Safety, security and governance for autonomous AI.

AI agents now have real access to real systems. They write and run code, call tools, touch production data and act on behalf of the people who deploy them. Most of what goes wrong isn't the model getting an answer wrong; it's an agent with more reach than anyone intended doing something nobody expected. In this opening keynote, Mat Velloso, Chief Product Officer at Docker, looks at what it actually takes to run agents at scale without breaking things — limiting what an agent can reach, keeping its actions visible and reversible, and building guardrails that let teams ship with confidence instead of locking agents down until they stop being useful.

Mat Velloso

Chief Product Officer · Docker

A company runs a sovereign cloud region, hosts model weights domestically, and keeps every byte of customer data inside the bloc. The chips came from one vendor, the architecture from a foreign lab, and the inference software from a company subject to its own government's compulsion powers. This panel works through the layers — separating data, model and compute sovereignty that most discussions collapse, asking what hosting weights domestically does and doesn't buy, and whether most sovereign AI is meaningful control or a reassuring wrapper around foreign dependencies.

Hamza Farooq

Founder · Traversaal.ai

Malte Pietsch

Co-founder & CTO · deepset

Jon Clay

VP, Threat Intelligence · TrendAI

Zain Hasan

Staff AI/ML Engineer, DX · Together AI

Every company has documents, and reading them correctly is essential. Can an AI platform be trusted to read them for you? Get hands-on with DPT-3 Verity, the newest parsing model in LandingAI's Agentic Document Extraction. Verity reads digitally created documents quickly and at a lower cost per page, grounds every word to its exact spot on the page, and gives it a confidence score, turning parsed output into something you can check, route and build on. You'll use those signals to highlight, cite and verify content on the source page, send low-confidence content to a person, and build a version-diffing pipeline that ignores layout changes and catches real edits.

Jaya Vivekanandan

Applied AI Engineer · LandingAI

A vendor's security guidance assumes a reference architecture nobody actually runs. A compliance framework assumes clean data ownership and a documented approval chain. The distance between the guidance and the deployment is where AI programs stall. Forward deployed engineers close that distance — embedding with a customer to turn guardrails, threat models, and control requirements into integrations that fit how that specific enterprise actually runs. The panel asks whether the FDE is a permanent fixture of enterprise AI or a sign the tooling isn't finished, and what it genuinely takes to translate security and compliance guidance into a specific environment.

Aater Suleman

Co-founder · Vixul

Hannah Marlowe

Senior Director, AI FDE · Databricks

Dan Maloney

CEO · LandingAI

A company gives an AI agent the power to move money and rewrite customer records — on a shared service account, with permissions nobody scoped, and no owner named anywhere. This panel treats agents as what they've become — teammates who need onboarding, not software that needs installing — and gets concrete on per-agent credentials and least-privilege scope versus shared service accounts, approval thresholds, evidence trails that survive a regulator's question, and how much authority a digital teammate gets on day one and what it must prove to earn more.

Raja Iqbal

Founder · Ejento AI

Sam Partee

Co-founder & CTO · Arcade.dev

Adnan Ijaz

Senior Director of Product Management, Agentic Data Cloud · Google

Get a first-hand look at the latest models and agentic workflows coming from Google DeepMind. In this session, Paige Bailey walks through live demos and hands-on coding patterns featuring Gemini 4, NanoBanana 2.1, Gemini TTS and more. You'll see how these models work with text, images and speech, how they call tools as part of multi-step agent workflows, and how to wire them together in your own code. Along the way, Paige shares what's coming next from Google DeepMind and the practical patterns that take an autonomous system from a quick prototype to something reliable enough to run in production.

Paige Bailey

AI Developer Relations Lead · Google DeepMind

Everyone is building agents, but few people can say what actually happens between a prompt and a finished task. Under the hood, an agent is a language model running in a loop: it reads its context, decides on a step, calls a tool, reads the result and decides again. In this panel, the RAG Pack, four educators known for making hard ideas in AI clear, take the agent apart piece by piece: how the model chooses its next action, what retrieval and memory really add, and why agents that impress in a demo often stall in practice. Then they turn to the harder question: how should agents work, and when does a simple pipeline win?

Luis Serrano

Founder · Serrano Academy

Chris McCormick

AI Researcher and Educator · InnerWorkings AI

Jay Alammar

Director & Engineering Fellow · Cohere

Josh Starmer

Founder · StatQuest

An agent that can file a ticket is useful. An agent that can also close one, refund the customer and push a config change has enough reach to do real damage. This panel gets into architectures people have actually shipped — container-level isolation, scoped credentials, network egress rules, approval gates on destructive operations — and asks whether a well-designed sandbox genuinely contains an agent, or whether every deployment accumulates exceptions until the boundary is decorative. The panelists share where their own boundaries have bent, and what it takes to keep an agent useful without handing it the keys.

Suman Debnath

Director of Developer Relations Engineering · Crusoe

Dwayne McDaniel

Principal Developer Advocate · GitGuardian

Ori Bendet

VP of Product · Docker

An always-on agent is only worth having if you can trust it with real work. In this hands-on workshop you'll build one on a Ryzen™ AI PC that runs day and night, works on your actual inbox and calendar, and stays inside limits you set yourself. Lemonade Server keeps every model call local across the NPU and GPU, so nothing leaves the machine. You'll put the agent in a sandbox where what it can read, run, and reach is a policy you write and can change. You'll be provided with an AMD Ryzen AI PC, a synthetic dataset and a simulated environment to experiment and build a fun productivity use case.

Iswarya Alex

Senior Staff Software Development Engineer · AMD

Satya Devineni

Product Application Engineer · AMD

In 2025, researchers embedded instructions in an ordinary web form and watched a Salesforce Agentforce agent retrieve sensitive CRM records and send them to an external address. Nothing about the model was compromised; the payload arrived the way every other piece of context arrives. This panel covers what teams are actually putting in place: provenance tracking that traces an action back to the document that triggered it, validation of external inputs before an agent acts on them, and detection that works on content nobody wrote by hand. Expect disagreement on whether poisoned context can be reliably cleaned, or whether untrusted content must simply stay away from anything privileged.

Scott Askinosie

Principal AI Architect, Knowledge & Memory Systems · SteelEngine

James Luan

CTO · Zilliz

Kiran Bondalapati

Engineering Leader · Glean

Data agents rarely fail loudly. They return plausible numbers, query data they shouldn't, and leave no trail you can audit. In this hands-on session, we run one text-to-SQL agent over a realistic 33-table BigQuery warehouse twice: once with the usual list-tables-and-guess tooling, and once with graph-based context from two Neo4j Labs projects. Neocarta adds a semantic layer of governed metric definitions, business synonyms and sensitivity tags, checked before any query runs. Neo4j Agent Memory records each reasoning step and what it touched, so you can trace a planted prompt injection to its source and quarantine it. You'll leave with a public repo to rerun everything yourself.

Benjamin Squire

Senior Developer Advocate · Neo4j