The Infrastructure Stack for Agentic Systems

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:09

   Welcome to Nearcon. This is a panel all about the infrastructure for the agentic world. And I [snorts] have some amazing speakers today. People building in eval frameworks, financial infrastructure for agents, the entire data layer for agents. And so today we're pretty much going to talk about, you know, what is needed to actually have agents be deployed into mass market and, you know, what companies you really need to be thinking about. So just before we get

2. 0:33

   going, I'd love for everyone to just a quick quick round of intros. Keep it short. This is not a you know, pitch, but u um real quick, Manuel, let's start with you. What are you building? And um uh we build observability and the valves for AI agents, browser, computer use agents. We look at how things fail and when they fail. So we help teams to fix and monitor performance.

3. 0:57

   Um I'm Bushett. I work for Circle. Um I work on agentic payments and all the core infrastructure for AI crypto layer. I'm Anupam Dada. I'm an AI research lead at Snowflake. We have been building uh end-to-end agent infrastructure.

4. 1:14

   um looking at questions of how to build data agents, coding agents, how to evaluate, observe, optimize them at [snorts] scale um ultimately building trustworthy agents. So everyone's talking about building agents and you know that's important but we do need to be able to measure this success and I think this is probably one of the hardest pieces because these agents are so sort of task specific or like vertical specific. So even before an entity starts creating agents what would

5. 1:45

   you guys suggest that they do whether it is you know getting their data organized properly or building that eval harness like what is the first place an entity starts let's kick it off with anubam sure u I think that's a very very important question when you're building an agent in my mind the first thing to do is to figure out what does success look like what what object objective is this agent supposed to achieve? And for example, when we are building our data encoding agents,

6. 2:20

   uh the data agents have some very specific objectives. There's a space of classes of queries over structured and unstructured data that we will want it to do well in terms of answering. for coding agents. There's a set of data native tasks like data engineering and so forth that we wanted to be very good at. Once you have that objective defined, the next thing is really to set up the eval harness, which is what you are starting to get at. And that often

7. 2:50

   means making sure that you have curated a data set on which you can evaluate your agent. That's the starting point. And then to scale start using other kinds of techniques like LLM judges or agentic judges so that even when you don't have ground truth or human curated data sets you can still have a a measure of how well the agent is doing um and you have confidence that that measure is meaningful. I I can go a lot deeper, but

8. 3:23

   maybe I'll pause here and teach a whole course on this ultimately, but um Monwell, you're building agent evals and harnesses. Um what are some of the biggest mistakes people make when building their eval harness? Building agents today is super cool.

9. 3:38

   Like is the thing that makes you wake up in the morning, go to work, and go every day. And so it's very hard to as he was saying like it's very hard to specify exactly what we want. It's very easy to start doing it. This means people do the least possible work on as if as with unit testing and software testing and then they move to the implementation phase very quickly hoping that they will go back to the valves afterwards. This works, but it's very to hard to convince people to go back to the US ones.

10. 4:11

    And so we end up with a lot of vibe checks and things that end up being in production because of time constraints which then people cannot trust. Okay. But um you know creating meaningful benchmarks for task specific things is difficult. Yeah.

11. 4:28

    In the world of payments like how what are you evaluating exactly like is it that the payment goes through? Is it like, you know, is it paying for the right thing? Like what how do you sort of approach this? Yeah, I think it's in different pieces.

12. 4:42

    Um the the core basics are like what you said. Does it pay for something? Is it doing the right thing? Especially now you're trusting it with your um financial data. Um there's other things like adversarial behavior. Hey, like these agents need to operate in the real world. Can someone fool them to actually pay something for something else or do some kind of uh illegal activity? It it can be a various amount of things. Um so I think those

13. 5:09

    it's it's still an unbounded problem and we have to get started slowly. Uh yeah, you the illegal piece is fascinating. Uh you don't want your agent to be doing something that you wouldn't do. Yeah. And so within Circle like how are you actually navigating this because the risk is so high. you know, if I accidentally have my agent pay for something or even pay another wallet and that wallet belongs to North Korea, um maybe I'm now breaking OFAC laws. And so

14. 5:36

    like how do you even start assessing that? Yeah, it's the same fundamentals which you would do for like you said humans. You need to have the right layers of infrastructure like hey you need to have a compliance engine to be able to make sure something which a human wouldn't do an agent doesn't do. Also for the agents I think there's a same principle we operate with is the least privilege we it's not just for payments but we do

15. 5:58

    that in coding agents right hey can I run this command can I access this folder similarly in the payments world you can what we do right now is you have spend limits you have policies step up approvals as needed so I think those are the core fundamentals which we are operating at now but as eval come in I think that lets you scale much better because then you have data you can trust

16. 6:20

    that this agent operates for this use case very well and then you can scale it. Got it. Talk about data you can trust. A lot of companies these days I mean within near not all the data is as structured as we would like it to be. Um so like what data work needs to be done before an entity is even able to start like agentifying because in this kind of snowflakes bread and butter right right yeah that's a very good

17. 6:46

    question. Um so I'd say that there are broadly two types of data that agents like to work with. One is structured data which are in tables like snowflake tables, iceberg tables and so on. And there in that setting the hard task is the users may often ask questions in natural language. How do you translate natural language to SQL in a way or how do you build agents that can reliably translate text to SQL? Uh and and

18. 7:20

    there's a lot of work we have done on this problem and that so has the community. But for unstructured data, the setup is a little bit different. uh for unstructured data what we have found quite helpful is let's say you have meeting notes in Google drive or you have u data in a PDFs and other formats uh what's useful is to take this data chunk it up into smaller component smaller chunks pieces um convert them into embeddings

19. 7:52

    put them in a vector database and then also in parallel have them in in a form From that you build indices both over the vectorzed representation of the data as well as over the keyword representation and then have tools that can do hybrid search meaning on one path it'll hit the vector representation and on the other path it'll just hit the keyword representation then you have some form of reranking uh on top of that to that kind of we

20. 8:23

    have a product called cortex search that does this uh hybrid search and and that that representation works really well over unstructured data and and in the world of agents now we are moving in a direction where we want our agents to be able to work across structured and unstructured data right so we might have a tool for text to SQL a tool that goes over search over structured unstructured data uh then we also have capabilities for what's called AI SQL which is

21. 8:56

    semantic IC data processing. If you think about SQL formats, the way SQL commands work is that if they're looking at a table, they might have a specific filter that says, "Okay, find all the customers who are u paying you more than a million dollars a year." It's a very deterministic fixed condition that can be checked on a column. But sometimes you have unstructured data in tables like let's say product reviews and you might want an analysis of what

22. 9:27

    are the top five uh customer most common customer complaints that surface in these reviews. Now you're in this gray area where you it's a combination of structured and unstructured capabilities and there's a whole set of work around semantic data processing or AISQL which is another set of tools that span this world of structured and unstructured data. So I think that space is very rich. Yeah, there has been a lot of developments

23. 9:56

    over the past year or two primarily on the on the enterprise side because like with my private claw like for those who don't know Near's recently launched private claw which is essentially open claw that's verifiably private um and it's running inside these confidential virtual machines. I need to structure my data properly to make sure that this thing can actually action on my behalf properly. So is this all happening within just enterprises or are there sort of bridges to consumer that

24. 10:25

    everyone here could even start leveraging because I I want this. Yeah. Yeah. There are bridges starting to happen. Uh I don't know if you some of you may have seen OpenAI put out a blog post about how they built their data agent and uh I think it still might be in closed uh or preview stage but that's an example of a system which is headed in that direction which likely will get opened up to consumers.

25. 10:57

    So I just got to tell my ironclaw to go check out that blog post and then implement changes. Okay, great. Yeah. Awesome. So, uh, Manuel, you're building lots of agents. Yes. Um, how are you structuring your data and, you know, making sure it's it's organized the right way so it's actually actioning properly on your behalf?

26. 11:15

    That depends used by user by user as in some users have already a database where all the data stays and these agents are very smart at figuring out conversions as you were saying, right? point it at at a data set data structure and you do the conversion, right? So, it really depends on a case by case basis.

27. 11:39

    Over time, they're getting way better at porting format to format. So, I think like we will end up with whatever works, whatever is optimal for the moment and the agent puts the work to convert to the Got it. Yeah. So um Bushit question for you. Um this conference is a lot about agentic commerce but if agentic commerce is powered by USDC um it needs to be private. How how are you thinking about this?

28. 12:12

    What are some like you know solutions to actually make sure that a business is not leaking all of their you know historical financial data on a public immutable ledger? Like are blockchains even the right tools for this? I think so. I think that there are core primitives which are still being built like there's privacy which is coming from near's perspective but obviously you don't want all of your data to be publicly available right you don't want

29. 12:37

    to see how much data your agent wallet has and you don't want to go make it like a a hot target for being trained that's one problem uh I think solutions are still very nent uh it's a it's a new problem to solve the one solution which people go by is like hot wallets you create specific wallets for your agents and you keep swapping them, but that doesn't scale by any means.

30. 13:00

    Then there's also like optional confidentiality at the blockchain layer itself, but now not all blockchain support it. And then you're now limited by the networks you can use. I think confidential intents is one way to actually solve it. Uh so yeah, just came out today. So let's hope it can solve it. Uh but I'm optimistic. Um, one other piece on like the the crypto agentic payments piece is like a lot of crypto transactions, they're deterministic. They get sent.

31. 13:27

    You can't just it's gone. Yeah. Um, if we're actually really trying to build this future where, you know, agents are transacting our behalfs, I do believe there needs to be some sort of chargebacks because not only will the model hallucinate, I will hallucinate. I will absolutely buy the wrong thing sometimes and very quickly need to go back to my Amazon cart, make refund. up, but in agentic world that's going to be kind of hard. And so if we're using USDC

32. 13:55

    as or you know just peer-to-peer payments so like that role of whether you're underwriting it like how do you see that actually panning out for aent commerce? Yeah, reversibility is like a blessing in some ways because now there's no charge back and other problems but like the the payments which we know right now I think we have built like some kind of forgiveness into it. we have our disputes, we have our chargebacks and we understand the whole world around it.

33. 14:20

    With machines, it's a bit different because now I'm delegating this to a machine like do I trust myself? Do I trust the machine to do something? Um I think it's still the approach is still very similar to a human layer where you still need to have a dispute based system and um the solutions could be like an escrobased smart contract where you escrow the money and then you predetermine a resolver or it could be like a slashing staking mechanism where

34. 14:44

    there is a reputation of an agent like if it's supposed to handle millions of dollars you better put a stake against it and say that hey I can claim to do something um right here and then always the insurance piece is going to exist because there will be residual risk one way or the other and because of the residual risk you need to be comfortable with taking that risk and and actually evals are a very important component like um a good analogy which comes to

35. 15:09

    mind is like self-driving cars right like we we were not comfortable with cars being on the road and it took a long time for these cars to come onto the road but they did like we we started with San Francisco and a few other cities and now they're expanding to many many cities expanding to highways um insurers are getting comfortable with this and they're able to now charge differently for autonomous vehicles. So I think it it's a similar arc. So just

36. 15:34

    send it out there and see what breaks and then kind of fix it along the way. But you know a lot of these agents in production like they're managing a lot of sensitive stuff with Snowflake like you can't really risk that as much. And so how do you go about, you know, editing the eval framework and, you know, managing these agents that are live in production? Like it's it's a little bit different if you're trying to set everything up and it's almost just internal, but if you're selling this as a service, it needs to be pretty damn good.

37. 16:04

    Yeah, there are different elements to it. In terms of evaluations, we uh created this framework that we call uh what is your agent's GPA? So in my previous life I was a professor before starting a company and then getting acquired and coming to Snowflake. So it's a nod to that first act in my life.

38. 16:26

    Uh but but the main insight there is agents have goals. That's the G. Then they make plans to achieve those goals. That's the P. And then they execute actions ideally in accordance with those plans to achieve the goals. And a lot of agent failures happen when goals, plans, and actions are not aligned.

39. 16:51

    And so with that insight, we created a framework where we could define a set of metrics that look for misalignment between plans and goals. Is this a good plan for the goal? Maybe not. Is are the plans are the actions aligned with the plans? Meaning are they the agent might make a plan and then go off and do something else. And then finally, do the actions actually achieve the goal and do they do so in an efficient way?

40. 17:18

    And so that that framework we have found is very um provides very good coverage of a whole host of failures and this is in addition to tool specifics where for you will have many many tools each of which can come with its own evals. Um so and then we have built that into our production system for evaluation.

41. 17:41

    So that's one area. The other area which you are starting to get into is u there is evaluation for expected inputs but there's also adversarial attacks that can come in through various tool call results or sometimes even through user prompts if the users are themselves malicious. So, so there we have been building a set of defenses, leveraging sandboxing, uh just doing adversarial testing, doing uh putting in guardrails

42. 18:14

    which uh is meant to guard against a whole Are those guardrails generalizable or is it are you actually creating specific guardrails for specific types of agents tasks? That's a very good question. uh the frameworks are general but for any given agent there's kind of an instantiation of it right because the nature of threats is different so there are two broad classes of agents I mentioned that we're working on data agents like

43. 18:41

    snowflake intelligence and coding agents like cortex code think of cortex code as similar to cloud code but uh specialized for data workflows and and then the attack vectors are kind of different Because cortex code is a developer tool.

44. 18:59

    People can come in through attacking through weird bash terminal commands and so on right whereas uh snowflake intelligence it's business users with a chat interface they don't have access to the bash terminal but there are other ways of doing attacks. So the the overall process is similar but the classes of threats and the instantiation of the guardrails necessarily are different.

45. 19:28

    Yeah. I mean I I want my agents to be verifiably private. That's sort of my mytick and what your AI is focused on. Um, and this one's from Unwell because we we met almost two years ago because we're both very passionate about private inference and and all this and so um what type of use cases sort of get unlocked when you do have this verifiable privacy? Yeah. And yeah, what excites you about that?

46. 19:54

    Um on the personal side, the personal agent side, once I can trust a machine with all my personal data, I can go very far in how much I can offload to the machine because I can trust it to be my guardian angel or whatever in the cloud to take care of me.

47. 20:12

    Otherwise there's always the question the tension do I want to share this type of data with some third party which in the past was a dangerous uh deal on the enterprise side is it's different say do I want to risk somebody else to have access to my internal processes do I want my employees data my customer data to be at risk and then there is the government side which is like oh no no no just we don't we don't do that there is no third second option for for many of these

48. 20:44

    entities especially in defense. So it's just non-starter. Can you tell people what you're building at home? Sorry, this this uh a little off the cuff. So I've been in AI for 16 years now and the dream that everybody has is um this guy that does everything for you, your personal assistant that takes care of you. And I see AI as taking over the boring things of my life so I can focus on the interesting things of my life.

49. 21:17

    Which meant that for the last 15 years I've been storing every single piece of data I could about myself, messages, charts, my personal data and u medical files. And now everything is in a nice database. Everything is uh stored. But now I can talk to it. And because it's local and private, I'm comfortable to with saying, have I have I been more happy over time in my life in the last 15 years, have I been when I travel, do

50. 21:48

    I look more excited? And it's something I would never be able to do otherwise. What is it doing for you? It has been preparing this to this this panel for me. Uh yesterday I had to go to a friend's home. I wouldn't remember the address of my friend's home. So, I went through all my chats and my email and my history with him and figure out where he lives.

51. 22:09

    Um, I I want to understand more of some things I don't understand like journalism and I don't have the time to be a journalist myself. So what he's doing right now as you're speaking is downloading open data from governments, archives and putting them in one data set so I can play to be an amateur or journalist which is something I always wanted to do never had the time to do and it's a lot about data normalization because everybody has in all the different ways. I I guess if I can ask a

52. 22:40

    follow-up question to the two of you. Um the I I read this post about Open Claw that this person went to OpenClaw and said, "Make me some money." And Open Claw made this person $280,000 very quickly. And the way that it did was to apply for 329 credit cards. the credit rating for the guy dropped down to like some very low number.

53. 23:11

    It it started some shell companies and uh it did a bunch of these things that did meet the objective. In fairness, open CL was merely asked to make money without any constraints. So it did follow those instructions quite accurately. So I'm curious if you can do private open claw um how would that because this is a it's a it's a it's a great power but with it comes also great responsibility. So I'm curious what how you would guard against something like this.

54. 23:46

    So can I um I have a strong belief that the human is in the center of the machine is not on the side of the machine. So the uh this is my old PhD topic but the agent is around the person. So the moment the person said go make me some money he put himself away from the system.

55. 24:07

    Instead we need to have the human in the loop like a manager but have constant feedback because as of now the agents are not good enough to do five days tasks. It's 15 minutes, 20 minutes, right? But if you try to step away, you're taking giving up the responsibility of your free will and I don't think that's the future we should go towards.

56. 24:27

    Y right. Totally agree. We need humans in the loop. Um I actually want the humans to be in the loop in the interface that is most likely for that human to stay in the loop because I think that that is not always going to be a chatbot. It's not always just going to be a notification. It's not always going to be an email. It's got to be something that is native to that person. and the colors that they like and the rounded edges of the buttons. And so I think it's this is probably going to be

57. 24:52

    probably one of the most exciting spaces is like how can you do access control and keep that you in the loop in the way that meets people's where they're at. Um we only have about five seconds left. Um so thank you all so much for joining. Uh this is a great panel and thank you so much for our guests. Thank you. Efficient.