You Can't Secure AI With More AI

Sohan Maheshwar is a developer advocate at AuthZed and the first in-house guest on the show. He has been in the industry about sixteen years, most of it in cloud, including the Amazon Alexa team from 2016 to 2018.

He opens with a demo built on a MIDI keyboard: each key carries its own permission, so one user can play every note and another only an octave. The version he did not get around to building is authorizing only the keys in a scale, so you can mash the keyboard and everything you play is in key, because the unauthorized notes make no sound.

The number he puts on slides: broken access control has topped the OWASP Top 10 for the last two lists, six years, and the most recent report found broken access control issues in 100% of the applications tested. "Not even 95, not 98, but literally every app tested."

At a conference keynote in Amsterdam, a speaker told a thousand people that the way to secure AI is more LLMs, and got applause. Sohan's position is that LLMs are probabilistic, and access control is a place where working 99.5% of the time still means things go wrong. Jake calls it an algebra of determinism: mix a deterministic thing with a non-deterministic thing and the result is non-deterministic. For anyone building agentic RAG, the rule he repeats is "don't let the agent decide whether it needs authorization."

Also in the episode: prompt injection landing more often in Portuguese or Hindi than in English; RAG is not old news, enterprises are only now adopting it; enterprises de-risking onto open-weight models after three months of turbulence; whether Python and JavaScript will read like Assyrian on papyrus in a museum ten years from now; and his bet that daily Claude Code use is costing him the ability to write code by hand.

He puts himself firmly in the futurist camp, by way of Gutenberg: the scholars of the late 1400s who wrote that the printing press was the worst invention ever, because now the common person could read the sacred texts.