Just-in-Time Access for AI Agents

**SPEAKER_1** (0:00)
From lashes for days with the Viral Liquid Lash Extensions Mascara to lift and color from their brilliant eye brightener, Thrive Cosmetics is the go-to for amplifying everyday looks. Plus, every product is 100% vegan, cruelty-free, and made with clean skin-loving ingredients that work with your skin. Amplify your everyday. Go to thrivecosmetics.com/shine26 for an exclusive offer of 20% off your first order. That's Thrive Cosmetics, causemetics.com/shine26.

**Ofir Stein** (0:30)
We took full AWS environment. We installed multiple OpenClaw agents that's going to manage this AWS environment as a company. We had the CEO, we had the support, the builder, and we took all of that. We put it together and we opened Discord channel, saying everyone that want to try to tweak them, just go ahead, try to tweak them, right? They know how to improve themselves, and this experiment was very interesting, because what we saw is that, is never mind how they protect themselves, and they really great in doing that, you can still tweak them. You just need to find the way, and it's a problem from security perspective.

**Darin Pope** (1:07)
This is DevOps Paradox, episode number 358, Just-in-Time Access for AI Agents.
Welcome to DevOps Paradox. This is a podcast about random stuff in which we, Darren and Victor, pretend we know what we're talking about. Most of the time, we mask our ignorance by putting the word DevOps everywhere we can and mix it with random buzzwords like Kubernetes, Serverless, CI-CD, Team Productivity, Islands of Happiness, and other fancy expressions that make us sound like we know what we're doing. Occasionally, we invite guests who do know something, but we do not do that often since they might make us look incompetent. The truth is out there and there is no way we are going to find it.
Yes, it's Darren reading this text and feeling embarrassed that Victor made me do it. Here are your hosts, Darren Pope and Victor Farsi. Victor, I'm going to lay out a story and tell me if it sounds familiar to you, if it's ever happened to you in your career. Are you ready?

**Viktor Farcic** (2:16)
Go for it.

**Darin Pope** (2:17)
All right. You've got something going on. The production's on fire.
You need access to a table that you've never touched before. You need some access. You file an access request.
You then make a phone call over to the desk, telling them that you filed an access request. You send a Slack saying that you left a message saying that you created an access request. And then you walk over telling them that you left a Slack, that you phone called to get an access request processed. Does that sound even familiar to you?

**Viktor Farcic** (2:51)
Fortunately for me, it sounds like a distant memory, meaning that I'm not working for a while in companies where you need to do all those things.

**Darin Pope** (3:03)
But wait, it gets better. So this whole process that you just went through took 25, 30 minutes, and of course, the incident's a week. But of course, the incident's resolved itself in the meantime.
Customers left during that time. Now imagine this happening every day of the week. What we want to do today is talk about what would it take to make that experience maybe not suck or suck way less without giving everybody the case of the kingdom. On today's show, we have Ofir Stein on from Apono. Ofir, how are you doing?

**Ofir Stein** (3:32)
Great, thank you for having me.

**Darin Pope** (3:34)
Does that story sound familiar to you?

**Ofir Stein** (3:36)
Oh, it is. Yeah, it's some story for me. And today in Apono is something we help companies with. But going back, it's actually something I noticed as being an engineer leader and feel that pain from the engineering side every day in my work.

**Darin Pope** (3:52)
It's amazing that that story I told actually happened to me multiple times at a company I worked at.
I can never get around that. And it's like, again, I get to the end and it's like, everything's already solved. Whereas if I wasn't the one doing it or somebody else could have done it, there's lots of different reasons why that can happen. But now that we're in a world, I'm going to go ahead and just jump into it. Now that we're in a world of humans and non-humans, AI, it seems like access controls and quick access when we need it is more important than ever. What do you think?

**Ofir Stein** (4:23)
I totally agree. And I think there is kind of like that kind of paradox, we can say, that take productivity and security risk and put access management in the middle, and you see organizations struggling to find the balance between those two.