普遍看到这种情况吗？大多数企业都已经建立了使命跟踪和政策跟踪机制，还是说如今这些机制大多仍然缺失？Host: And are you seeing this across enterprises today? Most people have mission tracking and policy tracking in place or is that largely missing today?

嘉宾：不，它还是全新的。嗯，我想你知道，我之所以很兴奋能聊聊它，部分原因是我觉得它正在改变我们思考这个问题的方式，对吧？即便是在最简单的情况下，如果你是开发者，嗯，你从事务这类概念出发思考，并且有意图这样的概念，那么你就更容易构建出能够按照这种意图进行组合和使用的组件。嗯，所以我认为，这会让我们有更多方式来思考这些问题并进行交流，最终也会让彼此之间更具互操作性，对吧？嗯，对我来说，另一个有意思的地方是，你可以在这上面运行的诊断。意图可能会贯穿许多事件，对吧？我想，嗯，我之前见过的一个例子是，谈到那个……使命会贯穿其中。Guest: No, it's it's it's brand new still. Um and I think you know part of the reason why I'm excited to talk about it because I think that it is changing the way to reason through this right even in the most simplistic case if you're a developer um and you are thinking in terms of things like transaction and you have these concepts of intent um it makes it easier for you to potentially build the components that'll be composed and used through that intention um and so I think it'll give us more ways to reason through these and communicate and then ultimately be more interoperable right um and to me the last thing that I think is interesting is the diagnost diagnostics that you can run on this. Intention is something that flows through many events potentially, right? And I think uh one of the examples I've seen before is, you know, talking about that like that that mission flows through.

嗯，它可能会持续很久，关注度可能几周后仍然还在。所以对大多数企业来说，现在仍然非常非常早期。Um it could be longived. It could be weeks that attention can still be there. Um so it's still very very early for most enterprises.

主持人：当然。没错，这种互操作性至关重要。我认为这对企业来说相当困难，因为它们需要在不同的云、不同的环境和不同的遗留系统之间周旋，同时还要确保这项政策使命在所有这些不同环节中都能贯彻落实。Host: Absolutely. And yes, that interoperability is key. I think that's pretty hard for enterprises because they're rubbing between different clouds, different environments, different legacy systems and that policy that mission has to hold through all of those different hops.

嘉宾：是的，很多企业仍然不得不面对这样一个事实：权限明明标的是只读，却仍然可以写入，对吧？所以你还得开始处理其他问题。嗯，我认为这有助于让人们更容易形成一套分类体系或共同语言，从而实现互操作。是的，Guest: Yeah, a lot of enterprises still have to deal with the fact that the the permission says read only and it's still rewrite, right? So like you have other problems you have to start dealing with and so um I think that it will help get that kind of taxonomy or language amongst people be easier to interoperate. Yeah,

主持人：当然。我对基于意图的授权感到兴奋的原因之一，是我认为它有潜力为智能体等领域带来重大突破。Host: absolutely. One of the reasons why I'm excited about intentbased authorization is because I think it has the ability to be a huge unlock for things like agentic

智能体商务与“了解你的智能体”Agentic commerce & "know your agent"

商业。嗯，我们来把基于意图的授权应用到实际场景中。我认为基于意图的授权在这里很有价值；对用户来说，它能帮助他们确保自己的智能体在个人预算范围内购买合适的商品。对商家来说，这意味着能够获取购买意图，从而获得更多数据，了解用户为什么购买，以及是否应该信任这个智能体并允许它访问自己的网站。嗯，Davis，当我们从金融服务和智能体商务的角度思考智能体时，基于意图的授权为什么如此重要？commerce. Um, so let's apply intentbased o to something real. I think intent based off adds a lot of value here and for users it can help them ensure their agents buy the right item with their own personal budget. And for merchants that means capturing the intent that gives them extra data to understand why a purchase is being made and if this agent should even be trusted to visit their site. Um Davis when we think about agents in the context of financial services and agentic commerce why is intentbased off so important.

嗯，我觉得简单来说，这可能是对一个概念的延伸。也许不是所有人都了解，但有些人应该听说过“了解你的客户”，对吧？我想了解我的客户，知道他们是谁、在做什么。但我觉得，我们也开始看到“了解你的智能体”的需求。所以，我认为这里需要将智能体本身、实际用户的意图、操作员的意图、处理方的意图等联系起来。以前我们还无法真正把这些因素结合起来，对吧？当然，这在商业等场景中很重要，因为还需要考虑更多层面，比如相关监管要求的目的是什么，等等。我认为这有助于简化这些操作，也就意味着我们能更充分地利用这些智能体，让它们为我们做好工作。Um, I think simply it extends the concept maybe not everybody's aware but some are around you know know your customer right so I want to know my customer know who they are what they're doing but I think also we're starting to see I want to know my agent right so I think that you have a coupling here around the agent itself um the intent of the actual user the intent of the operator the intent of the processor right etc um very before now we couldn't really bring those together right um it matters of course when it comes to things like commerce because you have additional layers on top of this around what was the intention for things like regulatory requirements etc. Um and this is going to help I think simplify those operations which means we'll get more access to these agents you know doing good work for us.

Web 并非为智能体而构建The web wasn't built for agents

主持人：这很有道理。智能体商务面临的另一个障碍是，互联网并非为智能体而打造。嗯，Ian，你能告诉我们智能体身份如何助力吗？Host: That makes sense. And another blocker for aentic commerce is the fact that the web wasn't made for agents. Um Ian can you tell us how agent identity can help?

嘉宾：是的，我觉得退一步来看，我们一直都面临这样一个问题：未注册的客户端该怎么办？比如说，我打开 eBay，但没有登录，我用的是 Chrome，eBay 不知道我是谁。那我怎么进行访客结账？怎么证明我是个真人？你知道的，这样他们才能说：“好，你可以出价 50 美元买这对枪托。”我觉得，如果我们都在关注个人智能体领域的动态，比如 Muse、Instinct、Grockbot，还有最近公布的 OD to Sierra、Decagon 以及其他公司围绕个人智能体协议所做的事，就会发现我们面临的根本问题是：怎样才能让智能体访问网站、与网站交互，并让你知道自己确实可以信任这个智能体？所以很长一段时间以来，网上一直都有验证码。Guest: Yeah I think stepping back we've kind of always had this problem where like what do you do with the unregistered client? So, like I I show up on eBay, I haven't logged in, I'm using Chrome, eBay doesn't know who I am. How do I do guest checkout? How do I prove I'm a person? How do I, you know, so they can, you know, say, "Yeah, you can bid on the this pair of stocks for $50." And if I think if we're all paying attention to what's going on in personal agents, Muse and Instinct and Grockbot and um you know recently this announcement OD to Sierra and Decagon and friends around this personal agent protocol is like the fundamental problem we have is like how do you have an agent show up to a web website be able to interact with the website know that you actually can trust that agent. So like for a long time you've had captures on the web.

那么，为什么会这样呢？因为我们想防止垃圾信息，也想防止滥用。所以我们加入了验证码——只有真人才能解出来的东西。这样一来，验证码就能拦住垃圾信息，他们就没法刷屏了，对吧？但现在有了智能体，它们已经破解了验证码。嗯，不过这一直是网络上的一个老问题。事实上，回想两三年前，Vercel——我想大家都知道 Vercel——在西班牙遭到了封锁。那么，为什么 Vercel 会在西班牙被封锁呢？因为 Vercel 上所有托管站点都共用同一组 IP 地址。而 Vercel 托管的其中一个站点在播放英超联赛内容。于是西班牙方面决定：为了阻止这些英超内容在西班牙被非法播放，我们要把整个 Vercel 都封掉，对吧？Well why is because we want to prevent spam. We want to prevent abuse. So we added captures and then like that's something only a human could solve. So if we have a capture that stops spam. So they can't spam the thing, right? And now we have agents and they've broken captas. Um, but this has like been a traditional problem on the web. In fact, if you think back two to three years, Verscell, which is I think we're all aware of Verscell, was blocked in Spain. Well, why was Versel blocked in Spain? Because Versell shared the same IP addresses for every single host on Versel. And there was one, one host on Versell, one website in Verscell that they were hosting that was hosting like Premier League content. And Spain decided, hey, in order us to stop for that premier content being displayed illegally inside Spain, we're going to block all of Forcel, right?

所以，就像 Vercel 面临这个问题一样，agents 也有同样的问题，而且严重得多。那么，怎样才能让从未见过、未经注册的流量来到你的门口，然后决定是否放它进来？这才是我们首先必须解决的根本问题。Muse 和 Instinct 也面临同样的问题。他们想做的是：我们怎样才能建立一套大家都能共同遵循、协同运作的机制？作为下游资源，我可以根据用户的身份，决定允许哪些 agents、信任谁；另一方面，我也能知道该如何与这些人沟通。And so in the same way that like Verscell has the problem, agents have the same problem, but so much so much worse. So how do you have unregistered traffic you've never met before show up to your front door and then decide whether or not you let it in or not? And that's like the actual first and foremost funal problem we have to solve. It's the same issue with Muse and Instinct. And what they're trying to do is like how do we actually create agreeable rails we can all operate on. So as a downstream resource I can decide what what agents want to allow who I trust based on who users they are and then on the other side I can also know how to talk to those people.

开放协议与封闭生态Open protocols vs. walled gardens

主持人：有道理。Dick，AOP 如何帮助开启代理式商业的未来？ 嗯，关键的一点是，很多人一直在构建某种专有的封闭系统，对吧？你知道，我很支持个人代理协议 Poppy 这个概念，但它还不够深入，对吧？它只是说，好吧，现在我们有了一点代理身份，只是用了其中一些构建模块。这种方法很有吸引力，因为你只要照着做就行了，但它并没有解决代理式世界所需要的许多新问题。 因此，人们推动制定标准的一个关键动机是，你可以接入来自不同地方的组件，对吧？我坚信，我们应该能够控制自己的代理要做什么。总有一天，代理会承担大量工作，我们不可能让人类参与其中、逐项审批，对吧？这根本行不通。我们已经看到，这种方式无法扩展。这意味着我们需要一个监管代理——由我们掌控的监管代理，它负责执行我们的策略并决定我们该如何行事，而且它应该独立于那些承担所有工作的代理。Host: Makes sense. Dick how is AOP helping unlock the future of aentic commerce. Uh well a key thing is a number of people have been building sort of proprietary closed box systems right you know so you know I'm a fan of the concept of the personal agent protocol Poppy um but it doesn't really go far enough right it just it's like okay well now we've got a bit of an agent identity we just use some of the building blocks and it's an attractive approach because you're just doing it but it doesn't solve many of the new things that you need for u an agent IC world and so a key motivator for people for having standards is that you can plug components from different places right so I'm a strong believer that we should have control over what our agents do at some point agents going to be so much doing so much work there's no way we can have human in the loop approving everything right that's just not we've already seen that that isn't going to scale so that means we need to have a supervising agent that is our supervising agent that runs our policy and decides how we do things that should be independent of the agents doing all the work.

而且，如果我们想让这些东西能够即插即用，就需要有一种协议把它们分开。否则，你知道，关于智能体能做什么、不能做什么的决定，以及护栏的设定，都是由智能体本身或智能体供应商来决定的，也就是由他们来决定你能做什么、不能做什么。我不太想把决定我能做什么的控制权交给他们，让我的所有决策都由他们来决定。或者，我希望能够把这种监督职能转移到另一个组件中；而要让各个部分能够即插即用，我们需要一种让它们能够互操作的协议。And if we want to be able to plug and play those things, we need to be able to have a protocol to separate those. Otherwise, you know, the decision about what the agent can and can't do, what the guard rails is decided by the agent, by the vendors of the agent around what you can and can't do. And I don't really want to go and give control to them to decide what I can do and that all my decisions are based in there. or I want to be able to pull that supervision into another component and in order to be able to plug and play pieces, we need to have a protocol that things interoperate.

嘉宾：我想补充一点。我觉得现在我们看到的是，我们都希望网络是联邦化的，对吧？这意味着网络上的网站或资源可以自行决定允许做什么，但事物运行所依据的标准应该是联邦化的，这样我们才能互操作。我觉得我们正处在一个这样的时刻：现在有几个大型参与者，整个行业面临的问题是，我们要不要选用那些实际上会把我们绑定到大型参与者身上的东西，还给他们筑起坚实的壁垒？还是要继续做我们一直以来做的事，也就是构建联邦协议，比如 OIDC、TLS 之类的？这些协议发挥了作用，让开放的网络得以发展，让大量商业活动得以开展，让信息得以广泛流通，也让我们所有人都能以一种允许我们发挥创造力的方式拥有工作。Guest: I I just add to that. I think like right now what we're seeing is like we kind of like we all want the web to be federated, right? That does that that means like re like websites or resources on the web can decide what they're allowed to do, but the the standards upon which things operate should be federated enable us all to interoperate. And I think we're at a moment where things like, you know, we're at a moment where there's a couple large players and the question for the industry is, are we going to settle on things that actually buy us to the large players and give them like concrete block doors? Are we going to move to do the thing we've always done, which is build federated protocols, things like OIDC, things like, you know, TLS? Those things operated, enabled like a broad web, enabled a lot of commerce to occur, enable a lot of information to flow, enabled all of us to have jobs in a way that because we could be inventive.

所以，我实际上向整个行业提出的问题是：好吧，这些东西就要来了。不管怎样，我们希望世界变成哪一种样子？And so the question I actually asked the broad industry is okay this stuff's coming. Which version of the world do we want one way or the other?

主持人：是的。不过我觉得有意思的是，假设一切都进展顺利，我们有智能体在买东西，大家也都挺满意。我认为最终会发生的是，我们会开始意识到，还有一个方面需要着手处理，那就是人本身。所以我觉得，当你开始让意图参与进来时，会产生一种所谓的心理所有权。也就是说，现在我这个人和智能体的结果之间有了联系。如果你只是把它断开，或者通过某种声明把它连接到一个 OAuth scope 之类的东西上，然后就让它像变魔术一样运行，那你其实并不清楚发生了什么。所以我觉得，有了意图，人类在事情出错时会更容易承担责任。Host: Yeah. I add though I think um it's interesting that let's say this all goes perfect and we've got you know agents buying stuff and everybody's kind of happy. What I think will end up happening is we'll start realizing that we have another piece that we have to start working on which is the human itself. And so one of the things I think when you start having intents being involved is you get what's called psychological ownership. Meaning I actually now have a linkage between the human and the outcome of that agent. when you're just kind of, you know, disconnecting it or you you connect it up an ooth scope or something like that in a claim and let it's kind of magic and then you don't really know what's going on. And so I think it'll with intention it'll be easier for a human to take accountability when things do go wrong.

我认为，当你谈到เงินจริง转账或类似的事情时，最终还是要由人来承担责任。我想很多人可能都看过 1979 年的 IBM 手册。它说，呃，你知道，所以我觉得那张照片表达的观点非常正确：我们不能让机器承担责任，对吧？我们必须让人类与之关联起来，而我认为，意图就是这种关联。And I think when you're talking about real money being transferred or things like that, you want to have that human ultimately accountable. I think many people have probably seen the uh 1979 IBM manual. It says uh you know and so like that that photo I think is very true in that we can't have the machines be accountable right we're going to have to have the humans link to it and intention I think is that link

嘉宾：是的，然后，嗯，意图的另一个说法是动机，就像我们昨晚聊到的那样。能够追究某个人或某个智能体的责任，我觉得非常重要；而意图也能帮助做到这一点，让我们理解为什么出了问题——是用户心怀恶意，还是智能体心怀恶意。嗯，然后根据这种意图作出回应。你们各位是怎么看待意图带来的这种好处的？它又如何帮助我们应对可能心怀恶意的用户或智能体？Guest: yes and then yeah another word for intent is motive like we're were talking about last night um and that ability to hold someone accountable whether it's a person or an agent I think is really important and I think intent can also help with that be able to understand why did this go wrong was it the user's um you know the user was maligned the agent was maligned. Um, and then using that intent to be able to respond. Um, for each of you, how are you seeing intent provide that benefit and the ability to respond to potentially a maligned user or agent?

主持人：呃，我觉得这又回到了我之前提到的诊断问题，对吧？所以，如果你把“意图”这个词换成“动机”，那你就会把“诊断”换成“取证”，对吧？我想，任何做过调试，或者不得不对失控的 AI 智能体进行取证的人都知道，试图弄清楚它当时想做什么，以及用户的意图是什么，是非常困难的，对吧？所以，如果这些信息能够在整个系统中传递并保持不可篡改，就能带来一些特性，让你更快地缩小调查范围，对吧？随着这些东西变得更加互操作，我认为我们会开始看到企业能够更快地评估和识别：这是人为错误，还是智能体软件错误，究竟是什么错误，并据此妥善处理其影响范围。Host: Uh, I think it's going back to what I mentioned before about diagnosing, right? So, the if if you change the word intent to motive, then you change diagnostics to forensics, right? And I think um anybody who's done debugging or had to do forensics of an AI agent gone rogue will know that like trying to figure out what it was trying to do versus what the intention of the user was uh is very hard right um so having some of that information being propagated and immutable through the system etc gives you some properties that allow you to more shortcircuit your investigation right um and as those things become more interoperable I think we're going to start seeing companies be able to more quickly kind of scope and identify well was this human error was this an agent software error is this what was that error and handle that blast radius appropriately.

嗯，在金融系统中，我们会看到交易过程中出现各种情况，比如“我付了这笔款，但金额不对”之类的。对于如何处理这些情况，你们有明确的指导方针；而目前事情出错时，我们还没有多少这样的指导。所以我认为，随着我们继续推进，有意识地去做会帮助我们建立起这些机制。uh we see in the financial system right you have different things when you're doing a transaction around okay I made this payment but it was you know incorrect dollar amount or whatnot you have clear guidelines on how to work with that we don't have a lot of those when things go wrong right now so I think intention will help us build those as we get go forward

嘉宾：我觉得，最近发生的一起事件在某种程度上凸显了一个方面：意图……你可能是出于好意，但仍然可能采取错误的……Guest: and I think one area where a recent incident kind of highlights uh where intent um you can have like good intent but still take potentially the wrong

那个被 Resy 封禁的智能体The agent that got banned from Resy

事情就是最近发生的 Resi 事件：一个 Instinct 代理代表用户访问 resi.com，试图预订餐厅。嗯，这个代理非常积极，每小时发出 200 次 API 调用，结果导致用户的 Resi 账户被封禁。嗯，Dick，如果代理像这样消耗过多下游资源，但本意是好的，AOTH 预算能如何提供帮助？action is the resi incident um that happened recently where an Instinct agent went out on behalf of a user and tried to book a restaurant reservation on resi.com. Um that agent was very eager. It made 200 API calls an hour and it ended up getting the user's resi account banned. Um Dick, how can AOTH budgets help in the case where an agent like that is using way too much of a downstream resource, but it still has good intent?

主持人：是的。这是另一个例子，说明在智能体时代，软件已经完全不一样了，对吧？过去，软件的行为都是预先设定好的，你知道，如果你调用了 200 次，那就是个 bug，你会把它修好。嗯，而现在呢，智能体会想：「那我就继续试，直到成功为止。」嗯，所以我们在尝试与 AOTH 的人合作时，也看到了这一点，并意识到，没错，这里有个大问题：智能体学到某些东西后，就会滥用系统——但它们并不认为自己是在滥用，也不知道还有别的做法。没有任何信号告诉它们：「哦，我只能用这么多资源。」因此我们加入了预算的概念：你不仅要给智能体一个令牌，限制它执行某项操作的时长，还要给它设定可使用资源的额度。Host: Yeah. Well, this is another example about how just software is completely different now in the agentic world, right? When it was predetermined software, you know, that was a bug if you called 200 times and you would fix it. Um, where now, well, the agent's like, well, I'll just keep trying until I win. Um and so we saw that as we were you know experimenting working with people with AOTH and we realized yeah there's a big problem that agents will learn something and they'll just uh abuse the system from they don't think it's of abuse. They don't know any different. There's been no signal to tell them that oh I should only use this amount of stuff. And so we added the concept of budgets where not only do you give a token to the agent that's timelmited as to how long can they do a particular action but also a budget of how much resource they can do.

因此，只要令牌尚未过期，或者预算尚未用尽，它们就可以继续访问。这样一来，当它们再次回来时——你知道，如果预算已经用完了——你可以通过监督来决定是否要给这个智能体更多预算。相比之下，传统的速率限制只是直接切断访问，然后呢？你该怎么办，对吧？它也不知道自己为什么被切断，或者发生了什么。而预算机制会持续向智能体反馈已消耗的预算，让它了解自己还剩多少预算，因此它现在可以在预算范围内运行，就像人会想：「这种资源很稀缺，我得谨慎使用。」And so they have access until the the tokens either expired or they've exhausted the budget. And so that way when they come back and you know they've exhausted all the budget the supervision you can go and decide should I give more budget to this agent or not as opposed to traditional rate limiting which just cuts it off and then like then what do you do right and it doesn't know well why did I get cut off or anything like that where in budget there's continual feedback to the agent about how much budget was consumed has an idea about how much budget it has and so now it can operate within a budget right like a person would do about oh this resource is scarce I'm going to be careful about how much I use this

将大脑与双手分离Separating the brain from the hands

嘉宾：那么，“大脑与双手”的架构理念在这里如何发挥作用？比如，当预算快要用尽或已经用尽时，大脑和双手在访问权限上的分离，以及凭证与模型本身的智能体相互隔离，如何帮助我们阻止智能体过度消耗下游资源？因为资源快要用尽了，我们或许就不再给它另一个凭证，比如说。Guest: then how does the brains versus the hands architecture concept come into play here to allow us to okay when a maj budget is close to being fully reached or is reached um how can the brain and hand separation of of access and the credentials being separate from the agent in the model itself help us to be able to stop an agent from using too much of a downstream resource cuz it's getting close then Maybe we don't exercise uh the ability to give it another credential for example.

主持人：呃，抱歉，我没太听清，这里的回声太严重了。所以……Host: Uh sorry I didn't quite follow the echo in here is horrible. So

嘉宾：没关系，这适用于任何人。不过，基本上，随着行业逐渐趋向采用「大脑在手中」这种架构，我们会把凭证和访问权限与智能体本身分开。因此，智能体不会像现在这样拥有广泛的访问权限。也不会使用 API 密钥。我知道这是 AOTH 的一项优势：AOF 允许智能体在没有 API 密钥的情况下运行。那么，在 Resi 事件中，这有什么帮助？Guest: no worries that's for anyone but basically like so with the brains in the hands architecture that we're converging on in an industry. We're basically keeping the credentials and the access from an agent separate from the agent itself. So there's no broadstanding access that an agent has today. No API keys which I know is a benefit of AOTH that AOF allows agents to run without API keys. How is that helpful in the context of the resi incident

主持人：那……你获得它的访问权限之后呢？嗯，抱歉，我还是不明白。Host: the when you've got the access to it? Um sorry I still don't understand.

嘉宾：好的，我可以接着说。嗯，谢谢。Guest: Yeah I can jump in. Yeah thanks.

主持人：我懂了，我懂了，Dick。总体来说，回想起一件我一直记在心里的事，我想到的是 Pocket OS：我当时在一张光盘上发现了一把来路不明的密钥，对吧？显然，智能体有很强的目标驱动力。所以问题的核心是：好吧，如果我们给这些智能体一个大脑，也就是模型和 LLM，再给它们一双手——也就是把它们放进沙箱里，并在沙箱中提供工具——那么沙箱的基本理念就是：你可以控制里面有什么，这样它就无法实际获得 API 访问权限。然后，如果你在沙箱外面设置一个出站代理，那就能在那里划定授权边界。这样做不仅有助于在不同系统之间进行转换，对吧？Host: I got I got you dick. So like broadly speaking look I think if we look back at an incident that I just keep in the top of my mind is like pocket OS where I found like a random key on on a disc, right? Like obviously agents are deeply goal seeking. So the core of the the core of the the question is like okay well if we give these like agents the brain which is the model and the LLM and you have these hands which is you kind of give them put them in a sandbox and inside the sandbox the tools um like the funal idea of the sandbox here that that's all that is that okay there's you can control what's inside of it so it can't actually like get API access and then if you have an egress proxy outside the sandbox that's where you get to have your authorization boundary and so not only does it help do translation between systems right?

也就是说，authz 可以在这里存在、与外部世界通信，或者执行终止操作；同时，这也意味着你可以在出口代理边界上为智能体应用授权。因此我认为，核心在于这种模型——这是 Anthropic、OpenAI 和许多其他实验室如今正在采用的主流模型——它既能让我们拥有想要的能力：让这些东西进行实验、尝试各种做法，甚至做些傻事，这正是其核心价值；同时又能在外部设置一个确定性层，用来实现 OAuth 以及我们希望在协议中包含的所有其他组件。Which is like that's where athos can exist and talk to the outside world or do termination but also means that like the agent you have like a ability to apply authorization at the egress proxy boundary and so I think at the core of it that model which is the predominant model that entropic and openi and many other labs are pursuing today is is the model that allows us to both do both have the things we want which is how do we have these things experiment and try stuff out and do silly things which is the core value while also having a deterministic layer outside of it that can implement things like aoth and all the other components we want in our protocols.

嘉宾：我觉得这种解耦很有价值，对吧？回到刚才提到的取证，以及能够把各部分分开。不过我确实认为，在这方面我们还有很多需要学习的地方：它不只是一个大脑，对吧？而且，实际上很容易构建这样一种智能体循环：把大脑放在循环里面，而不是循环之外。对吧？举个例子，你知道，有些人在利用记忆系统。他们加入一些记忆和上下文，这些内容之后会被每个智能体使用，从而对智能体产生偏置，让它做出某种决定——在这个例子里，就是指挥双手去做一些不该做的事。所以我认为，我们在这里谈得还不够多的一件事就是有害组合，对吧？因此，当你把双手和大脑之类的部分分开时，实际上就可以调整哪些双手可用，对吧？我见过一个非常成功的例子，就是根据大脑本身及其正在做的事情，动态移除工具。也就是我们前面举的读取电子邮件的例子。Guest: I think the decoupling is valuable, right? Going back to mentioned with forensics and be able to separate things, but I do think that we still have a lot to learn on it isn't just one brain, right? And it's very easy actually to build your agent loop where you put the brain in the loop rather than outside the loop. Right? So, example of this would be, you know, people that are leveraging memory systems. um they put in some memory and some context that is now used going forward for every agent that is biasing that agent to make a decision to tell the hands in this case to go do something it shouldn't do and so one of the things that I think we don't talk about enough here is toxic combinations right um and so when you do separate the hands and the brain and whatnot you can actually change up you know what hands are available right so the example that you know I've seen be very successful is the removal of tools dynamically based on that actual brain and what it's doing so the earlier example we gave of reading an email.

呃，并没有什么规定说，如果它们要去写邮件，我就会禁用所有网络搜索工具调用，或者任何其他具有外部出口能力的工具调用，直到合适的邮件工具完成、任务也完成之后，我再重新启用它们，对吧？所以，呃，我觉得我们必须开始以越来越工程化的方式处理这些不同的概念。它们仍然很复杂，仍在发展，也还处于萌芽阶段，但我认为这比我们现在的做法划分得更清楚。Um there's nothing that says that oh if they're going to go write an email I'm going to disable all you know web search tool calls or any other external egress capability tool call ww wise until the right email tool has been complete and that you know mission has been done then I can reenable them right and so um I think that we have to we're going to start becoming more and more uh engineering in these different kind of concepts that um they are still complicated they're still growing and still nent but I think it's a better separation of what we have today.

没错，我们讨论的这些东西，乍看之下像是些极客式的 O 类问题，但实际上最终都会回归到真正的智能体工程问题。也就是说，如果你真正理解自己在做什么，就会知道，MCP 最大的几个槽点之一（现在没那么严重了）就是上下文膨胀，尤其是在上下文窗口还比较小的时候。不过，意图系统可以确保在合适的时机向智能体提供恰当的能力，这样它们就不会花大量时间做不该做的事，对吧？这实际上有助于它们朝着目标状态前进，也能让它们走上更有章法的路径。因此，意图不仅能解锁一系列安全能力，还能让我们减少 token 消耗，因为智能体会少做那些偏离正确路径的事；或者，它会在某个节点停下来，说：“嘿，我做不到。”Yeah, and this is how these things we're talking about which you know seemed like geeky O problems actually then merge back up to like real agent engineering problems which is if you actually understand what you're doing you know one of the biggest complaints less now but one of the biggest complaints with MCP was context bloat like especially when we had smaller context windows right but intent systems can ensure that the right capabilities are given to the agent at the right time so they don't spend a bunch of time doing things they shouldn't be doing right they actually helps them navigate towards the goal state and helps them put them on a more of a paved path so intent like not only unlocks like a bunch of security stuff. Intent also will result in us spending less tokens because the agent will spend time doing less things that aren't the right pathway or it'll come up to the point say, "Hey, I just can't do it."

因此，我们对这个时代的了解，很大一部分都在于如何引导智能体朝正确的方向行动，并确保它无法做错事，这样才能得到你想要的结果。And so what we know about this era is so much of it is about nudging the agent in the right direction and ensuring you can't do the wrong thing and that's how you get the outcome you want.

当前适用于生产环境智能体的方案What works for production agents today

主持人：Davis，你怎么看待意图式方法在面向生产环境的智能体整体策略中所扮演的角色？我知道，在生产环境中构建、部署和运行智能体时，团队需要考虑许多不同的目标，比如了解当前有哪些东西在运行、智能体具备哪些能力、如何验证输入和输出、如何像我们刚才讨论的那样约束智能体，以及如何使用出口代理和不同的网络规则。嗯，这一切该如何融入其中？如今企业里有哪些做法行之有效，能真正让智能体在生产环境中落地？是的，我想我们终于开始把讨论从身份验证转向授权了，尤其是如何实现动态授权、如何验证授权，以及如何在恰当的时机让人类参与其中。Host: Davis, how are you seeing intentbased as part of a larger strategy for production agents? I know when it comes to building, deploying, and operating agents in production, there's many different outcomes teams should be thinking about such as discovering what's running, what agents capabilities are, the ability to validate inputs and outputs, constraining an agent like we talked about, and using the egress proxy and different networking rules. Um, how does all of this fit into play and what's working inside enterprises today to really be able to ship agents to production? Yeah, I I think we're finally it's helping move the kind of conversation from authentication to authorization and really like how do we do dynamic authorization? How do I validate that authorization? How do I have the human in the loop at the right time?

因为我赞同 Dick 之前说的，人类参与流程在很多方面都算是一种反模式，对吧？嗯，因为人会疲劳，等等。但在重要的时候，你需要有办法让他们参与进来。以前这些并不是工程层面的讨论，对吧？而现在，它们实际上已经成了工程讨论的一部分，工程师也参与到了授权流程中。他们不再只是说：“哦，我已经拿到访问权限了，可以开始了。”这实际上改变了我们构建威胁模型的方式，也改变了我们看待应用整体攻击面的方式。嗯，所以我认为，现在你们把这种授权模式看作另一套可以使用的工具，不仅能减少安全问题，还能切实降低代理的错误率，对吧？Because I agree with what Dick was saying earlier that the human in the loop is somewhat of an anti-attern in many ways, right? Um because they can get fatigue etc. But you need to have a way to bring them in when it's important. Those were not engineering discussions before, right? Now they're actually part of the engineering conversation where engineers are being involved in the authorization process. They're not just saying, "Oh, I've got my access. I'm good to go." So that actually changes the way we're seeing threat models done. It changes the way we're seeing the full attack surface of applications in general. Um and so I think you're now looking at this authorization model as a another kind of set of tools that you can use to reduce not just um security issues, but flatout error rates of your agent, right?

我的意思是，当智能体能做的事情更少时，它就能做出更好的决策，对吧？所以从根本上说，我们已经在现实案例中看到，智能体循环确实变得更好、更快、更强，因为你们真正花时间去了解他们想实现什么意图、想完成什么任务。最后一点是，它让大家走到了一起：现在有了不同的人，比如安全团队和应用团队，他们能够用同一种语言交流。很多时候，涉及身份时，大家说的完全是两种不同的语言，对吧？嗯，那时大家只会说：“别挡我的道。我要做什么才能拿到我的令牌，然后继续往下做？”现在他们发现，实际上可以把这些东西配合起来，利用这种能力来提高智能体实际执行结果的效率。Like I mean when you have less things the agent can do it makes better decisions right and so fundamentally we've seen you know real world cases where the agent loop is just better faster stronger because you've actually spent the time on knowing what is the intent they're trying to get what's the mission that they're trying to accomplish. And then last thing is it brings the people together in terms of we now have other different people, the security team, the application team. They're now able to have a conversation that they're using the same language. And a lot of times when it came to identity, it was a completely different language, right? Um and it was just like get out of my way. What do I have to go do to go ahead and get my, you know, token and I can go forward. Now they're seeing that you can actually pair these things and leverage that capability um to drive, you know, efficiency of your actual agents outcome.

安全软件工厂Secure software factories

嘉宾：这很有道理。Ian，你是如何将这些概念应用到软件工厂中的？我知道你们今天发布了一个关于安全软件工厂的参考架构。你们是如何将运行时授权限制智能体等概念应用到其中的？Guest: That makes sense. Ian, how are you applying these concepts to software factories? I know today you released a reference architecture on the secure software factory. How are you applying the concepts of runtime authorization constraining agents and all of that to that?

主持人：是的，我觉得我们刚刚在 agentbaseline.org 上发布了一套参考架构。嗯，我们谈到了工厂的三个不同层级：一种是由人驱动的，一种是由工作流驱动的，还有一种是由智能体驱动的——这基本上就是我们所有人都想实现的状态，也就是每时每刻都由智能体来驱动。运行时授权是更大生态系统中的核心组件。它实际上让工厂能够朝着某个方向运行，做正确的事，并获得正确资源的访问权限。它和你过去可能用过的那些东西，比如密钥管理器，很不一样，因为它做出的决策，与以往用于管理确定性软件的那些方案截然不同。Host: Yeah, I think like so there is a a reference architecture we just published on agentbaseline.org. Um we talked about three different levels of of factory. one being like a human-driven one, one being a workflow driven one, one being like this agentic driven one, which is like the thing we all basically want to get to, which is like it's it's driven by agents at all points in time. The runtime authorization is a core component of a larger ecosystem. It actually enables the the factory to like be able to be pointed in a direction and do the right thing and also get access to the right piece. And it's very it looks different than previous things that you would have used like a secret manager because it's making very different decisions than previous generations head for managing deterministic software.

但这是让整个体系能够运转起来的核心组成部分，比如什么时候让某人介入、智能体可以把哪些工作交给其他哪些智能体。你知道，怎样才能让一个能够访问生产系统的智能体自动打补丁？嗯，这些都是关于我们究竟如何大规模解决软件问题的根本性问题。现在，我们所处的境况是：我们生成软件的能力从未如此强大，呃，但我们实际上始终受制于一个瓶颈——如何将软件部署到生产环境、确保它正常运行。接下来的阶段就是：如何真正从仅仅使用 LM 生成文本和软件，进阶到让它能够将软件部署到生产环境、持续迭代并快速使其达到稳定状态，然后在问题出现时及时响应。But it is a core component of enabling the entire thing to work like when to bring someone into the loop when what agents can pass what work off to what other agents. You know how can we have an agent that can have access to production systems and do an auto patch. Um these are fundamental questions of like how do we actually solve at scale software. Right now we're in a position where like we've never been able to generate more software. uh but we never actually but we have a complete bottleneck in getting into production ensuring it works and that's the the next phase is like how do you actually graduate from just using LM to generate text and software to actually making it capable of deploying it into production iterating on it and getting it to a stable state quickly and then responding to instances they arise

嘉宾：戴维斯，在你和我一起做的一期播客中，我们谈到了网络安全如何……Guest: Davis on a podcast you did with me we talked about how cyber security has

机器人领域的经验教训Lessons from robotics

有些东西可以从机器人学中借鉴。嗯，在机器人学中有这么一个概念：比如机器人抬起手臂时，会想：“抬起手臂对我来说安全吗？我应该这么做吗？我获准这么做吗？”但它也会观察外部环境，并问：“发生了什么变化？现在抬起手臂对我来说还安全吗？”嗯，当我们思考运行时授权时，除了意图之外，这些决策还需要考虑哪些因素？something to learn from robotics um in robotics there's this concept when maybe a robot raises its arm arm. It thinks is it safe for me to raise my arm? Should I am I allowed to do that? But it also looks at its external environment and says, "What has changed? Is it is it still safe for me to raise my arm?" Um, when we think about runtime authorizations, what do those decisions need to take into context beyond just intent?

主持人：是的，我觉得，嗯，有了这样的模型，我们就能在决策中纳入更多传感器。比如机器人手臂向上或向下移动时，嗯，可能有哪些外部因素呢？它附近有没有其他物体，对吧？温度呢？或者我是否正在移动——如果机器人其他部分正在移动，我就不想移动手臂，等等。因此，通常需要考虑各种不同的因素；它们都不是确定性的，而是具有概率性的，所以会有一系列选项，然后根据所有这些传感器数据，在同一时刻选出最佳选项。如今，组织中的大多数授权决策都是单一的二元决策，对吧？但未来这样行不通，对吧？因此，我们需要将用户的意图与用户所处的生态系统结合起来。Host: Yeah, I think um having a model like this allows us to add in more sensors into our decision. So the robotics example of you know an arm moving up or down um any of the external factors it could be are there other objects near it right um it could be temperature it could be well am I moving and I'm don't want to move my arm while my you know the the rest of the robot's moving etc so it's usually looking at all different types of things none of those are deterministic they're all probabilistic so there's a range of options and it picks the best option based on all of those sensor data at one time most authorization decisions in organizations today are single binary decision, right? And that just doesn't work in the future, right? So, being able to pair the intent of what a user is trying to do with the ecosystem that the user is doing it in.

这可能是他们进行操作的地点、时间段，但也可能涉及更高级的因素。比如说，当服务器存在高风险漏洞，而且管理员的系统也尚未打上相应补丁时，我是否应该允许这位管理员现在使用 Firefox 访问这台服务器？对吧？这样一来，你就能把更多上下文信息引入周边环境中。再说一次，这些信息可以来自不同的团队，但更重要的是，它们可以来自传感器。我想大家多少都已经看到了可观测性的价值。想象一下，如果能从 OpenTelemetry 的角度，在 span 级别获得这类上下文信息，会是什么样？比如你正在查看一条 trace，其中有一个 span，而你不仅能知道当时应用之外的环境是什么样，还能知道用户当时的意图。That could be where they're doing it from, time of day, but it could be even more advanced things like, for example, should I let, you know, this administrator use Firefox to access this server right now when this server has, you know, high-risisk vulnerabilities and their system hasn't been patched to. Right? Now all of a sudden you're bringing in a lot more context into the environment around it and again um that can be through different teams but more importantly through sensors and I think we've all kind of seen the value of observability in general. Imagine being able to have this type of context at the span level from an Otel perspective or something right you're looking at a trace you've got a span and you actually know what the environment was outside your application at that time as well as what the user's intention was.

嗯，这能让你以完全不同的方式诊断问题。我认为，如果我们能引入其中一些概念，就能缩短时间，缩短……缩短存活时间（TTL）。你知道，这样做出的授权决策就会包含比单纯考虑用户意图更多的上下文，也会考虑周围环境的状态。Um that allows you to diagnose things in a completely different way. Um, and so I think if we can bring in some of those concepts, we'll get shorter time, shorter shorter to live, you know, um, authorization decisions that have much more context than even just a user's intent. It'll be the state of the environment around it.

嘉宾：这很有道理。而且，展望未来，在评估基于意图的授权是否在我们的环境中发挥作用时，一个很自然的关注点就是代理的操作日志。嗯，哪些操作被拒绝了，哪些被允许了。嗯，Ian，为什么拥有你的……很重要？Guest: That makes sense. And forward looking as we evaluate whether intentbased authorization is working in our environments, one natural place to look will be a log of the agents actions. Um, what was denied, what was allowed. Um, Ian, why is it important to have your

为什么审计日志位于代理之外Why the audit log lives outside the agent

自动日志与代理本身分开，也就是说不受它控制吗？auto log separate from the agent itself, meaning outside of its control?

主持人：是的，我觉得这也回到了一个问题：为什么执行控制点必须位于智能体的主要“手脚”和“大脑”之外，对吧？你不能信任这个东西。所以，在 Hugging Face 事件中，它有几个不同的组成部分。我的意思是，其中一个显然利用了 Squid 代理中一个我们此前不知道的漏洞，但更重要的是，你没有任何可观测性或监控机制来了解正在发生什么。因此，这个东西能够通过这个漏洞进入开放互联网，而没有任何地方记录智能体采取的各项操作，也没有人监控这些操作。所以，不管我们是对流向互联网的网络流量设置执行控制点，以防智能体篡改流量，还是在漏洞出现时设法解决它们，都是如此。Host: Yeah, I think this comes back to also just like why the enforcement point has to be outside the like primary like hands and brains of of an agent, right? You can't trust this thing. And so, in the hugging phase incident, it had a couple different components of it. I mean, one obviously abused a vulnerability we didn't know about in Squid in Squid proxy, but more importantly, you didn't have any observability or monitoring about what was going on. And so this thing was able to go in the open internet through this vulnerability and there was no like place at which recorded the different actions that this agent was taking and for them to monitor. And so independent of like whether we're applying like a you know enforcement point to network traffic that's pushing on the internet that it's outreach of the agent to tamper with or we're using you know solving vulnerabilities as they pop up.

你知道，Hugging Face 这个例子有点特别。嗯，我们仍然需要有记录，说明是谁让这个智能体做了什么事、目的是什么，以及这种情况现在是否依然如此。嗯，因为说到底，我们使用智能体时，面对的是一个责任问题。所以这就是为什么我其实不认为我们需要针对智能体制定更多监管规定。我们需要做的只是让现有的责任法律得到落实、得到处理：如果我让一个智能体执行某项操作，而这项操作造成了损害，谁该承担责任？对吧？是雇用它的人，可能是某个组织、某个人，或者是委托某个实体执行某项操作的人。这才是我们最终必须解决的问题。当然，你还得有能力回答这个问题：究竟是谁做的？这正是防篡改自动日志的作用所在。You know this this hugging face one is a little unique. Um we still need to actually have a record of like who told this agent to do what thing for what purpose and is that still true? Um because ultimately at the end of the day what we're doing with agents is we is is a liability question. And so this is why I actually don't think we need more regulation around agents. What we just need is our pre-existing laws around liability to be held to be dealt with which is if I employ an agent do some action who is liable if that action causes damage right it is the person who employs it which could be an organization or a person or someone that delegated some action to something that is like that's the final question we have to deal with and then of course you have to ability to answer that question which is well who did it which is where the tamper resistant autolog comes from

嘉宾：太好了，最后我想问大家一个有趣的问题。所以有一个……Guest: perfect and then to wrap up I wanted to ask you all a fun question. So there's a

P(doom) 是真实存在的吗？Is P(doom) real?

末日概率（pdoom）这个概念，也就是 AI 末日论者所说的：AI 智能体会引发各种混乱，甚至毁灭人类；而 AI 乐观派则认为，不，AI 实际上有望帮助我们，并非真正的威胁。对于在座的各位来说，你们怎么看？基于意图的运行时授权，以及我们谈到的其他做法，比如限制智能体、验证输入和输出，制定一套面向生产环境中智能体的整体策略，这些是否足以拯救我们？Poom 真的存在吗，还是说不值得如此炒作？concept of the probability of doom or pdoom where the uh AI doomers are saying that AI agents are going to um release all sorts of havoc or be like the ruin to humanity whereas the AI optimists are like no this is really you know poised to help us it's not a genuine threat. Um for each of you on the panel, what is your take on this? Is you know runtime authorization based on intent and the other things we talk about like constraining agents, validating inputs, outputs, a holistic strategy for production agents. Is that enough to save us? Is Poom real or is it not worth the hype?

主持人：你可以从那里开始。Host: You get to start there.

客人：哦，我确实这么做了。Guest: Oh, I did.

主持人：你脸上露出了有点火辣辣的表情。嗯，你的问题有一部分是在问，智能体会不会接管一切？我觉得，智能体完全自主、又不真正隶属于某个特定组织，这目前仍然是科幻，你知道吧，所以谁说得准呢？这算是一种可能。另一种情况是，在一个负责任的组织里，设置好恰当的管控措施。智能体并不是……你知道，我们正在不断完善工具，确保在负责任的组织中设置好恰当的管控措施，以免出问题。这样一来，可能出现问题的情形就有两种。其中一种是，某个组织管理不善，内部人员可能会释放一个智能体，造成混乱，对吧？他们可能拥有其他人没有的特殊权限。Host: You got that spicy look on your face. Uh uh well part of your question is are agents going to take over? And uh I I think agents being fully autonomous and not really tied to a particular organization is still science fiction, you know, so who knows, right? Like that's a that's one direction. Another one is in a responsible organization put in the right controls, agents aren't, you know, we're getting in evolving enough of the tools to make sure that bad things don't happen in a responsible organizations to put in the right controls. And so that leaves two scenarios for where there's going to be a potential problem. One of those is in an organization that isn't got its act together, an insider threat could go and unleash an agent to cause havoc, right? And so they've got some special access that other people have.

另一个让我更担心的是，你知道，相关情况已经出现过了。你要是看他们在 Black Hat 上的演讲，就会发现那其实是在发出战斗号召：我们原本不希望坏事发生，但坏事还是发生了。那么，那些希望坏事发生、又掌握这些工具的人会怎样？我认为这才是真正的威胁，可能会带来——我是说，这种情况会发生，也会酿成一些灾难。希望我们已经做好了足够的准备，不至于让灾难严重到无法挽回。但肯定会出现一些问题，其规模堪比巨大的自然灾害，而这些问题是由恶意行为者有意或无意造成的；归根结底，是有人没有负责任地使用这些超级强大的工具。The other one, the one that I'm more concerned about is, you know, it's been shown, you know, the hugging faces. And if you watch the the talk that they gave at Black Hat, right, that was really a call to arms around, you know, here's a situation where we didn't want a bad thing to happen and a bad thing did happen. What about people that want bad things to happen and have these tools and that I think is a threat that's the one that's potentially going to have I mean it's going to happen and there's going to be some catastrophes. Hopefully, we're prepared enough that those aren't horribly disastrous, but it's going to be, you know, some there's going to be some things that are like massive natural disaster like scale issues caused by malicious actors either kind of intentionally or kind of unintentionally, but it's where people aren't being responsible in their use of these super powerful tools.

嘉宾：是的，我没法给出一个具体的概率，对吧？但我可以说，我一直都对工程师的创造力参与解决问题感到惊讶和兴奋。我认为我们现在正处于这样一个阶段，比如智能体领域的一些新能力。真正的工程师们就在这里，不断针对问题进行迭代，对吧？我们开始看到巨大的进步。在我看来，一些即将具备的能力将改变我们的未来。因此，我完全相信工程师们会找到解决方案。Guest: Yeah, I can't give necessarily a specific probability, right? But what I uh can say is I think I've always been you know kind of uh surprised and excited when you know ingenuity of engineers gets involved in problem solving and I think where we're at the stage now like some of the new capabilities within agents etc. We have real engineers, folks that are here actually just iterating on the problem, right? We're starting to see just tremendous improvement in the, you know, in my mind, some of the capabilities that'll be available to change what our future can be. And so to me, I have no problem kind of believing the engineers are going to figure out a solution here.

主持人：我是说，也许我有个最惊世骇俗的看法。我是说，我不能说它等于零，但我会说它在渐近地趋近于零。呃，世界末日发生的概率。我觉得，大多数人的激励机制都是让事情继续下去。嗯，而且说到底，我们仍然有责任框架；你知道，我觉得一般来说人都是好人，所以我们不会专门以毁灭世界为目标。嗯，我还觉得，笼统地说，这些智能体——说到底，我有个挺惊世骇俗的看法，我常这么说：它们随时可以被拔掉电源。但我觉得这就是事实。说到底，你只要把它们拔掉就行了，它们是电脑，我们可以把它们关掉。嗯，总的来说，我不相信这场争论。我觉得它并不真实。Host: I mean, maybe I have the hottest take. I mean, like I can't say it's equal to zero, but I would say it's approaching asmtoically zero. Uh, is the probability the world is going to end. Uh, I think like the incentive structure for most people is to continue. Um and also at the end of the day like we still have liability frameworks and you know I think generally humans are good people so we don't set out to destroy the world specifically. Um I also think like broadly speaking like these agents at the end of I have this sort of hot take I say which is like they can just be unplugged but I think it's just true. It's like at the end of the day like they you can just they're computers we can unplug them. Um and at so broadly speaking I I don't believe in the debate. I I don't think it's real.

我觉得从它好的一面来看，我多少更认同戴维斯的立场：我们迭代得非常快，正在摸索这些东西在哪些地方行得通、哪些地方行不通。而当它们行不通时，就会造成损害。最终，这就像是社会的某种“抗体”，会说：“嘿，也许我们不该这么做。这可能不是件好事。”I think at the at the upside of it, I I kind of believe more more to what Davis's position is is we're iterating very quickly. We're figuring out where these things can work, where they don't. And when they don't work, they create damage. And that's what ultimately like sort of um the antibbody of society is that says, "Hey, maybe we shouldn't do this." Like this is probably a bad thing.

嘉宾：所以，我是这个小组里持悲观论调的人。Guest: So, I'm the doomer on the on the panel.

主持人：是啊。你知道，这对像 P 这样的人来说挺不幸的，比如 Pocket OS 的创始人丢失了很多数据；但这对我们其他人来说是件好事，因为我们都能一起吸取教训。呃，归根结底，这会让人们避免做那些不太合理的事情，我想这一点今后也会继续成立。Host: Yeah. It's unfortunate for, you know, people like the P, you know, the founder of Pocket OS who like lost a bunch of data like but it's great for the rest of us because we all learn together and uh at the end of the day like that results in people not doing things that don't make a lot of sense and I think that will continue to be true.

嘉宾：有道理。感谢各位今天在这个讨论会上分享专业见解并拨冗参与，也感谢观众朋友们的聆听。我们下次再见。谢谢。谢谢你，Marshall。Guest: Makes sense. Thank you each for your expertise and your time here on this panel today and thank you to the audience for listening and we'll catch you next time. Thank you. Thanks, Marshall.