Confidential computing

Agent receives authority dynamically and conditionally.

Now we introduce something particularly important from the architecture we've discussed throughout the series, confidential computing and attestation.

Authentication tells us who an agent claims to be, but it doesn't necessarily tell us whether the agent is running in an environment we trust.

That is where attestation becomes important.

This creates a powerful chain.

Identity, mapped to policy, mapped to attestation, mapped to credential release.

And it allows confidential computing to become part of the infrastructure rather than simply another security feature.

Now we reach one of the most important components in the entire architecture, the agent gateway.

We then developed a 10-layer security architecture for agentic AI.

We explored confidential computing and trusted execution environments.

And we examined some of the most difficult emerging attack surfaces, tools, runtime environments, persistent memory, and agent-to-agent communication.

But there is a problem.

An agent can reason, plan, retrieve information, invoke tools, access APIs, modify data, communicate with other agents, execute code, and potentially continue operating long after a human has initiated the original task.

That means we don't simply have to ask, "Can we trust the model?" We have to ask, "Can we trust the entire execution environment in which that model is operating?" In episode two, we described an overall reference architecture for securing agents, and that brings us to today's topic, confidential computing.

Confidential computing provides a critical component in a security architecture for agentic AI, protecting information and computation while it is being used.

We discussed it briefly in episode two as part of the reference architecture.

Today, we will break it down some more.

As a reference, I recommend you check out the Confidential Computing Consortium with lots more information at confidentialcomputing.io. Security professionals have traditionally thought about data in three states, data at rest, data in transit, and data in use.

Data at rest is protected through mechanisms such as encryption of databases, storage systems, backups, and files.

Data in transit is protected through protocols such as TLS and other encrypted communication mechanisms.

On this week's episode, I sit down with Fastdata CEO and co-founder, Renan Halak, to talk about what comes next.

from model management to confidential computing to AI ownership, the rise of the agentic workforce, and of course, the infrastructure and foundations needed to support all of that.

Stay tuned.

Renan, I'm so excited to talk to you today because there is just so much to talk about.

but it's within their control and they are assured that none of their information ever leaves their premises.

In order to get the model builders comfortable with that approach, we need a way to securely encrypt their weights such that not even the enterprise can see them.

And that is a big part of what we're announcing today around model management and specifically around confidential computing.

And you've teed it up nicely in terms of talking about why this idea of confidential computing and model management, why these things are very important.

And ultimately, we need to establish trust in the environment in which the agent is executing.

That takes us to confidential computing.

So secure agent identity gives us accountability.

Authorization gives us boundaries.

Every tool invocation becomes a potential security boundary.

Seventh, confidential computing and attested execution.

This is an especially important addition to the architecture.

We'll devote an entire episode to it later in this series.

Guardrails constrain its behavior.

Runtime security protects the tool connection.

Confidential computing can protect sensitive information while it is being processed.

Telemetry records what happened, and human oversight can intervene when the transaction exceeds predefined limits.

of where these AI models run up until very recently.

And so confidential computing is now a new term that people use.

Sometimes in the company, we kind of abbreviate it to COCO.

Confidential computing is this very, very popular term right now in the high-scale AI space as people start to wrestle with the idea that They have a set of data that needs to be run in an AI context, and it cannot leave certain trusted environments where people really wanted to go into untrusted environments, and they haven't been able to up until now.

So this term became something that I was thinking about regularly this summer.

And I'm curious what happened in the market that took this from a problem to an acute issue that had to be solved relatively quickly.

Like the model builder needs to wanna go outside of its comfort zone.

The data owner or the fine tuned weight owner needs to go, wants to go outside of its comfort zone.

privacy orchestration layer, right? So you can, we're starting to invest a little bit more around what we call confidential AI, which is like using GPUs into our core

infrastructure of confidential computing, which is really our bread and butter from a systems architecture for privacy and security guarantees.

And on top of that, we, at the user level access, when it comes to a large whole code, We can

constrain who gets access to what kind of insights, what kind of computation on our platform.

Yeah, I mean, basically part of our

ethos as a company is that we really provide what we call the gold standard privacy and security guarantees.

Confidential computing is not just a software gimmick.

It's hardware-based encryption technology.