Your Agent Shouldn't Have Your Password

Ari Shamash spent sixteen years at Google. For part of it he managed the Zanzibar team, which means he is a large part of the reason anyone outside Google knows Zanzibar exists: the paper came out on his watch, and it did not come easily.

He is blunt about how the system got built. "It's not like we had a magic wand or some divine intuition. Standard engineering applies." A large problem, no idea how to solve it, lots of trials, most of them failures, and occasionally a nugget worth chasing. Jake pushes back that Google scale from day one is its own kind of magic, and Ari half concedes it: Spanner already existed, the data centers already existed, and clients like YouTube supplied constraints that were real rather than invented.

The paper itself was the hard sell, and the hardest audience was the team. Writing it cost a lead engineer a year or two of wall-clock time that could have gone to features, scale or cost. Then came finding a lawyer technical enough to read it, and a handful of executives who all had to agree on the one question that mattered: how much to give away. Engineers wanted maximum detail. The company wanted minimum. He calls publishing it one of the best decisions the team ever made, and notes that Zanzibar may be the last big infrastructure paper Google has put out.

On scale, the best story in the episode: someone misconfigured a load test and pointed it at production instead of staging, adding something like ten million QPS. "We didn't notice." Nobody got paged, nothing fell over, and the reward was an immediate question from capacity planning about why they were sitting on that much headroom.

On adoption, there is no silver bullet and he refuses to pretend otherwise. No corporate mandate. They went and found teams whose authorization was actually hurting, spoke in those teams' vocabulary, and co-built the integration. A mentor's line stuck with him: "it is our job to walk a mile to save an inch for our customers."

Then the turn. Fifteen years ago, when code started acting on our behalf, it was obvious that you did not hard-code your own username and password into a service, so the industry built service-to-service authorization and moved on. "I don't understand why in the AI world we think it's completely reasonable to say, here's my Amazon password, agent, go do whatever you want with it." His read is that we may be one disaster away from taking agent authorization seriously, and that every previous disruption, the browser, e-commerce, mobile, eventually circled back to the same basics.

He closes an optimist, by way of Calvin and Hobbes: you find out how much a bridge holds by driving heavier trucks over it until it falls down. The point is not to avoid building. It is that the software industry, unlike every other engineering discipline, keeps skipping the part where you think about the support structure first.