What if an AI agent had to earn—and keep—its access based on how it behaved?

In this episode of ClearTech Loop, Jo Peterson sits down with Elliott Mattice, founder of Exprima, to examine trust as the missing operating layer between AI security and AI governance.

Traditional controls can define an agent’s identity and permissions. Governance frameworks can establish policies and accountability. Elliott argues that organizations still need something in the middle: continuous behavioral trust that can raise, lower or revoke an agent’s access based on what it actually does.

Jo and Elliott discuss why accountability must still land with a human, how organizations can balance useful autonomy against unrestrained risk and why an MCP server could function as an enforcement point—not merely a bridge to enterprise tools and data.

The agent does not need to feel guilty when it crosses a boundary. The systems around it need the authority to say no.

What We Cover

• Why policies and technical guardrails are not enough to operationalize AI governance
• How behavioral trust could be continuously measured and tied to access
• Why human accountability remains necessary when an agent takes an unauthorized action
• How MCP servers could evaluate identity, permissions and current trust before granting access
• Why autonomy is both the value of an AI agent and the source of its risk
• What an agent may need to do to rebuild trust after crossing a boundary

Featured Soundbite

“We can give AI enough room to be independent, to be autonomous, as long as we hold it accountable for its outputs.”
— Elliott Mattice

Guest

Elliott Mattice is the founder of Exprima, an advisory and consulting firm focused on cybersecurity compliance, federal procurement risk and decision realism. He has more than 25 years of experience across federal IT operations, cybersecurity, compliance and regulated environments.

Guest website: https://elliottmattice.work/

Host

Jo Peterson is the CIO of Clarify360 and Chief Analyst at ClearTech Research.

Full episode webpage: https://cleartechresearch.com/cleartech-loop-elliot-mattice-on-ai-governance-missing-trust-layer/

Subscribe to ClearTech Loop: https://www.linkedin.com/newsletters/7346174860760416256/

Watch on YouTube: https://www.youtube.com/@ClearTechResearch

Topics

AI governance, agentic AI, behavioral trust, AI agent accountability, MCP security, non-human identity, AI access control, defense in depth, AI risk management

Tags / Keywords

AI governance; agentic AI security; behavioral trust; AI agents; MCP servers; AI accountability; non-human identity; cybersecurity governance; autonomous agents; ClearTech Loop; Elliott Mattice; Jo Peterson

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

What happens when an AI agent takes an action no one authorized?

The answer is not, “The model did it.”

In this episode of ClearTech Loop, Jo Peterson sits down with cybersecurity and technology executive Billy Spears to unpack the gap between AI policy and actual AI control.

They discuss:

• Who is accountable when an AI agent makes an unauthorized decision
• Why agents should never inherit broad permissions by default
• How identity and authorization must work at runtime
• Why third-party MCP servers should be treated as untrusted
• What organizations need to prove when something goes wrong

Billy’s warning is simple:

“AI is not eliminating risk; it’s amplifying the consequence of weak controls.”

If your AI governance lives in a PDF while your agents operate with broad access, this episode is for you.

Listen now to learn what real AI governance looks like when systems begin to act.

About Billy Spears

Billy Spears is a technology and cybersecurity executive with more than 25 years of experience across security, IT, privacy and business operations. He has held executive roles at Dell, Hyundai and loanDepot and currently advises executives and boards while building a stealth cybersecurity startup.

Connect with ClearTech Loop

Watch on YouTube:
https://www.youtube.com/@ClearTechResearch

Subscribe to the LinkedIn newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI agents are becoming part of the enterprise workforce, but many organizations still do not know where those agents are, what they can access, or what they are allowed to do.

In this ClearTech Loop Special Edition sponsored by Okta, Jo Peterson speaks with Matthew Hansen, Regional Chief Security Officer and Head of Customer Audit at Okta, about the identity challenge behind agentic AI.

They discuss Okta’s AI Blueprint, Okta for AI Agents, and why enterprises need to treat AI agents as first-class, non-human identities with clear ownership, lifecycle management, runtime enforcement, and a way to revoke access fast when something goes wrong.

EPISODE DESCRIPTION:
Agentic AI is creating a new security problem: identity sprawl.

AI agents can connect to systems, access data, trigger workflows, and act on behalf of users. But if organizations cannot see those agents, govern their access, or understand what they are doing, productivity gains can quickly turn into security risk.

In this episode, Jo Peterson talks with Matthew Hansen from Okta about how organizations can move from Shadow AI and unmanaged agent activity toward verified, governed AI environments.

The conversation covers:

• Why every AI agent needs an identity
• How Shadow AI extends beyond employee chatbot use
• The three questions organizations need to answer: where agents are, what they connect to, and what they can do
• Why static credentials and broad permissions create risk
• How runtime enforcement and human-in-the-loop controls help govern agent behavior
• Why an AI kill switch may become a critical backstop for enterprise AI

This ClearTech Loop Special Edition is sponsored by Okta.

Learn more about Okta for AI Agents platform: https://bit.ly/4dZ5FkU

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI governance is no longer just a policy conversation. As AI moves into business workflows, sanctioned platforms, employee tools, local models, agents, and third-party services, organizations need to understand where AI is being used, what it can access, who approved it, and who owns the outcome when something goes wrong.

In this episode of ClearTech Loop, Jo Peterson speaks with Derek Fisher, founder of Securely Built, cybersecurity educator, author, and Director of Temple University’s Cyber Defense and Information Assurance Program.

Derek brings a practical security lens to AI governance, AI agents, and third-party MCP risk. The conversation covers why governance needs clear ownership, how organizations should think about AI agents as non-human actors with access and authority, and why MCP servers and AI-enabled services should be evaluated through a third-party risk management lens.

This episode is especially relevant for security leaders, technology leaders, compliance teams, and business executives trying to move AI from experimentation into controlled, accountable use.

In This Episode:

• Why many organizations still do not know where AI is being used
• Why AI governance needs executive ownership, cross-functional standards, and business accountability
• How AI agents create new access control and auditability challenges
• Why agents should be treated more like privileged non-human actors than simple tools
• What organizations should ask before adopting third-party MCP servers or AI-enabled services
• Why AI governance is not about slowing the business down, but making the approved path usable enough that people follow it

Key Questions:

1. How do we operationalize AI governance, and who is legally accountable when an AI agent makes an unauthorized decision?
2. How do we prevent agents from executing actions the user should not be allowed to perform?
3. How do organizations verify the authenticity and security of third-party MCP servers and services?

Featured Guest:
Derek Fisher
Founder, Securely Built
Director, Cyber Defense and Information Assurance Program, Temple University

Derek Fisher is a cybersecurity leader, educator, author, and speaker with experience across product security, secure software development, governance, risk management, regulatory compliance, incident response, and cybersecurity education.

Host:
Jo Peterson
CIO, Clarify360
Chief Analyst, ClearTech Research

Additional Resources:

• Securely Built
  https://securelybuilt.substack.com/
• The Application Security Program Handbook https://www.manning.com/books/application-security-program-handbook
• Derek Fisher on SecureWorld News
  https://www.secureworld.io/industry-news/author/derek-fisher
• Your AI Coding Assistant Has Root Access—and That Should Terrify You https://www.secureworld.io/industry-news/your-ai-coding-assistant-has-root-access

Watch More ClearTech Loop:

Subscribe to ClearTech Research on YouTube:
https://www.youtube.com/@ClearTechResearch

Stay in the Loop

Follow ClearTech Research for more conversations on cybersecurity, AI governance, cloud, enterprise technology, and emerging risk.

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

In this ClearTech Loop Special Edition from AWS Summit New York, Jo Peterson speaks with Himanshu Verma, Worldwide Leader for Security, Identity, and Governance Specialists at AWS, about how agentic AI is changing the identity risk conversation.

They discuss why AI agents need to be treated as non-human identities, how AWS Security Hub helps centralize identity risk management, and why multi-Region resilience matters for enterprise security leaders.

Episode Description

AI agents are moving from assistive chatbots to autonomous, task-executing digital employees. That creates new identity risks around permissions, visibility, accountability, and resilience.

In this special episode, Jo Peterson and AWS’s Himanshu Verma discuss:

• Why agentic AI changes identity risk
• The problem of over-permissioned agents
• How AWS Security Hub centralizes identity and access visibility
• Why Security Hub helps correlate findings across core AWS security services
• How multi-Region resilience supports enterprise identity and continuity

Guest

Himanshu Verma
Worldwide Leader for Security, Identity, and Governance Specialists, AWS

Host

Jo Peterson
CIO, Clarify360
Chief Analyst, ClearTech Research

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI is moving faster than policy, training, and many traditional controls were designed to handle.

In this episode of ClearTech Loop, Jo Peterson talks with Gerald Auger, Chief Content Creator of Simply Cyber, about shadow AI, non human identities, over-permissioned agents, and what AI defense means when AI systems can act at machine speed.

Gerald brings the educator, GRC, and practitioner-community lens to the conversation. His take is practical: organizations probably cannot put AI back in the bottle, so they need to educate users, provide approved tools, bring agents into identity governance, and start treating AI governance like a real security discipline.

What You’ll Hear in This Episode

Jo and Gerald discuss:

• Why shadow AI is a problem for IT, security, and the organization
• How AI is becoming easier to use inside everyday SaaS tools
• Why sensitive data in public AI tools creates a visibility gap
• Why user education has to be part of AI security
• How non human identities and AI agents create new permissioning risks
• Why Gerald thinks organizations may need a “manager in the loop”
• What AI defense means when AI systems can act quickly and at scale

Key Insight

AI governance is becoming its own discipline.

Gerald’s point is not that organizations can stop AI adoption. It is that they need to build around it with education, approved tools, segmented environments, identity controls, better detection, and practical guardrails before “just let it run” becomes the strategy. Which, respectfully, is not a strategy. It is a group project with consequences.

Timestamps

00:00 Introduction to Gerald Auger
00:30 Gerald’s background in cybersecurity, education, and Simply Cyber
01:38 Shadow AI as an IT, security, and organizational issue
03:00 Why public AI tools create data visibility risk
04:40 Why organizations have to “ride the lightning”
06:46 Jo on the missing layer of AI security training
07:13 AI inside everyday tools and emerging attacker behavior
08:58 Non human identities and over-permissioned agents
12:30 AI Wrangler or Manager in the Loop?
13:12 What AI defense means in practice
15:46 AI Gone Wild and closing thoughts

Guest Bio

Gerald Auger, PhD, is Chief Content Creator of Simply Cyber. He is a cybersecurity educator, GRC practitioner, community builder, and creator of the Simply Cyber Daily Cyber Threat Brief.

He has a PhD in Cyber Operations from Dakota State University and teaches cybersecurity at The Citadel. Through Simply Cyber, Gerald helps cybersecurity professionals build careers through practical education, daily threat briefings, and practitioner-first community content.

Resources

• Simply Cyber Academy: The Definitive GRC Analyst Program https://academy.simplycyber.io/p/the-definitive-grc-analyst-program
• Flashlight in a Dark Room: A Grounded Theory Study on Information Security Management at Small Healthcare Provider Organizations by Gerald Auger
  https://scholar.dsu.edu/theses/329/
• Subscribe to ClearTech Loop on YouTube: https://www.youtube.com/@ClearTechResearch/

Follow

Follow ClearTech Loop for more conversations on AI security, cybersecurity leadership, AI governance, cloud security, GRC, risk, and enterprise technology strategy.

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

Your AI policy does not matter much if no one understands how to follow it.

In this episode of ClearTech Loop, Jo Peterson talks with Maybelyn Plecic, Manager of Training and Adoption at Network to Code, about shadow AI, non human identities, and what AI defense actually means when people are already using AI to get work done.

Maybelyn brings a security, compliance, training, and adoption lens to the conversation. She is CISSP certified, AWS certified, and has spent her career helping teams strengthen security posture, drive compliance initiatives, and make technical change usable.

Why This Matters

AI adoption is already happening inside organizations.

The challenge is that governance, policy, training, and approved tools are not always keeping pace.

That creates risk, but not always because people are acting recklessly. In many cases, employees are trying to move faster, automate boring work, and solve problems the official process has not solved yet.

Maybelyn frames shadow AI as an IT issue, a security issue, and a trust issue. Her point is clear: if leaders want people to use AI safely, they have to make the safe path understandable, practical, and easier than the workaround.

What You’ll Hear in This Episode

• Why shadow AI starts with trust, not blame
• How protected proof of concept environments and AI sandboxes can reduce risk
• Why shared language matters when AI systems, agents, and workflows touch data
• How prompt injection, AI training defaults, and history tracking create new security concerns
• Why AI defense is not just a tooling conversation
• How leaders can create AI guidance that teams will actually follow

Key Insight

AI security is not only about tools and controls.

It is about whether people understand the rules, whether the approved process works, and whether organizations are willing to meet teams where the work actually happens.

As Maybelyn says in the episode: “how do you expect someone to be compliant if they don't even know the rules, right?”

Timestamps

00:00 Introduction to ClearTech Loop
00:26 Meet Maybelyn Plecic
01:29 Shadow AI: IT problem, security problem, or both?
01:54 Why shadow AI starts with trust
03:00 AI is moving faster than governance
04:47 AI generated content, visibility, and accountability
06:35 How language around AI is changing
08:43 Using AI to automate the boring work
10:40 How AI changes the CISO conversation
12:33 Non human identities and the importance of shared language
13:05 Workflow questions become security questions
14:26 Prompt injection, AI defaults, and training gaps
15:47 What AI defense means beyond tools
17:30 Why AI guidance has to match each team
18:45 Closing thoughts

Guest Bio

Maybelyn Plecic is the Manager of Training and Adoption at Network to Code. She specializes in helping teams make technical change practical, secure, and usable.

Her work spans security posture, compliance initiatives, technical enablement, training strategy, and customer adoption. She brings a builder’s perspective to AI security, with a focus on making complex technology easier for people to understand and use responsibly.

Additional Resources

• Maybelyn Plecic website: https://www.maybelynplecic.com/
• Network to Code Resource Center: https://networktocode.com/resources/resource-center/
• NIST AI Risk Management Framework:
  https://www.nist.gov/itl/ai-risk-management-framework
• Season 1 ClearTech Loop: https://www.buzzsprout.com/2248577

Follow ClearTech Loop for more conversations on AI security, cybersecurity leadership, AI governance, shadow AI, non human identities, and enterprise technology strategy.

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/