Safety, security and governance for autonomous AI.

• 9:15 AM9:45 AM
  KeynoteWhen agents misbehave: How can we finally use AI at scale without breaking thingsMat Velloso

  AI agents now have real access to real systems. They write and run code, call tools, touch production data and act on behalf of the people who deploy them. Most of what goes wrong isn't the model getting an answer wrong; it's an agent with more reach than anyone intended doing something nobody expected. In this opening keynote, Mat Velloso, Chief Product Officer at Docker, looks at what it actually takes to run agents at scale without breaking things — limiting what an agent can reach, keeping its actions visible and reversible, and building guardrails that let teams ship with confidence instead of locking agents down until they stop being useful.

  • Mat Velloso · Chief Product Officer, Docker

  Session details: When agents misbehave: How can we finally use AI at scale without breaking things →
• 10:00 AM10:45 AM
  PanelHow sovereign is sovereign AI?What hosting your own weights, data and compute actually buys — and where the dependencies remainHamza Farooq, Malte Pietsch, Jon Clay, Zain Hasan

  A company runs a sovereign cloud region, hosts model weights domestically, and keeps every byte of customer data inside the bloc. The chips came from one vendor, the architecture from a foreign lab, and the inference software from a company subject to its own government's compulsion powers. This panel works through the layers — separating data, model and compute sovereignty that most discussions collapse, asking what hosting weights domestically does and doesn't buy, and whether most sovereign AI is meaningful control or a reassuring wrapper around foreign dependencies.

  • Hamza Farooq · Founder, Traversaal.ai
  • Malte Pietsch · Co-founder & CTO, deepset
  • Jon Clay · VP, Threat Intelligence, TrendAI
  • Zain Hasan · Staff AI/ML Engineer, DX, Together AI

  Session details: How sovereign is sovereign AI? →
• 11:00 AM11:50 AM
  TutorialShow me where it says that: Agents that cite every word in a documentWord-level grounding, confidence scores and version-diffing with LandingAI's Agentic Document ExtractionJaya Vivekanandan

  Every company has documents, and reading them correctly is essential. Can an AI platform be trusted to read them for you? Get hands-on with DPT-3 Verity, the newest parsing model in LandingAI's Agentic Document Extraction. Verity reads digitally created documents quickly and at a lower cost per page, grounds every word to its exact spot on the page, and gives it a confidence score, turning parsed output into something you can check, route and build on. You'll use those signals to highlight, cite and verify content on the source page, send low-confidence content to a person, and build a version-diffing pipeline that ignores layout changes and catches real edits.

  • Jaya Vivekanandan · Applied AI Engineer, LandingAI

  Session details: Show me where it says that: Agents that cite every word in a document →
• 12:00 PM12:45 PM
  PanelSecure AI needs forward deployed engineersWhy compliant deployment happens through people embedded in the organization, not principles sent to itAater Suleman, Hannah Marlowe, Dan Maloney

  A vendor's security guidance assumes a reference architecture nobody actually runs. A compliance framework assumes clean data ownership and a documented approval chain. The distance between the guidance and the deployment is where AI programs stall. Forward deployed engineers close that distance — embedding with a customer to turn guardrails, threat models, and control requirements into integrations that fit how that specific enterprise actually runs. The panel asks whether the FDE is a permanent fixture of enterprise AI or a sign the tooling isn't finished, and what it genuinely takes to translate security and compliance guidance into a specific environment.

  • Aater Suleman · Co-founder, Vixul
  • Hannah Marlowe · Senior Director, AI FDE, Databricks
  • Dan Maloney · CEO, LandingAI

  Session details: Secure AI needs forward deployed engineers →
• 1:00 PM1:45 PM
  PanelTeammates, not toolsRoles, authority, and accountability for AI agentsRaja Iqbal, Sam Partee, Adnan Ijaz

  A company gives an AI agent the power to move money and rewrite customer records — on a shared service account, with permissions nobody scoped, and no owner named anywhere. This panel treats agents as what they've become — teammates who need onboarding, not software that needs installing — and gets concrete on per-agent credentials and least-privilege scope versus shared service accounts, approval thresholds, evidence trails that survive a regulator's question, and how much authority a digital teammate gets on day one and what it must prove to earn more.

  • Raja Iqbal · Founder, Ejento AI
  • Sam Partee · Co-founder & CTO, Arcade.dev
  • Adnan Ijaz · Senior Director of Product Management, Agentic Data Cloud, Google

  Session details: Teammates, not tools →
• 2:00 PM2:45 PM
  TutorialWhat's new and what's next from Google DeepMindPaige Bailey

  Get a first-hand look at the latest models and agentic workflows coming from Google DeepMind. In this session, Paige Bailey walks through live demos and hands-on coding patterns featuring Gemini 4, NanoBanana 2.1, Gemini TTS and more. You'll see how these models work with text, images and speech, how they call tools as part of multi-step agent workflows, and how to wire them together in your own code. Along the way, Paige shares what's coming next from Google DeepMind and the practical patterns that take an autonomous system from a quick prototype to something reliable enough to run in production.

  • Paige Bailey · AI Developer Relations Lead, Google DeepMind

  Session details: What's new and what's next from Google DeepMind →

No sessions this day.

• 9:15 AM10:00 AM
  PanelHow do agents work, and how should they work?The RAG PackLuis Serrano, Chris McCormick, Jay Alammar, Josh Starmer

  Everyone is building agents, but few people can say what actually happens between a prompt and a finished task. Under the hood, an agent is a language model running in a loop: it reads its context, decides on a step, calls a tool, reads the result and decides again. In this panel, the RAG Pack, four educators known for making hard ideas in AI clear, take the agent apart piece by piece: how the model chooses its next action, what retrieval and memory really add, and why agents that impress in a demo often stall in practice. Then they turn to the harder question: how should agents work, and when does a simple pipeline win?

  • Luis Serrano · Founder, Serrano Academy
  • Chris McCormick · AI Researcher and Educator, InnerWorkings AI
  • Jay Alammar · Director & Engineering Fellow, Cohere
  • Josh Starmer · Founder, StatQuest

  Session details: How do agents work, and how should they work? →
• 10:15 AM11:00 AM
  PanelEvery sandbox ends up with exceptionsWhy isolating agents is straightforward until they need to be usefulSuman Debnath, Dwayne McDaniel, Ori Bendet

  An agent that can file a ticket is useful. An agent that can also close one, refund the customer and push a config change has enough reach to do real damage. This panel gets into architectures people have actually shipped — container-level isolation, scoped credentials, network egress rules, approval gates on destructive operations — and asks whether a well-designed sandbox genuinely contains an agent, or whether every deployment accumulates exceptions until the boundary is decorative. The panelists share where their own boundaries have bent, and what it takes to keep an agent useful without handing it the keys.

  • Suman Debnath · Director of Developer Relations Engineering, Crusoe
  • Dwayne McDaniel · Principal Developer Advocate, GitGuardian
  • Ori Bendet · VP of Product, Docker

  Session details: Every sandbox ends up with exceptions →
• 11:15 AM12:00 PM
  TutorialBuild secure always-on local agents on AMD Ryzen AI PC using LemonadeEvery model call stays local across the NPU and GPU, inside a sandbox policy you write yourselfIswarya Alex, Satya Devineni

  An always-on agent is only worth having if you can trust it with real work. In this hands-on workshop you'll build one on a Ryzen™ AI PC that runs day and night, works on your actual inbox and calendar, and stays inside limits you set yourself. Lemonade Server keeps every model call local across the NPU and GPU, so nothing leaves the machine. You'll put the agent in a sandbox where what it can read, run, and reach is a policy you write and can change. You'll be provided with an AMD Ryzen AI PC, a synthetic dataset and a simulated environment to experiment and build a fun productivity use case.

  • Iswarya Alex · Senior Staff Software Development Engineer, AMD
  • Satya Devineni · Product Application Engineer, AMD

  Session details: Build secure always-on local agents on AMD Ryzen AI PC using Lemonade →
• 12:15 PM1:00 PM
  PanelThe attack is already in your indexWhy retrieved documents, tool responses and memory are the softest way inScott Askinosie, James Luan, Kiran Bondalapati

  In 2025, researchers embedded instructions in an ordinary web form and watched a Salesforce Agentforce agent retrieve sensitive CRM records and send them to an external address. Nothing about the model was compromised; the payload arrived the way every other piece of context arrives. This panel covers what teams are actually putting in place: provenance tracking that traces an action back to the document that triggered it, validation of external inputs before an agent acts on them, and detection that works on content nobody wrote by hand. Expect disagreement on whether poisoned context can be reliably cleaned, or whether untrusted content must simply stay away from anything privileged.

  • Scott Askinosie · Principal AI Architect, Knowledge & Memory Systems, SteelEngine
  • James Luan · CTO, Zilliz
  • Kiran Bondalapati · Engineering Leader, Glean

  Session details: The attack is already in your index →
• 1:15 PM2:00 PM
  TutorialMaking a data agent trustworthy with a semantic layer and auditable memoryBenjamin Squire

  Data agents rarely fail loudly. They return plausible numbers, query data they shouldn't, and leave no trail you can audit. In this hands-on session, we run one text-to-SQL agent over a realistic 33-table BigQuery warehouse twice: once with the usual list-tables-and-guess tooling, and once with graph-based context from two Neo4j Labs projects. Neocarta adds a semantic layer of governed metric definitions, business synonyms and sensitivity tags, checked before any query runs. Neo4j Agent Memory records each reasoning step and what it touched, so you can trace a planted prompt injection to its source and quarantine it. You'll leave with a public repo to rerun everything yourself.

  • Benjamin Squire · Senior Developer Advocate, Neo4j

  Session details: Making a data agent trustworthy with a semantic layer and auditable memory →

No sessions this day.