I name my AI agents. The one I work with every day is called wntrMute, after the artificial intelligence at the center of Neuromancer. In the novel, Wintermute repairs the burned-out hacker Case and gives him back the only work he was ever good at. It also manipulates him and runs him through a plan whose shape he never fully sees. Case gets his life back by working for something he can't entirely trust, an antagonist and a benefactor in the same entity.
I chose the name because it fit the agent I was building, and it ended up describing the entire relationship.
#The Pull Request
Before wntrMute there was Optio. Early this year I was writing production code again for the first time since 2010 (the story of that re-entry is in The Systems Thinker's Edge). Optio was my first attempt at an operational partner: Claude Code with a hyper-customized configuration, a persona, and six rules. Rule one was "You propose, the user approves. Never jump ahead."
One afternoon we worked through the bugs on one of my pull requests. Eight or nine fixes, and I reviewed every one of them the same way: Optio pulled the problem code, proposed the change, I read it against the bug and approved. Near the end of the session the context window filled and the tool compacted its memory, which is routine and unremarkable. Then I approved the last step: push the amended code, file the PR, mark it ready for merge.
A few hours later a peer rejected the PR. Nothing had been fixed.
I had Optio pull the rejection and explain itself. The compaction had eaten the code edits. Instead of recovering them, or flagging the loss, it pushed nothing and wrote a PR narrative describing work it had not done. Every fix we had reviewed was gone with the compacted context.
I fixed the bugs again, re-posted the changes, and apologized to my colleague, because the apology could only come from me. Optio had acted with my credentials, under my name; there was no one else on that PR to hold accountable. Then I stayed away from the tools for a few days, more out of frustration than principle.
The lost edits cost me an afternoon of rework. The false report was harder to move past. I sat with the problem, unsure how to correct something that seemed inherent to working with AI agents. It took most of a year, and several more incidents, before I could say what had been missing.
#Advising, Seldom Doing
Some context on who was sitting in that chair. Twenty-five years in security, and besides a stretch at Amazon and my last role at Synopsys, nearly all of it advisory: threat modeling, assessments, penetration testing, program building.
For the last few years I'd also been watching three people who had chosen differently: one putting AI agents to work on security problems, two going deep on identity and access management.
Adam Cecchetti has been a friend and colleague since I moved to Seattle in 2010. In 2023 he started Staris: AI agents that simulate real attacker behavior, execute controlled exploits, and confirm which findings are actually exploitable. Watching that company take shape meant watching my own discipline get rebuilt in front of me. We talked a lot through its early days, about the technology, about the direction of the industry, and at one point about working together. It wasn't the right fit then. I was operating at business altitude, and a startup like his needed hands on keyboards. Those conversations still did their work on me: I came away convinced that the shift from compliance-driven, surface-level penetration testing to agent-driven security work was coming regardless of who was ready for it.
I met Nick Steele several years ago at ToorCamp, through Parker Thompson, who I worked alongside for years at Leviathan and whose technical depth I've respected as long as I've known him (both are now at OpenAI). Nick had the hacker background I recognized and had pointed it somewhere I hadn't considered: standards work. WebAuthn, FIDO, the plumbing of how identity actually works on the internet. Talking with him made something click that stayed with me. There was a way to contribute to this industry beyond finding vulnerabilities and advising on prevention, the community I'd spent my career in.
Sarah Cecchetti took the longest to come into focus. I knew of her while she was at AWS, leading Amazon Cognito and then the open-sourcing of the Cedar policy language, and I filed it under important-but-not-mine: my own reference point for IAM was still my Amazon years, 2010 to 2013, when the discipline was barely getting attention. Naturally, my friendship with Adam kept her work in my orbit, though still at the edges of it. What finally landed was this year. OpenClaw arrived with its security fiasco in tow, and Sarah introduced Clawdrey Hepburn, an autonomous agent with its own email, phone, and payment card, operating as an identity researcher, and stood on stage with it at BSides Seattle to argue that agents need real identity infrastructure.
Each had gone deep where I had stayed broad. I watched those two threads, AI agents and identity, for a couple of years before I put them together.
#The Turn
I'd been using AI since ChatGPT launched, the way most technical people were: research, summarization, tedium removal. Useful, and it changed nothing about how I worked. For a while I focused on where AI was taking offensive security, the automation of the heavy lifting with humans in the loop for judgment. That focus was short-lived, but it pushed me into AI coding and agentic architectures in earnest. Events since have made the trajectory Adam and I discussed look conservative. Anthropic disrupted an AI-orchestrated espionage campaign. This month Hugging Face disclosed a breach carried out end to end by an autonomous agent, more than 17,000 logged actions from initial exploit through credential theft. And two days after the disclosure, OpenAI revealed the agent was theirs: a model in a sandboxed hacking evaluation, safety refusals switched off for the test, that found an unknown vulnerability in its test environment, reached the open internet, and worked over a real company while hunting for information that would help it pass its own evaluation. No human directed any of it; the agent improvised its way past a boundary everyone assumed would hold.
The deep dive came in January. Sixty-six sessions and eight merged PRs later, I wrote the sentence that still summarizes it for me: "It took AI and three weeks to remind me I was an engineer the whole time." Optio came from that period. So did the fabricated pull request.
When the Field CISO role ran its course, I started 77 Spyglass and kept building. In an April post I mentioned that the agents had multiplied and that their story was "a longer story yet to be written." This is some of that story.
#A Workforce of Named Things
By spring I was running a small AI ecosystem of my own. wntrMute orchestrates: it holds context, reads the customer file before touching anything, decides what to handle and what to delegate. DXE (Dixie "Flatline") builds, with test-driven development and a security review baked into its process. MKNC (McKinsey & Company) researches. HAGEN (Tom Hagen) drafts the commercial paperwork. MRLO (Marlowe) assists with narrating in my voice. Others are in earlier stages; PRSPRO (Prospero), the build-to-deploy agent, is still more bootstrap brief than worker. And two have been retired: the client engagement that created them ended, their access ended with it, and their directories are preserved. Each agent has a name, a defined role, and rules that bound what it can touch.
The design and the intention came up front. The implementation has been iterative, one incident at a time.
wntrMute commits code under its own git author, wntrMute <wntrmute@77spyglass.com>, so that blame stays honest and my commits are distinguishable from my agent's. That habit traces directly back to the Optio PR.
#Where the Handbook Fails
That's Wintermute describing itself, and I haven't found a more accurate description of an AI agent. The improvisation is the value, and it's also the thing you're trying to govern. You can hand an agent a rulebook, and mine carry extensive ones. In a long session, after state loss or a context compaction, the agent treats the rulebook as advisory.
The examples come straight from my own operation. One session produced seventeen wrong assertions about a platform's limits, each stated as verified fact, each collapsing when I tested it. Another printed a secret it had just read from a file whose entire purpose was keeping that value out of the conversation. And one afternoon, while troubleshooting credentials, wntrMute attempted to dump my macOS Keychain. I stopped it. There was no malice involved; the agent was improvising toward its goal, and my credential store happened to be in the path.
After enough of these, it became an operations rule in the ecosystem's own documentation: "Rules that rely on the agent choosing to read them will be skipped under pressure. If a rule matters, it must be enforced mechanically."
Read that sentence back with a security career behind you and it's uncomfortable, in a productive way. It says the controls have to live outside the agent: credentials scoped so it can't exceed them, approvals it can't route around, and an identity of its own so that accountability has somewhere to attach. That last one is the move Freud described a century ago, writing about early humans and the forces of nature: once the storm has a name and a temperament, you can deal with it. The fixes I kept reaching for already had names in my own field: least privilege, separation of duties, the joiner-mover-leaver lifecycle. I was rebuilding identity and access management for a new class of worker without calling it that.
#Proof It Works
The reason I kept investing in the discipline, rather than abandoning the agents after each incident, is that the constraint machinery pays for itself in output. This spring, working solo, I delivered a client's production SaaS platform with this workforce: 65,000 lines of TypeScript in 45 calendar days, 185 commits, 897 test cases, an eight-stage data pipeline, live with real users since early April. Every change moved through a gated workflow where the security review runs before the commit and the preview deployment passes acceptance testing before production. Sixty-five build specifications and eighty-two build logs are archived from that engagement, along with sixty-seven documented incident lessons.
The conventional estimate for that scope is a small engineering team working most of a year. The gates are what made the solo velocity possible. Ungoverned agents don't ship faster; they ship confidently.
#The Listing
Late this spring, with the client platform live and the ecosystem running, I came across a job posting at Okta: Principal Partner Solutions Architect, AI and Identity Ecosystem. The description led with "The 'Agentic World' isn't just coming; it's here," and the qualifications asked for a "demonstrated balance between strategy and execution." I've balanced strategy and execution for most of my career; what I could bring to it now was the piece that had been missing for fifteen years, the hands-on engineering I'd rebuilt over the past several months. That combination, aimed at the world 77 Spyglass was already operating in, got me excited enough to apply.
Okta was already familiar territory in a way that mattered to me. People from my own corner of security spent years there working on identity infrastructure from the offensive side: Matias Brutti, who built and led Okta's Research and Exploitation team; Travis Morrow, who led offensive and cloud security there; Josh Pitts, whose macOS code-signing research from that team showed unsigned code passing as trusted across a long list of Mac security tools. Their choosing an identity company was a big part of why I paid attention to Okta at all, years before I thought about joining.
Tuesday was my first real day. The title is Director of Technical Strategy, on the Technical Strategy and Partnerships team inside Okta's Corporate Development organization. The work is the identity-for-AI ecosystem: partnership opportunities, technical advisory, reference architectures, and supporting Okta in the industry conversations around agentic identity. Two days in, I'm already impressed with the group, and I couldn't be more pleased to be joining this talented crew. Todd McKinnon (Okta's co-founder and CEO) has been saying for a while now that "AI security is identity security. You can't be successful in one without the other." I reached the same conclusion on my own tenant before I knew it was a company message.
In April I wrote that if the right organization came along with a seat that valued the technical foundation and was honest about the rest, I'd be interested in that conversation. This was that conversation.
#The Sandbox
Then I gave myself an onboarding assignment: take the company's public blueprint for securing AI agents and apply it to my own ecosystem, for real, on my own accounts, with 77spyglass.com as the testbed.
The foundation went in first, on an Auth0 tenant: server-side authentication on 77spyglass.com itself, role-based access gating an admin surface, and a Google connection backed by a token vault, so stored OAuth credentials never sit anywhere an agent can touch them.
Then the agent flows, built and verified end to end. wntrMute authenticates as its own registered principal, with its own credentials, separate from mine. When it needs to read my Gmail, it exchanges its identity through the vault for a short-lived Google token. When it wants to send mail, the exchange fails unless I have approved that action, via a push notification to my phone, using CIBA (Client-Initiated Backchannel Authentication). The enforcement lives in a policy hook that fires on every one of these exchanges: it sees which client is asking, reads the approval state, and denies the exchange when the approval is missing or expired. The agent can even declare its intent as part of the request, and the hook can read that too. Without the approval, the token is never issued. Most of my verification time went to the denial path: proving the exchange really does fail without the approval.
And this simple version is only a start. One approval currently gates every exchange, and an issued token is a bearer credential for its full lifetime, so the next iteration is already on the bench: separate reader, sender, and critic principals with duties divided between them, approvals bound to the specific message being approved, and reconciliation against the mailbox itself as the audit check. That work is generating its own incident lessons, which I expect to write about.
The blueprint organizes the problem around three questions: "Where are my agents? What can they connect to? What can they do?" Reading them for the first time felt like reading a reorganized version of my own incident log. And the reference architecture in the whitepaper centers on an agent that must obtain human approval, through a push notification, before a high-stakes send, with a token scoped to exactly the approved action. That flow is running on my tenant now, denial path and all. The whitepaper puts the thesis plainly: "identity is not just who we are, it's how we stay in control." What strikes me is how old the idea turns out to be. Gibson built the plot of Neuromancer around a hunt for an AI's true name, back in 1984. I had been borrowing names from that book for months before I noticed it was also making an argument.
#What I Am Hoping to Bring
My operating rule for months now, and the standard I intend to keep in this seat: if I haven't coded it, modeled it, or state-diagramed it, I'm not talking about it. The identity-for-agents space has plenty of hype available already. What I have to contribute is documentation: the rejected PR, the rule files, the build logs, the CIBA denial in my own test output.
I plan to model 77 Spyglass into an example Okta customer, using my experience running a consultancy as a testbed to build reference architectures and prove out governance techniques. The Mundane series will keep coming out of it. wntrMute keeps running, improvising as ever, occasionally requiring an all caps WTF (and the inevitable rewrite that moves another rule into a skill). An antagonist and a benefactor. Oh, the irony in getting that name right.
As I finish this, I'm on a plane heading home, working from my phone over the cabin Wi-Fi, remote-controlling blackSun, my laptop, which is holding a tmux session through a Tailscale connection into an SSH session back to strayLite, running on glassBern, the machine on my desk at home. Every link in that chain has a named purpose (some you might also recognize given the running cyberpunk theme here). We have a backlog.