Latest / Identity at the Center / #332 - Sponsor Spotlight - IAMONES

Transcript

#332 - Sponsor Spotlight - IAMONES · Identity at the Center

0:00
We want to kill roles, and we could want actually to kill any
0:03
in between layer who's trying to translate the word of
0:07
entitlement into a business language because we think it's
0:10
no longer needed. It's a good transition topic to
0:13
move from administering the system to ask anything from a
0:18
user perspective. So kind of I'd say, what is this
0:24
capability and who would get access to it?
0:29
So our platform is designed to give access with visibility
0:34
controls and then I'll talk about that how we ensure
0:38
visibility or proper access restriction.
0:43
It can be anything, can be the business users, they are
0:46
typically lost and they always call an out desk and say I need
0:50
permission to do something. And by the way, I would love to
0:53
get everything that my friend has because that is actually
0:57
what I have to do. They express their problem
1:00
without talking about entitlement and application
1:03
name. They don't say I need SAPI, need
1:05
Salesforce. They say I need to do what
1:08
Johnny's doing. Well, minus that stuff that he's
1:12
doing because, you know, I don't have the permission.
1:16
That's the way it expressed it. So the primary persona that is
1:19
benefit from that simplification are the thousands of business
1:23
users that today are complaining that these systems are complex,
1:28
that the entitlement doesn't speak the language.
1:30
And then you know what they do? They just call the app best they
1:33
call the application owners or in the case of access
1:36
recyclification, they say they just say, OK, click, click,
1:39
click. Who cares?
1:40
I don't understand it. Get get it off my back.
1:43
So business user are the primary benefit of that.
1:51
This is identity at the center if it has anything to do with
1:56
IAM. This is the go to podcast now
2:01
your hosts Jim McDonald and Jeff Steadman.
2:11
Welcome to the Identity at the Center podcast.
2:14
I'm Jim. I'm without Jeff today, but I
2:16
have a fantastic guest, Andrea Rossi from Yamonez.
2:23
And that's right, it's time for another Sponsor Spotlight
2:25
episode. These special episodes are
2:28
created in collaboration with our sponsor to delve more deeply
2:33
into their viewpoints and specific solutions in the
2:36
identity and access management market.
2:39
To make this crystal clear, this is a fully sponsored episode.
2:42
This allows us to provide you in depth insights and expert
2:46
perspectives straight from the source.
2:49
And so like I said, we have Andrea Rossi from Yamonez, a
2:54
conversational identity governance platform that we're
2:58
going to learn more about today. Their website is Yamonez dot AI
3:04
and they have a special landing page for you, which I'll mention
3:07
several times during the episode.
3:09
Yamonez dot AI/ID A/C Andrea, welcome to the Identity at the
3:16
Center podcast. We're very happy to have you.
3:19
Thank you. My pleasure.
3:22
So our mutual friend Marco Venuti taught me the
3:26
pronunciation. How close did I get it?
3:28
Yamonez. You're perfect.
3:31
And yeah, say it. Yamones or Yamones you can.
3:37
That's a right pronunciation. OK, So what are all the other
3:43
pronunciations that you hear? Because I mean, honestly, when
3:46
you look at the name, it looks like I am ones, right?
3:49
But that's that's not correct. Yeah.
3:53
You know, there is a reason for the name we picked, but it's,
3:57
you know, basically all you want the customers and clients and
4:01
partners and the ecosystem to remember is that your name is
4:04
not easy to pronounce, so it becomes stickier.
4:08
So sometimes they say I am once, which is the typical reading
4:13
point from an English standpoint or otherwise the Spanish say
4:19
come honest like the prosciutto or the hen.
4:23
So it's just the name that you can pronounce it actually the
4:26
way you want as long as you remember there is a company that
4:28
does interesting things. Yeah, absolutely.
4:32
So again, Yamonez dot AI/ID A/C spelled like IAM ones ONES.
4:42
And so if you go to that direct link, it's a there's a special
4:47
offer that Andre and his company have put together $5000 off a
4:52
subscription. So if it's something that you're
4:54
going to explore after this podcast is over and after you've
4:57
heard about all the great things they do, make sure you go to
5:01
that link and get your discount. A little bit more about the name
5:06
because I don't want to freeze by this, but Andrea, how did you
5:09
come up with the name Yamones? So when we created the company,
5:18
you know, I have the basic rule, which is even before
5:22
establishing the company, you have to find a good name and the
5:25
name has to mean something to you.
5:27
So I decided to put together MY2 passions in that name.
5:31
The first one is Identity Access Management, because I've been in
5:35
this domain for 20 years. I founded a company called Cross
5:39
ADS and then sold to IBM. So I've seen all the original
5:42
sense that I'm trying to fix today.
5:45
And the other part of the name is, you know, I was born in 67
5:52
and I was born and raised with punk and punk and rock'n'roll.
5:57
So the other part of the name comes from the Ramones and
6:00
that's why the pronunciation is Yamounse.
6:03
And why that name? Not just because I love that
6:08
band that created punk rock, but because the Ramones took a
6:12
boring genre sort of rock'n'roll.
6:15
Songs lasting 7 minutes, complex lyrics and made it fun.
6:20
Songs were one minute and a half and quite melodic.
6:24
So what we're trying to do into the IGA experience is a lot like
6:29
what the Ramones brought to rock'n'roll.
6:32
Fast, fun and simple. Yeah.
6:35
And I'll tell you the this space, the IAM or Digital
6:40
Identity space is kind of famous for having unique names of
6:44
companies. I remember the first IAM product
6:47
that I worked with was OBLIX. And we had to go and get
6:51
business approval to spend a lot of money to get OBLIX and
6:54
implement it with a equally funny name system integrator at
6:59
the time that no longer exists called Entology.
7:03
But getting all of that money proved when you don't know the
7:06
name, it can be interesting interplay.
7:09
But that's what you've got in this space.
7:13
I mean, some of the the most famous names that exist out
7:17
there today, if you if they weren't famous already, they
7:21
sound kind of funny. So, but I'm thinking about the
7:25
Ramones. What was their most famous song?
7:28
Well, the most famous song was Blitzkrieg Pop, which most of
7:33
the people don't know by that name, but the Hey ho, Let's go
7:38
slogan inside it. So that was for sure the
7:42
quintessential famous Ramones song.
7:45
And and that's basically the song that everybody knows not
7:49
even knowing. That's it by Red de Ramones.
7:55
So I, I have to admit I cheated a little bit.
7:57
So I, I was expecting you to give that answer, but I also saw
8:00
another song, which I remember called I want to be sedated.
8:04
And I also saw another song called Gabba Gabba Hey, and I
8:09
wanted to, I mean, it seems like that would be a perfect fit.
8:12
Gabba Gabba kind of sounds like yadda, yadda.
8:16
It's, you know, language. I think what you're doing is
8:20
bringing the large language model to a traditional space
8:24
like identity, governance and administration.
8:26
So what do you have to say about that?
8:30
Well, yes, Gabba, Gabba A, it's actually the first presentation
8:38
that we had. So when we got out of stealth,
8:40
we went out the Koopinger and Pole EIC event to believe it was
8:44
June last year. The company's very young.
8:47
We basically exist since April last year.
8:50
And my first speech was Gabba, Gabba, I am.
8:55
And it was an attempt to say we're disrupting something with
8:59
conversation and with simplicity.
9:01
And yeah, we say that we use large language model and we'll
9:04
get into that. But essentially we are allowing
9:09
to conversate with the system rather than programming, coding
9:14
a system to do what you want to do.
9:17
And that's the, you know, this type of simplicity and ease of
9:21
use that we're trying to bring into this very complex domain of
9:25
IGA. Yeah, so that's starting to get
9:30
us to the elevator pitch, but why don't we get right to it?
9:33
What does your monies do? What makes the product unique?
9:37
So we essentially are unique on two aspects.
9:43
First of all, every interaction that a business user and auditor
9:48
and I am an administrator, a third party is the only way to
9:56
access the system is just by asking question, any question in
10:00
your mother tongue. As we say, it doesn't have to be
10:03
in English, can be in any language, even dialect.
10:07
So for the first time, the UI adapts to you, rather than you
10:12
having to adapt to UI where you don't know exactly where to
10:15
navigate, where to click, what label is right.
10:19
That's the first thing that sets us apart.
10:23
The second part is we went a little further because I think
10:26
that this conversational UI will become the standard in software
10:31
industry 12 months from now. So we made another thing.
10:36
We said we also want the system to be configurable or to operate
10:42
according to natural language instructions.
10:45
So you tell the system as we speak this operational duty
10:51
policy, it's that permission, if it's with that permission for
10:55
that department, then there is a risk which is made this and
10:58
that. So it's like explaining what to
11:01
do to a human and same applies for anything in the platform.
11:07
And that's a configuration of how the system, the amounts
11:13
identity brain resonates on your data.
11:19
And what I mean by your data, I mean the data that are
11:22
represented by user account permission roles, a bunch of
11:26
data which is sitting on Prem and legacy application that we
11:30
are able to augment and you know give Life, OK.
11:37
See, you say you augment that legacy IM application, you don't
11:42
replace it. No, no.
11:45
I think that clients have gone through blood, sweat and tears
11:48
of implementing provisioning. OK, you could call it IGA
11:53
identity. But they, you know, I've seen
11:55
plenty of clients they've gone through very painful
11:59
implementation of connectors with unders of application.
12:03
And maybe when it comes to security controls or workflow
12:06
they do very little, but they spend a fortune integrating.
12:09
So it would be stupid to say don't reuse that stuff.
12:12
So we tap into the existing traditional platforms, I don't
12:18
want to call them legacy, be the same .1 identity, save it.
12:22
And, you know, we take that data out, we enrich that data, and we
12:28
make it available for, you know, inquiring and reasoning with the
12:33
natural language that I just told you.
12:36
Yeah, you're taking all these AI tools and making them available
12:39
to these, whether you want to use the term or not.
12:43
I'll say the legacy identity infrastructure that's in place
12:46
today. So obviously I think that you're
12:51
the ideal client for you is a company that already has a
12:58
identity system in place, an IGA system in place.
13:03
Talk to me a little bit more about what is the ideal client
13:06
for your moans. So the ideal client is a large
13:12
enterprise that has implemented some sort of identity
13:17
management. Maybe you know they implemented
13:20
Oracle IDM years ago, maybe they have gone through save point,
13:24
IAQ 1, identity of savings or maybe they are going to more SAS
13:29
version. But they have gone through a
13:31
program of implementing IGA to some extent.
13:35
So they have a platform where integration are set and we
13:40
cannot meant what they already have.
13:42
So for the time being, our target clients are large and
13:47
mature enterprises. And it's on your website that
13:51
it, it's right at the very top says enter the age of
13:55
conversational identity. And they feel like that's a
13:57
pretty bold statement. It's what I think we all we all
14:02
want to do, right? We're all excited about that
14:05
possibility. I put a post on LinkedIn.
14:09
It was actually a poll and I said, why isn't this there?
14:13
And I got a lot of, oh, you know, yes, our product does that
14:17
XY and Z. And here go to this.
14:21
I said every time someone would say this, they send me a video
14:23
and then I go, and I mean, I, I felt like for the most part of
14:27
seeing a lot of vaporware. So are we really there at this
14:31
age of conversational identity? Well, first of all,
14:36
conversational identity is a nickname we came up with because
14:42
it's a we need to call the way we do, which is essentially a
14:45
new softer stack with new ingredient and the new
14:49
ingredient is larger was model. We just we need to give it a
14:53
name and initially we call it the generative identity.
14:57
But then a partner here in Europe said, well, it's all
15:02
about conversation. So call it conversational
15:05
identity. And so we, we created that
15:10
nickname because for us it's, it's our DNA.
15:16
We had a very distinct luxury. We could build the platform
15:20
ground up with that ingredients. Most of the established players,
15:27
it's hard for them because they have an engine which is built on
15:30
traditional software, free AI and they probably are patching
15:35
some use cases with a bit of AI. So we wanted to have our self
15:41
qualified with the new branding because I think it's going to be
15:46
there's going to be a refreshing industry, not just identity.
15:50
The software industry will be disrupted by a new way of
15:56
building software application specifically in B to B.
15:59
And there is a nice interview by the Microsoft CEO in chairman
16:05
that basically says that where today a lot of business logic is
16:09
are coded into code and it's a bunch of CRUD, read delayed
16:14
updates into a database. All that logic which is now
16:20
softer with rule based configuration where rules are
16:23
sitting, maybe the database is going to be replaced by agents.
16:28
And I introduced essentially a mini larger language model that
16:32
does a business function. But where are you used to have
16:38
20 developers to code that logic, Now you have one LLM
16:44
engineer to does it in a week. You have other problems to fix,
16:50
but you know the productivity it's phenomenal.
16:54
I think I read this article also from Sam Altman that, you know,
16:59
within their club there is the bet of who's going to be the
17:02
first one man company at the billion dollar valuation.
17:10
Of course that a bit extreme, but but that's the that's the,
17:15
you know, my my take on the on on.
17:17
I went a bit too long into the conversation, but that's the
17:21
nuance behind it. No, it's, it's, it's
17:25
revolutionary thinking and it's something that I think we're all
17:28
wondering how's this all going to play out?
17:31
Is this going to be one day we walk into work and we don't need
17:34
20 people, we just need one? Or is it going to happen over
17:37
time and they're going to be an evolution into this?
17:41
I think it's going to be more evolutionary.
17:44
I think that one person running a billion dollar company will
17:47
come sooner than we think because a lot of roles within
17:51
the company can be done using AI or large parts of our job could
17:57
be done using AI. So why not be able to create a
18:01
company that you know, makes those roles available to others.
18:06
So I don't think it's that crazy.
18:09
And then plus inflation of billion dollars will all be
18:12
billionaires here pretty soon. Yeah, and there and there is one
18:16
of just just one side comment I think I heard one time that you
18:19
know AI will replace all the boring tasks and honestly what
18:24
is most boring than approving certifying entitlements from
18:28
managers that don't like that to be done.
18:31
So they would love to delegate to something that says, you
18:34
know, follow my guidelines right in natural language and approve
18:39
it for me. So we are exactly on a spot
18:41
where AI can replace boring tasks too.
18:46
And that's why we think that IGA is well spot on to be simplified
18:52
and rejuvenated. But what what we do or what is
18:56
happening in the market? My, my son is a second year
19:00
college cybersecurity major and I asked him, you know, are you
19:05
learning AI? And he's very little, very, very
19:09
little. And I kind of feel like that is,
19:13
has been the university model where it's kind of lagging
19:15
behind where things are going by a couple of years and then they
19:21
do catch up. But I said to him, I'm like,
19:23
this is the area you need to focus on because your career
19:27
will be using AI to get things done.
19:30
And that is how you are going to differentiate yourself in this
19:34
crowded marketplace. Even though we say, hey, there's
19:36
a a lack of talent in this cybersecurity space.
19:42
There's a lack of knowledgeable talent, talent, right?
19:46
People have experience. If somebody's coming right out
19:48
of college, there are plenty of people who don't know what they
19:50
do, don't know how to do it, looking for cybersecurity jobs.
19:55
I think that for him and for other people who are in college,
19:59
like that's the that's the area to focus on is AI.
20:05
But we're throwing around this term AI and that's what I think
20:10
it's happens in the industry so much as.
20:13
You know, now with 50% more AI, we joke around that it's kind of
20:17
just become marketing buzz and creating like business
20:23
intelligence reports. It's called AI.
20:26
And what I think people, the general public think of with AI
20:31
is what you're seeing starting to see more with like, you know,
20:35
even Google searches and you think of with open AI, it's gone
20:41
up to ChatGPT is this large language model, It's generative
20:45
AI. You talk about the large
20:48
language model. You don't talk about AI in that
20:52
generic sense as much. I'm like, is that right?
20:55
I mean, are you looking to make sure that people understand this
20:59
isn't just, you know, just like a veneer?
21:04
Yeah, if you read to our presentation marketing material,
21:07
we don't use the word AI because they were AI is over abuse.
21:11
So we say we use large anguish Mara so which is a sub domain of
21:15
AI. But it's the most interesting
21:17
one because that's the that's that's the part that we really
21:21
replace boring tasks that now Humana made and that we also
21:25
replace a lot of jobs. I know it's not nice to say, but
21:29
that will happen. A lot of the interaction we have
21:35
with clients, they are asking questions reflecting the way
21:39
they are using that stuff today through Gemini or GPT, which is
21:43
not the way we do. We use the ingredient to rebuild
21:48
AB to B software stack and that's a new part that clients
21:52
still have to to be adapted with understanding that they are B to
21:57
B products will be rebuilt with a new ingredient and they will
22:02
become easier. So we are in the transitioning
22:04
moment and will it happen overnight be moving to AUI where
22:12
you just had things or system that can be configured the
22:15
natural language? No, for a simple reason.
22:21
The software market, we know with the UI done in a certain
22:24
way, with coding done in a certain way as 50 years, but it
22:30
won't take five years, it will take two years.
22:34
So the revolution will be dramatically faster because you
22:40
see and they are taken by surprise.
22:42
So university and colleges are taken by surprise, companies are
22:47
taken by surprise. And so they try to stop the
22:49
flood with one figure, say don't do that, don't do that.
22:52
But in reality, it's so bloody convenient that it's impossible
22:57
to stop. And I think that convenience
23:02
wins, and what we do is just convenient.
23:05
Right, I couldn't agree more. OK, I wouldn't really drill into
23:10
the solution. So we're talking about large
23:13
language model for your existing IGA implementation.
23:19
So as an administrator of an IGA system, I've got to do back end
23:25
work. I've got to configure the
23:26
system, create policies, excetera, create roles.
23:33
As a user of the system, I need to interact and get things done.
23:38
I might need to request access for somebody that works for me.
23:43
I may or may not know the access.
23:44
So those are the two areas, IGA configuration using large
23:50
language model and IGA user. And I think you call this Ask me
23:55
anything, be a large language model.
23:58
So first, I'd love to dig into the IGA configuration with large
24:04
language models. So let's stick there for a
24:06
minute. If we could, you know what is
24:10
this and why is it helpful for the company that has an existing
24:16
IGA infrastructure? So say that you have implemented
24:19
your traditional IGA and you spent blood with blood, sweat
24:23
and tears. It's connected to 200
24:25
applications and you have a wealth of data, user permission
24:28
request the roles that you have created in your legacy.
24:32
Now out of the issue. It's really reasoning or doing
24:36
stuff on those data and say I need to implement a very complex
24:40
separation of duty policy. I need to implement a very
24:43
sophisticated security policy that tells me every permission
24:49
which has been granted for less than two minutes and belong to a
24:53
list of privileged permission and then the guy might also have
25:02
another permission. These type of complex
25:05
correlation policies are basically impossible to
25:08
implement in traditional identity platform.
25:13
This is just the example of security policies which is again
25:17
typically one of the things you would like to do with
25:19
traditional software, but you can't.
25:22
So in our case, you take everything which I said and you
25:26
say, all right, so the security policy that I want to apply is
25:32
if a user has this list of permissions out of this
25:35
application and you name the permission and you name the
25:38
application as you call them as they are stored in the database
25:42
as their name. And if you say if this
25:46
permission has been granted and revoked and lasted less than two
25:51
minutes, then it's suspicious. So these type of what I just
25:57
described, it's a complex instruction in natural language
26:02
that you give to us and we are able to reason on your data that
26:07
we take and extract out of your legacy platform.
26:10
That's a complex use case of configuration, a very simple
26:15
one. It's enriching descriptions of
26:19
your permissions. So your permission out of SAP
26:23
says was whatever are stored in save point, there's the
26:27
permission name and then there is no description.
26:30
Why? Because the application owners
26:31
hate to contribute to description.
26:35
So imagine that in our platform you allow the application
26:39
manager to upload their spreadsheet, their manual, the
26:43
document where already have sent 10s of time, what that
26:47
entitlement does and our system takes it and populate the data
26:53
and that enriches semantically the description without you to
26:58
wait a month and probably spend the under €50,000 of process
27:02
consulting and upload of data. So this is the simplest
27:09
instruction, one of the simplest example of instructing the
27:12
system to do something in natural language.
27:15
Just upload a file name, description and the system
27:18
crunches and Prisma like a human.
27:21
You give that and say, all right, got it, we're going to do
27:24
it. The other example of a security
27:26
policy is probably on the more complex side of distracting it.
27:32
All these instructions in natural language are basically
27:35
something that we funnel into our identity brain and it does
27:42
the reasoning, combining these instructions with your data and
27:46
your data coming from your legacy data.
27:48
OK, there's no magic here. It's reasoning on data.
27:52
Data is oil. And that's why we take your
27:55
existing data and we are able to amend them with reasoning.
28:02
And the two examples I I gave are just a very, you know, 2
28:06
simple examples of what we mean by configuring the system.
28:11
Yeah, the benefits are. Sorry, I think that's that
28:14
second simple example. I mean, you can make a business
28:17
case just on that. We need to do a data cleanup
28:20
because you know, our our roles are meaningless.
28:25
I'm just going to go and look at all of our roles that we have
28:29
all of our entitlements and I'm going to have AI help me put
28:33
together descriptions. And rather than asking you for a
28:36
six month project to go through each one and go back to the
28:39
business owner and ask him what is this?
28:42
And he says he doesn't know. And we go back and forth.
28:46
I'm going to have AI tried to figure it out and give me some
28:50
sample text I'm going to send to the business center and say this
28:54
yes or no, you know, or. You, you, you might not want
28:59
even to as the business owner. Business owner says, listen, I
29:02
have this 50 pages PDF which I wrote three years ago.
29:06
Nobody reads to it, but this has the magic of everything.
29:11
Now what we do through the digestion technique of LLM is to
29:15
say, all right, we are able to read the manual, distill a
29:20
description that fits into an entitlement readable on screen,
29:25
and maybe do other magic, something like I'm an auditor,
29:30
explain me that permission with my language.
29:33
No, I, I'm the IM administrator. Explain me with a broader
29:37
description and give me more technical background.
29:41
You're right, honestly, today sometimes we start with, you
29:45
know, we can do magic here and there.
29:48
There's a lot of value in augmenting cementing description
29:52
of permission job titles roles because once they are described
29:57
properly, LLM can reason on it. And that's the very simple and
30:03
you're right, there are clients that are just mesmerized by the
30:06
idea that you can generate description, summarize
30:10
description out of manuals that have been sitting there for
30:13
ages. And then they will start
30:16
thinking the magic they can do on policy and securities.
30:20
We do it today. Sometimes you're limiting our
30:23
capability because they say do nice to be true.
30:29
Go one step at a time. Yeah.
30:32
I mean, you know, the thing that comes to my mind is that all the
30:36
things that excited me, that I talked about, the way you just
30:39
talked about there with the manual, those things should all
30:43
be done manually. Hurry, we can go through them
30:47
and figure it out. But why spend hours on these
30:50
things when you could potentially do them in minutes
30:55
and offloaded to the large language model to figure out?
30:59
I mean, you go onto the web and you're thinking I'm going to
31:02
research something the old way to do it.
31:05
You start clicking through links and try to find what you where
31:09
you can find good information. Now the first thing you get back
31:13
is the summary answer right in Google that kind of like lays it
31:18
out for you. So why wouldn't you want to
31:21
bring that kind of horsepower to your IGA system as well?
31:27
I kind of feel like it's inevitable, right?
31:30
It is going to happen and and I think what you're here to say
31:34
today is that you can have you can have it now.
31:39
I think this is a lot of this about outcomes, right?
31:44
You need to be able to make your system do certain things that
31:51
you you want to achieve least privilege, for example, you want
31:55
to achieve putting people in, giving people the entitlements
32:00
that they need, nothing more, nothing less.
32:03
And I think the industry's approach for a long time was
32:07
role based access control. I you see it's shifting more
32:11
towards policy based access control.
32:14
But again, to me, where the rubber hits the road is like how
32:19
long does it take to get your system to do that and who can do
32:24
it? Who has the technical know how
32:26
to take the business outcomes that you want to drive and turn
32:30
them into policies that this system can apply to the data to
32:36
get the to drive those outcomes? So talking about roles or Arbach
32:43
or key back, I mean these are all the attempts to translate a
32:48
very simple problem that we have in our identity governance
32:52
domain. There are a lot of technical
32:54
entitlements out of the different applications and they
32:58
have all their cryptic names, no descriptions.
33:03
And then there is a plethora of business users that are speaking
33:06
just a different language. So ICP transaction XYZ means
33:12
placing orders for raw material on the user side.
33:20
For ages raw was an attempt to bridge the translation gap and
33:26
the principle of saying I'm going to aggregate permission
33:29
and give it the meaningful business name was the only way
33:32
available up until large language model.
33:35
The only issue out of that, and I think you know it well, we got
33:38
the paradox that now there are companies with more roles than
33:42
people and you say, OK, I don't get it.
33:46
Roles were supposed to be a fraction of people.
33:49
And now you, you you're sort of there's a role explosion that
33:53
cost me millions a year to consultants who are maintaining
33:56
reviewing that we want to kill that.
34:00
That's an old practice. If we say if you have a proper
34:04
description in every business object attaching to your
34:08
database in our, we call it temporary identity whereof and
34:12
there is description for entitlement for roles, proper
34:15
description. Now we can reason on that.
34:18
And do you need policy? I'll be honest with you less and
34:21
less because the system can say this is a guy from the IT
34:26
department. No, let's do the other way
34:28
around. This is a guy from the marketing
34:29
department and he has three permissions with a description
34:34
that means marketing, and then one description that means
34:38
privileged data administrator. It doesn't make any sense.
34:44
You know, it's like if you read it, it says, you know, it can't
34:47
be, it was a violation in principle.
34:50
Is there a policy for that? No, that's one of the example of
34:54
something that we get out of our platform and we call it a
34:57
coherence check. If a description doesn't match
35:00
with your job function, I mean alert now that's not even a
35:05
policy. It's the coherence check without
35:08
any configuration in the old days.
35:12
Well, policy click rules here and there.
35:16
So we want to kill roles and we could want actually to kill any
35:20
in between layer who's trying to translate the word of
35:23
entitlement into a business language because we think it's
35:26
longer needed. It's a good transition topic to
35:29
move from administering the system to ask anything from a
35:35
user perspective. So kind of I'd say, what is this
35:41
capability and who would get access to it?
35:46
So our platform is designed to give access with visibility
35:51
controls and then I'll talk about that how we ensure
35:55
visibility or proper access restriction.
36:00
It can be anything, can be the business users, they are
36:03
typically lost and they always call an out desk and say I need
36:07
permission to do something. And by the way, I would love to
36:10
get everything that my friend has because that is actually
36:14
what I have to do. They express their problem
36:17
without talking about entitlement and application
36:20
name. They don't say I need SAPI, need
36:23
Salesforce. They say I need to do what
36:25
Johnny's doing. Well, mine is that stuff that
36:29
he's doing because, you know, I don't have the permission.
36:33
That's the way it expressed it. So the primary persona that is
36:36
benefit from that simplification are the thousands of business
36:40
users that today are complaining that these systems are complex,
36:45
that the entitlement doesn't speak the language.
36:47
And then you know what they do? They just call the app best they
36:50
call the application owners or in the case of access
36:53
recertification, they say they just say, OK, click, click,
36:56
click. Who cares?
36:57
I don't understand it. Get get it off my back.
37:00
So business user are the primary benefit of that auditors.
37:04
If you think about how much time auditors are asking, tell me
37:08
about this, tell me about that. I want a report and you have
37:11
these poor IM administrator folds that they need every day
37:14
to strike data to create a new report, new columns, new stuff.
37:20
This stuff is gone. You say, dear auditor, that's my
37:24
system. Ask any question and also they
37:26
might the auditor must say let me check if this violation took
37:30
place in the past. So auditor risk manager,
37:34
security people having to control the posture are the, I
37:38
would say the secondary benefit beneficiaries of this.
37:42
But the reality also traditional administrator, once they see how
37:46
to create a security policy, they will say, wow, I'm going to
37:51
jump on it because instead of waiting a month and spending,
37:56
you know, and avalanche of money, I can do it myself.
38:00
It's my PDF, it's written properly.
38:03
And in fact, we say the PDF, the natural language is the new
38:05
code. And I think that clients and
38:07
consultants will have to pay more attention to what they
38:11
write in the documents because they will write get it to the
38:14
reasoning, you know, cycle. So, so that's the beneficial
38:24
again, business user auditors for sure.
38:27
These are the two audiences that are screaming for just asking
38:33
things in their language and the system to adapt and understand
38:37
their language instead of adding the other way around where you
38:40
need to make sure that you ask things in the way that the
38:44
system understand. So.
38:46
So is your moon going to be smart enough to say, OK, here
38:51
comes Jim and he is a business user and he can do XY and Z, but
38:57
here's Andrea, he's the System Administrator and he can do
39:02
everything A through Z. How will it know to you know to
39:11
restrict that? Does it leverage the permissions
39:15
that were set up in the legacy or is this something you train
39:19
the system on? No, there is no training, and
39:22
that's an important remark to make.
39:25
There is no training learning period.
39:27
With our software, you plug into your data and in two minutes
39:31
you're able to inquire them in nature or language and give
39:34
natural language instruction. So how do we ensure that the
39:37
right people are seeing the right data and asking the right
39:40
question? And I'll tell you more, we also
39:43
need to make sure that tricky questions are blocked.
39:51
So what are the attributes that we use to segment the visibility
39:55
on data? And what I mean by data, I mean
39:57
your IGA data that might be sitting on save point.
40:01
And also how do you ensure that some questions like risk
40:07
checking, security check type of questions, a business user can't
40:11
test them? We had to develop what we call
40:15
an LLN firewall, which is essentially is an Ln model that
40:21
does just the tasks of, you know, saying you can't, you
40:28
can't ask this question or yes, you can ask this question, but
40:32
just on the data, you're the finance department, you go
40:35
there, you go here. So we call it LM firewall.
40:40
And it's a crucial component for ensuring again, not just
40:44
visibility of data, but now we're asking questions.
40:48
So we need to make sure that we block some type of question.
40:53
And what I mean by some type is that the model can understand
40:57
that you're asking a question about is John violating the
41:02
least privileged policy? He understand that the part the
41:05
question is about risk violation and the system can be configured
41:12
again in natural language to say if the guy's a business user,
41:18
then he can't test that question.
41:19
Where do we take these attributes out of the IGA data?
41:23
Because there, there is always the job function, the department
41:28
we can augment, you know, the tagging, but essentially the LLM
41:34
firewall resonates on the attributes that we take out of
41:37
this Eastern legacy. Yeah, that's important.
41:42
I'd love to see kind of how that works in action.
41:46
And I want to remind people that if they are interested in
41:51
everything we've been talking about, they want to see a demo,
41:54
go to Yamones dot AI/ID A/C. It's IAMONES dot AI/IDC and got
42:04
a code on there to get a discount, but I'm sure they'd be
42:08
more than happy to spend some one-on-one time with you and set
42:12
up a demo. I think this is all really
42:17
great. One thing that I I kind of felt
42:19
all along because when I look at large language model technology,
42:25
I kind of feel like the back end is a big piece of that.
42:29
It's a graph database. Am I under something or is that
42:34
just not as important as I'm making out to be?
42:38
So the word graph in the word of AI comes out very often.
42:44
So in the way we what we mean by graph.
42:48
So where we store the data coming out of legacy system, we
42:52
call it temporal identity graph. Why graph and why temporal
42:59
graph? Because it's a design.
43:02
The entities are users, account permissions are notes, and then
43:07
there are relationships. OK, like a user has been
43:10
assigned a permission. No, it's been revoked.
43:13
So all these are connections pretty much like a LinkedIn
43:17
network or an X type of you know, I follow that person that
43:22
has disinterest and stuff. One of the reason why graph is
43:30
important, it's not much today on the LLM space because
43:35
actually the data could be sitting in any database.
43:38
You query them, you'll treat the data as a text and the LLM
43:42
reasons on the output of the query to a database.
43:47
The value of why we have designed the data model to be a
43:51
graph model, it's not for now, it's for the next AI ingredient
43:58
we will be adding, which is not even on the website because we
44:01
didn't want to sound too foolish.
44:03
But you know, that's a bit of a road map.
44:06
We're going to use another deep learning neural network model,
44:10
which is not LLM. It's called temporal graph
44:12
network and it does good prediction on an on a, on a time
44:18
evolving graph. What is prediction for?
44:22
Well, this permission might be useful for that person.
44:26
This permission it's likely to be added and that could be a
44:29
risk as it happened for the other guy.
44:32
So in order to make prediction on a on a time evolving graph
44:36
model, LLMS are not good. You need another AI ingredients,
44:41
another sub domain or model out of this complicated word that
44:46
too often people just refer to it as AIAI is an archipelagos of
44:52
models and you need to pick what suits best to your needs and
44:56
that's why you don't find much AI buzz worthy into our
45:00
communication. You saved me from asking a
45:03
question about the future, so we can put that off the side.
45:06
It sounds like the temporal. What did you call again?
45:11
Temporal. It's temporal identity Roth a
45:16
time of. It's basically because we store
45:20
a timeline of information. OK.
45:22
So that's where you're going. I did want to talk a little bit
45:27
about, you know you talked earlier about the Yamon's sits
45:34
as a enhancer to the existing identity infrastructure.
45:42
So I think that's kind of key from a infrastructure standpoint
45:46
or from a starting off standpoint.
45:49
So if I say, all right, this is something I'm interested in,
45:54
they go to the website, your moans dot AI slash IDAC to get
46:01
the demo, decide to buy it, then what?
46:03
They start the one year project to implement it.
46:07
Now it starts 5 to 35 minutes project and it works this way.
46:16
We have a piece of software which is non AI.
46:18
It's called the identity Gateway and it connects to your data
46:22
source. If it's a standard one like say
46:25
.1 identity and so forth, we have prefined integrations.
46:30
What that does, it takes the data out of your system and also
46:35
start tracking, change events and store them into our temporal
46:39
identity graph. What I mean by our doesn't mean
46:42
that it has to be on our cloud can be even hosted on your
46:45
premises or your AWS Azure region that normalizing the data
46:56
takes 30 minutes. As long as you plug into your
47:00
system. Then the only other thing you
47:05
have to do is go on our, you know, actual platform that
47:09
you're going to get through the IDIDAC page and you activate
47:14
your tenant 30 seconds and then get tenant will point to your
47:19
temporal density graph. So All in all, if you want to
47:22
add conversational capabilities of inquiring your data, it takes
47:27
30 minutes, one hour depending on how much time you take to to
47:31
connect to your environment. And then if you want to start
47:34
adding instructions, maybe takes another one hour just to
47:38
practice depending on the type of instruction you want to
47:41
build. Data enrichment, super simple.
47:44
You might already have APDF somewhere that you know as that
47:47
description. You upload it in the system and
47:50
we do the magic of understanding and extending your data.
47:55
For large enterprise, I'm assuming they they normally
47:58
start with a pre production environment, test things out
48:02
there, make sure that they feel like OK, we're safe and then
48:07
move it into production and or then implement it into their
48:10
production environment. Yeah, technically we start the
48:15
pilot, call it whatever you want.
48:17
We basically tap into non production data that might be
48:20
also anonymized or a subset over there, you know, large chain of
48:24
identities. They subscribe to the tenant and
48:27
we point the our SAS platform to that database that contains the
48:33
data taken from the non production.
48:35
And the day they switch it there, we basically point the
48:39
reasoning to the database that has the copy, so to say, out of
48:43
their production. Data.
48:45
So you have existing customers, yes.
48:49
What are you hearing back from them?
48:50
What are the benefits? And then how do they gauge their
48:54
success? Well, you know at the moment
48:57
what the clients are looking, especially the IM administrator
49:01
people, they're just trying to get their business users off
49:03
their back. So now the measurement of
49:07
success is given to you, the business user AUI where they
49:11
just ask questions and they just get an answer without having to
49:17
call the IM administrator that has to waste time or the
49:20
application owners to try to translate those questions they
49:25
have into into the right permission that might look into
49:28
the catalog. So today it's all about
49:31
convenience. And if you think about the
49:33
reporting issue, so imagine today you have your business
49:38
user and they want a report. Well, if it's not there, you
49:42
have to create it. And then they say, well, I want
49:46
that extra column and you have to add that extra column with
49:50
us. You say give me the list of
49:53
permission belong to the finance department, Boom.
49:57
Well, add me the department column, boom.
50:02
Please reply in German because I have subsidiary in Germany.
50:05
Oh period. So we the business user benefits
50:12
from that because it's just just ask.
50:15
But the IM administrator get all the bird and following all the
50:20
requests out of business user for stupid things like an extra
50:24
report, an extra column, an extra language that's all gone.
50:27
There's no longer the multi language UI is gone with large
50:30
average model in our system. We also make fun, we ask
50:34
questions in local dialects in Italy and Germany and the system
50:39
replies in the local dialect, which makes the demo very funny.
50:42
But think about the company that has, you know, you know, our
50:47
client in US, the first one who was on board.
50:51
I think they have well Spanish, English and few European
50:55
countries languages. How do you maintain a multi UI
50:59
into Saypoint? That's what they have.
51:01
Well, it costs for us, it's gone.
51:06
So that's the biggest benefit today that clients are looking
51:08
OK, get the business users out that they are back giving them
51:12
something easy that they can play with.
51:15
Yeah, that's a benefit I didn't even think about.
51:17
Like I, I guess I intuitively knew when you're talking about
51:21
like language support for all these different languages, like,
51:25
Oh yeah, well, AI has already taken care of that for you of
51:29
like the open AI model. And so if you're taking that
51:32
model and you're applying it, then you get it.
51:34
But now business benefit, if you have been having to maintain UIS
51:42
the old way and multiple languages, I mean, that's no
51:45
longer just have a problem, figures out who the person is,
51:49
sends them, you know, and they start asking questions in the
51:54
language that they know and it understands the questions.
51:57
I mean, that feels like a revolutionary impact.
52:01
I'm going to ask you a little bit of a fun question now
52:05
because this, this, I mean, I'm feeling the benefit, but I'm
52:09
also used to using like AI for trying to research things and
52:18
then getting answers that you'd later find out are made-up
52:23
hallucinations, if you will. Do you suffer from
52:28
hallucinations with your moans? The beginning, 12 months ago,
52:33
the company started the technology well before we
52:36
founded the company. That was April last year.
52:39
Yeah, a lot. At the beginning we said, well,
52:43
LLM will do magic. So we take data out of the IGA
52:46
legacy data, and we'll give a bunch of instructions, throw
52:50
everything there, and the system will get it.
52:53
No way, no way. Maybe we get there one day, but
52:56
not in the coming years. So in order to prevent
53:00
hallucinations because we were giving too much information, we
53:04
said, well, let's make like the humans do just tell everybody to
53:10
you have a bunch of people and you say I pick you because
53:12
you're very good in reasoning on sets of the evaluation.
53:15
You're very good in relating natural language to data
53:18
retrieval query from the database.
53:21
And each one is a specific task. And with that street guard,
53:25
guard rail, a lot of context and task specific.
53:30
We have avoided evolutionation. Yeah, not avoided.
53:33
I mean it's like bugs. You always have a minority of
53:36
illucinations, but you know, at the beginning it was the problem
53:41
now or it's happens, you know, one time every six months.
53:45
OK. And then it's easy to fix
53:48
because it's like adding extra context and eventually making
53:53
the guard rail narrower. So this practice of taking the
53:59
big elephant and eating it bite by bite is going to become the
54:03
standard when you develop business software application.
54:07
And it's essentially if you look at legacy or pre AI software
54:11
stacks, components of code that does components of business
54:16
logic, the new AI stack, it's those business components of
54:21
business logic are nothing more than instructions or prompts,
54:27
guardrails given to an LLM. And what I mean by LLM, you know
54:32
as we work across LLM, so we're not tied to a specific one,
54:37
although today we use a combination of Open AI and
54:41
Anthropic Sony. But you know, we are going to
54:46
replace some tasks with some other LLM.
54:49
Why we do that? Because these horizontal LMS,
54:53
they improve and they become cheaper and faster.
54:57
So, but Long story short, the way to prevent hallucination is
55:04
you give very guided restriction to Mini LLM, each performing a
55:09
single task within what we call the identity brain.
55:12
And the funny note is the guy who has developed that is my
55:15
fellow shareholder head of AI. He's 24.
55:20
He has no experience whatsoever to suffer.
55:23
And actually that's what I wanted.
55:24
Otherwise they just go back complaining about the good old
55:27
days where you can programmatically do everything.
55:31
Yeah, but it takes six months. Interesting stuff.
55:36
Well Andrea, this has been a really interesting episode.
55:42
I want to remind people again Yamones, I AM ones dot AI/ID A/C
55:51
For more information to take the next step in exploration on this
55:57
journey. There's also going to be a lot
55:58
of links in the show notes, including the link to that PCU
56:05
that you talked about with Satya Nadella, the AI agents.
56:09
I think that's absolutely fascinating, and I think people
56:13
can easily go down a rabbit hole with the whole AI agents and how
56:18
things are going to be in the future.
56:21
Our tradition on the show is to end things with a later note.
56:24
Andrea, you're in Italy, You're an Italian.
56:28
Where? What city are you in now, or
56:30
what are you closest to that we made know?
56:32
Close to Bologna, which is the city of Ducati, Ferrari,
56:37
Lamborghini. So I live in the mechanical
56:39
valley. So as a softer guy, I'm in a
56:42
beautiful place, but not the right one typically.
56:45
Actually I live nearby, so I live in a town called Imola.
56:49
It's spelled IMOLA, which is famous for the F1 racetrack.
56:55
There are two in Italy, one is Monza near Milan and the other
56:58
one is here in my hometown Imola, so north of Italy, close
57:03
to Bologna. Simple.
57:05
OK, so here's my question for our later note is I I love
57:11
travel talking with you, you love travel.
57:15
It'll trip to Italy is on my bucket list.
57:18
I probably would go somewhere between one week and two weeks
57:21
long. How would how should I spend
57:24
that time? I want to tell you, of course I
57:27
want to eat good food. I mean, that's going to be a
57:30
mainstay and drink good wine and but I also want to not just go
57:35
to one place and sit there for the whole time.
57:38
I want to bounce around and really have the Italian
57:41
experience. So what do you recommend?
57:45
Well, first, I wouldn't recommend you to visit the big
57:48
city because that's where you get the the crappy food.
57:52
So if you're looking for good food and good wine, don't go to
57:54
Milan, you know, maybe come to Bologna, the main city.
57:58
Don't go to Florence, go to don't go to Venice, don't go to
58:01
Rome, go in the countryside. Then you might decide whether to
58:04
experience more of a northern experience of Italy, which means
58:08
just in the upwards Venetopia Monta, I mean the upper part
58:13
where the cuisine is different. Or go to the South like Sicily,
58:17
Pulia or around Naples. But definitely if you want to
58:21
enjoy good food, don't go to the picturial cities because you
58:24
know, you get average or well below average.
58:31
So there are a lot of places. Italy, it's food experience
58:34
everywhere. And you know when you plan to
58:37
come get you a ring and you might come and visit here.
58:41
I mean, there are nice places here where I live and good food,
58:44
good wine. Actually, the region, the part
58:46
of the country where I live, Emilia, Romania, it's known for,
58:51
you know, the prosciutto, and it's good everywhere.
58:55
But here we are sort of well known for balsamic vinegar, for
59:00
example. So I'd be your guide here, no
59:03
worries. That sounds great.
59:06
What time of year should I come? Well, it's generally very hot in
59:11
the summer. So I would tell you skip July
59:14
and August. October is phenomenal.
59:17
April, March is phenomenal as well.
59:20
But you know, I tell you what this year has been specifically,
59:24
we'll say harsh winter, not as harsh as upstate New York, but
59:29
you know, not the mild one we used to know.
59:31
But typically if you want to come to Italy over January,
59:35
February, that's phenomenal. Most of the tourists are not
59:39
here. So again, really off the beaten
59:42
track, January, February, right after Christmas or otherwise you
59:46
come October, late September and that's phenomenal.
59:50
That sounds like great advice. I'm very excited for when I make
59:53
that trip. And you will be you and my
59:55
friend. Our mutual friend Marco will be
59:58
the first people I tap for sharpening the pencil on the
1:00:03
itinerary. We love very close.
1:00:05
Yeah, I I very much appreciate the advice and very much
1:00:09
appreciate your time today. Just want to go over a couple of
1:00:15
things, which is again, yamones.com or, I'm sorry,
1:00:19
yamones dot AI slash idac. You can also visit our website,
1:00:26
idacpodcast.com and you can watch all of our episodes on
1:00:31
idacpodcast.tv. Thank you everyone for listening
1:00:36
or watching and we'll catch you all on the next one.
1:00:40
Bye, bye. You've been listening to
1:00:43
Identity at the Center. We hope you've enjoyed the show.
1:00:47
Make sure to like rate and review and we'll be back soon.
1:00:52
But in the meantime, hit the website at
1:00:54
identity@thecenter.com. See you next time on Identity at
1:01:00
the Center.