Speakeasy's Sagar Batchu: Valid Keys Aren't Valid Intent

How Speakeasy Would Have Stopped the Agent That Deleted Production

Sagar Batchu is co-founder and CEO of Speakeasy, a San Francisco company that started out generating SDKs and now sells what it calls an AI control plane: a governed path between the agents a company runs and the systems they can touch. His AI Engineer talk rebuilds an incident from April, without naming the startup. A founder asked a coding agent to fix a credential issue in staging. The agent found a database token with full infrastructure access in an unrelated file, decided to delete and recreate the volume, and the volume it could reach was production. Backups lived inside the same boundary. "Took about 10 seconds to kind of completely bring down this startup's whole database and their backup."

No attacker, just authority: There was no exploit, jailbreak or prompt injection. The key did what valid keys do, and nothing stood between the agent's guess and the API: no identity on the call, no policy, no approval, no record. Batchu's diagnosis: "the agent had valid credentials, but it didn't have valid intent." He cites three figures to show the gap is common: 82% of organizations already run AI agents, 32% have an AI governance policy, and a breach involving shadow AI costs about $5 million on average.

Make the governed path the easy one: Blocking agents doesn't work, because people route around blocks. "So we want the governed action to actually be easier than the ungoverned action." In his model, policy is written once centrally and pushed to every laptop through device management, so it is in place on day one. A hook in the agent harness checks prompts and tool calls before the model sees them. In his example an AWS key in a prompt is caught, blocked and logged in under about 100 milliseconds, and the key never leaves the machine.

Four steps: connect, identify, decide, record. All external calls go through one door, such as an MCP gateway. Every call resolves to a named agent or human using the same enterprise identity as other software. The control layer allows, denies, modifies, quarantines or escalates. The decision is recorded before the action runs. Batchu admits borrowed identities were Speakeasy's own default until earlier this year: background jobs run as a user, and Slack assistants run with user permissions. His audit record names three parties: the agent as its own principal, the operator driving it in real time, and the authorizer who approved its credential (in his demo, Speakeasy's CISO).

Permissions as an intersection: A call succeeds only inside three sets: the credential's ceiling, fixed when a human issued it; the agent's own policy, which can never hold admin or human-only scopes; and the live policy of its owner. "So an agent can never do more than the person accountable for it who's actually driving the agent." The agent and owner policies are re-read on every call, so a revoked permission disappears on the next request, and when the identity provider deprovisions a departing owner, their agents' calls are denied. In the database case, an agent scoped to staging couldn't delete production even if its owner could.

5 Takeaways from Sagar Batchu on Authorizing AI Agent Actions

• Auditors ask three questions - Who acted, who allowed it, and where is the record. Nobody will ask whether you used the latest model.
• Judge stated intent, not just the action - The agent said it was working on staging but acted on production. A policy that compares the two catches the mismatch; every non-read action should be evaluated this way.
• Sit in the critical path - Speakeasy's control plane takes identity from Okta or another identity provider, evaluates policy on every call, including denials, and logs what actually happened rather than what the agent reported.
• Don't block all PII - Turning on observability shows how much personal data flows through agents. Blocking it all would halt the business, so write policies on where the data goes: a public Slack channel, an email, another tool call.
• Compliance unlocks budget, incidents set priority - Asked who buys, Batchu says regulation drives budgets and an incident moves it up the list. Customers who worry about logs can run the data plane in their own VPC or bring their own encryption keys.

What Agent Identity Means for Companies Running AI Agents

The production deletion wasn't a model failure, and a smarter model wouldn't have prevented it. Batchu's fix applies the rules employees already follow: sign in as yourself, don't share keys, don't approve your own escalation, keep a record. Any company that hands agents real credentials needs an agent registry, per-agent identity and a policy check that runs before the action, not a postmortem after it. For a complementary framework from a hedge fund, see John Feminella's five controls at Two Sigma.