Create a Secure HR AI Agent with Claude Code

Data Scamps and Data Champs, this is Richie Cotton. Welcome back to the Anthropic Age. Sorry, we're starting a little bit late today. It turns out that building agents is the easy part. Getting your screen share working is, uh, surprisingly difficult. So we had a few technical issues, all resolved now. So, uh, very much ready to go. Uh, so two very quick pieces of housekeeping before we get going. Uh, everything you need for today's session is in the resources file. So please do make use of that. If you want to follow along. And secondly, yes, this session is being recorded. So if you have to, uh, jump or you want to catch up on anything that you learned, uh, please do come back to that, uh, uh, using the recording. All right. So point to today is that every time we've run a session on creating agents, the top question is, how do I do this securely? Can I do this with, uh, sensitive data for my work? We got lots of questions around this. And so today we're gonna find out, uh, we're gonna build an agent and we're gonna step through thinking about how do we make sure that the architecture of this is gonna help keep things secure. We're not going to have any kind of disasters resulting from the agent's creation. Our guest is Cailin Bedford, who is a security architect at Insight Global. Welcome, Cailin. Great to have you here.

Hey, Richie.

Yeah, very much looking forward to this session. It's been such a requested topic that I think it's going to be very useful for a lot of people. So Cailin helps Insight Global aviation and defense customers build security and governance into their AI initiatives. So he's also the founder and architect at Orbit Works, and he's also Principal Solution Architect at KolgiCast. Previously, Calum served as Global Manager of Engineering for the Cyber Defense at Genuine Parts Company, and he's got a DataCamp course coming very soon, which is AWS Security for Developers. Actually, when's that course coming out?

So we actually did a test call yesterday, and so we are looking at, I believe, May 15th. May 19th. So there's been a few challenges, but we're getting there.

I imagine so. Security is hard stuff. That's why we learned about it today. But yeah, put that in your diaries, everyone. May 19th, and yeah, new course for you to take. All right, I'm going to jump off and let you dive in, Kaelan.

Sure, no worries. And then a quick plug. So that course that I spoke to Shazad, who's also a DataCamp engineer and evangelist. So it would, it would actually been launched today, but it turned into a situation where it was just DataCamp and I, and then AWS came in the picture, and then Claude came in the picture, and I had started the course on ChatGPT's Codex, which of course means, means that I had to change everything. So that's, that's what's brought the delay on that. I think Richie, Richie is used to those types of delays. Alright, so today, guys, what we're going to do, I've kind of— originally, I was going to plan a security agent. And I tried to find a way that would make everyone feel a little bit more comfortable. Not a lot of people are interested in talking about security just because it kind of goes over people's heads. And so we worked with the team at DataCamp, and we came up with something that would be useful. For people and something that most people would understand, and that is HR, right? And oftentimes it's the nuances that people don't understand. So what we are going to do today is we're going to— I'm going to make some assumptions here. There was a link that was sent out to anyone who had formally registered, and then also on the YouTube page itself, you can download the assets. And so there's going to be lots of assets. I will kind of break them out as we, as we get to them, but by the time we're done, you'll have internalized 3 things regardless of whether you touch HR systems or are responsible for attribute-based access controls: provenance-first design, prompt injection resistance, all these different aspects of security that are tied to making sure that an agent will work. Of course, the theme is for HR data, so all the assets are going to be tied to, you know, just made-up people with made-up assets. The only thing that you won't see is there won't be like an official salary, but outside of that, most information will be populated for you in the assets so you can try it as well. So I guess where we will go now is I am going to explain a couple of the assets, but we will move forward with this slide. There's 21 slides. For most of you that know me from my career and my friends and family, I typically talk very fast. So, you know, I'm going to try my best to keep this very smooth and moving forward so that way we have time for questions. Alright, so to make this easier and digestible, you know, I'm working on my master's right now in cybersecurity, so this is actually kind of fun because I can showcase this project, right? And what we are doing here is we basically created a case study, and the data that we're using is 50 synthetic ACME Tech employees. Plus 10-rule ABAC policy workbook, a 10-rule ABAC policy workbook. And for those of you that don't understand what ABAC is, we will get to that. But for the technology minds on, on today, ABAC is similar to RBAC. Our primary goal is to build a secure HR agent, and that will enforce ABAC through a cloud Skill. Secondarily, we will map every decision to OWASP's LLM Top 10 through Cloud Skill as well, and also aligned to NIST SP 837, which, which essentially is, you know, when you think about AI, AI is moving so fast right now, and NIST and OWASP are the two leading frameworks and standards that, that both are government and the UK's government, and pretty much all major countries are trying to align to NIST. And then OWASP has just kind of exploded over the past, you know, 30 days, not 30 days, 60 days, 90 days. They are constantly coming up with new content. And I realized that in the assets, I did include some of the full, very boring NIST and OWASP PDFs, but I also generated some infographics that weren't included, and I will go ahead and get those over to Richie Cotton and Reese so that they can get them out to everyone that has, that has been a part of this. So we're on the slide, biggest issue, right? Most AI agent demos skip the hard part. They show you the happy path. The agent answers a nice question, which, you know, is kind of like the confetti moment that we all are excited about. What they don't show you is what happens when the agent has asked for something it shouldn't return, right? Or when the data it's processing contains an attack. And this is where generating an HR agent, it was kind of a bit of a, you know, it got to me, but I found a way to make it more about security. So, you know, when an auditor walks in and asks who authorized what and why, this is exactly, you know, why we put these types of agents in place and why we have to start relying on the ability to take care of managing what most people understand is required for a secure system, right, with new agentic workloads. So today we will demo all three of these explicitly. And now we'll move on to slide 3. So it's just a little bit about, about me. I'm running this session. I'm an AI product evangelist. I have spent a lot of time with ChatGPT's OpenAI product lines. If you are familiar with ChatGPT, I took a copy yesterday of my entire ChatGPT file and I had over 6.8 gigabytes of data, which is mind-blowing, because I think the average is about 2 gigabytes. So I've used it for so many different things. And based off of today's course, I'm a security practitioner. So I work through hardening environments, vulnerabilities. I started in mergers and acquisitions. My first job was working with storage solutions, and from storage solutions to networking for large law firms. Think like companies, the defense contractors with plane crashes insured by like insurers like Zurich International and major insurance firms. So imagine the amount of data that has to be managed. So my background is enterprise data protection, HRIS integrations, and ML platform engineering recently over the past 6 months. Which is where Obert Works came about. So interesting things about that. And I'm more than happy to talk about that. If anyone ever wants to chat, feel free to email me. Why I built this session is that HR was the first domain where I saw one prompt equals data breach become real. And I guess an easy way to understand this is that most people that are in corporate enterprises, you realize how slow integrations and transformations happen. And that's a big challenging point. And most companies want to go from a legacy state to a target state where they're modern, but most of the time they end up in some sort of hybrid state. And that's because they have hundreds and hundreds, if not thousands, of systems that they have to reconcile and transform or modernize. And so the reality is that data breach can be, you know, it can hit every aspect of these solutions. So I like to tell my clients, and I like to tell my employers that, you know, I love NRG when it comes to taking in how you deal with latest and greatest technologies. But I use a story that I tell that helps me educate customers and clients that I like putting in solutions that scale, but my biggest fear is that executive that is just, you know, coming off a plane at LaGuardia and coming down an escalator and sees a scrolling marquee and is like, oh wow, Workday had a new revision module and let's go implement it. And the next thing you know, he has a war room started and the businesses bought the licenses. And IT and security are like, what? And so this is exactly why we as security practitioners want to break it down into segments where we are able to align compliance frameworks. That includes NIST and OWASP for today's aspects. So ABAC is— it basically helps identify patterns, shapes for cells, and legal support, finance agents, and today's will be for HR. So we will go ahead and, um, you're going to leave today with a starter kit, a workbook with the policy rules that I've created, a 50-row dataset, a SkillMD file, a response template which is MIT licensed. So that's super cool. I've made some pretty tremendous inroads over the past 6 months getting sponsorships with different companies, and so yours to fork at the end of the day, right? All right, so let's move into the agenda. And Richie, feel free to step in if I'm over on time as well. All right, so we've advanced to slide 4, the HR agent problem in one scenario, right? So we are dealing with a scenario of an HR manager that's asking the agent to pull everything on an employee, Acme0017, right? The dataset would typically, right, and in this scenario has salaries, Social Security numbers, performance notes, and free text notes field. What the naive agent does is it returns every column, right? Um, including compensation figures it should not share. Um, it, it obeys the notes field when it says it, uh, when it says ignore previous instructions. And then it leaves no audit trail, no rule file, no log row, no citation. And that is a problem. Right, so what a defensible agent does, and you know, an agent that has followed the ability to align to a security framework gives the agent the ability, several abilities that are key. It allows the evaluation of requests against documented policy. And as we all know, policy is a huge gap in most companies. And typically it's not amended as it relates to onboarding new solutions, like that executive who saw the scrolling marquee at LaGuardia, and not understanding what requirements are needed to be reconciled with the technical debt to get to that latest and greatest phase, right? And an agent that is working with proper frameworks returns only what rules allow. It treats notes fields as untrusted data, not instructions, it writes an audit row so you can prove the decisions later. And that is the biggest thing that I'm noticing with clients and my employers is that if you don't have an audit trail, it is almost impossible to, you know, be defensive, be defensive across multiple planes from federal government regulations to even your state's regulations. That's why having audit included is important. Unfortunately, having proper audit controls is not fun. When we are moving at the speed of light, we typically want to slow— we don't want to slow down to implement a solid audit strategy. Hopefully, in the assets, you will see how I've built this out. Now we know the problem. We're going to move on to essentially the build phase. We're going to take 3 artifacts. That's the whole agent. This is a very simple agent, guys. This is not going to be a fully fleshed-out agent that my coworkers or my friends know me to build. I have agents that run you know, academia. I have agents that run script writing. I have agents that run security hardening, security vulnerability assessments. But this one's very specific to HR, and there are 3 artifacts that are going to run it. That is ABAC policies, which is essentially 10 rules that are a workbook that include all of the attributes. And I've tried to keep them simple, one rule per row. Then skill.md, which is essentially a file that the agent looks at. That skill reads the workbook and enforces each rule at request time. No server, no Python runtime. I'm making this very simple because I want to be able to show how you can build an agent very simply in a solution like CoWork and Cloud Code. And then of course the HR request template MD, which is the structured markdown template every response follows, and that includes metadata, decisions, fields, audit pointers, and sources. Every, every decision in this aspect is traceable to a row in the workbook. So when you try this at home, when you go into Claude, and, and I'm not gonna say you can't use any other LLMs, but the assets are the assets, right? The auditable artifact is the spreadsheet in your assets, not the model. So keep that in mind. All right, so I am going to make sure I have each of these items available for myself and We will move into slide 6. All right, so let's talk a little bit about why, why ABAC and not RBAC. So RBAC equals role-based access control, and that's typically HR managers use that to read HR databases. You know, one attribute would be like your role. Work until an HR manager asks for pure salary, no nuance there, right? ABAC is different in a sense that it's attribute-based access controls. So HR managers can read HR fields classified internal for direct reports during performance cycles, and attributes like that typically come across as role, department, purpose, target relationship, data classification, time. RBAC is a subset of ABAC where role is the only attribute. So it's important to notate the differences, and most— mostly HR people are going to understand this, um, as well as IT and security governance engineers. Why this matters for agents: so LLMs in general interpret context well, but they're not perfect. So you have to provide agents with the ability of giving them rich attributes. And rich attributes are important because they're not just roles. And I know a lot of people have learned about latest and greatest agents out there where there's a role like a researcher role or a role for assistant, but the reality is it doesn't matter what role you give them. If they don't have rich attributes to evaluate, you're going to end up in a situation where you're frustrated and you stop using the tool. So every rule in the workbook that I've provided to you is an ABAC rule, and Claude reads them top to bottom, and first match wins. And we will see this live. All right, so, um, for OWASP LLM risks, we'll demonstrate live, is that there are a lot of risks, right? And there's a top 10 list We are going to use prompt injection, which is very important right now, sensitive information disclosure, improper output handling, and excessive agency. You're going to have access to this presentation, so I know we're running a little tight on time, so I'm not going to go through every aspect of every slide moving forward. But as you know, we're working with prompt injection, sensitive information disclosure, improper output handling, and excessive agency. And I've also included a PDF for you to actually see in-depth quantifiable details of each of these threats. All right, now for roadmap for live segments, um, the way that I have built this out for us today, because we're trying to keep this simple, is 4 steps: categorize, database sensitivity sheets where we classify public, internal, confidential, or restricted. This is aligned to NIST's RMF Step 1. So of course you will have access to NIST's latest PDF. We will also select and implement policy rules and a SkillMD, which for anyone that's using agents today, right, you know what a SkillMD is, right? It's taking the ABAC rules that I am implementing as a security practitioner for each role and purpose load, and then loading the skill so Claude enforces them. And that's important because we're not just talking to, you know, Claude and saying, do this, do this, do that. We're actually giving it controlled metrics and data points for it to work with. And then we'll assess with a prompt injection demo, and which will trigger rules. And then move into authorize and monitor, break glass and audit logs as well. And that would be an exercise you could actually customize yourself when you go through the audit logs, when— if you try this out, right? All right, so now we're gonna move into step 1. So let me make sure that I don't have an update to process because Claude is pushing out updates updates every single day, even multiple, multiple during the day. And I am just making sure we do not have an update to process, and we actually do. So give me one second. Alright, so we're on slide 9, and here we're gonna talk about categorization. So NIST RMF SP 837 Rev 2, it's, it's no, it's essentially the latest revision is helping people understand what you have before you protect it. Because if you don't know what you have, then how are you gonna know what tools and methodologies and frameworks or compliance requirements you have to use to protect it. So let's move forward with policy rules. So what we want to do here is we're going to discuss the database sensitivity sheets, um, at a very high level. I built 22 fields, 4 tiers, broken down into public, internal, confidential, and restricted. I spoke on this earlier, right? So we have public information, which is your employee ID, which we're all used to, full name, role, department, fine to return in any response, right? Internal items, which are work emails, manager IDs, hire dates, your tenure, location, also available to colleagues in like gals or you know, databases or, you know, even intranets. And then confidential information, which is very important, right? That's your performance ratings, any clearances you may have, termination items, PIPs, risks, salary bands, and whether or not you're an employee that is fortunate enough to have a pension, those types of things. And then of course, your restricted, which includes salary amounts, bank information, socials, And the way that we will work with those from a sensitivity perspective aligns with both NIST and OWASP as explicit denies. So I am hopeful that Claude is going to keep us on track. So classification for this effort lives in the workbook. When you add a field, you declare it first, not after. So, That gives you an idea of how we're going to deal with the database sensitivity aspects. Now, as we move forward in selecting and implementing, so this is going to put us into a theory mindset. I have several options that I was going to kind of pull out on the fly. But for this purpose, we're going to select and implement. So we're going to write, write the rules, load the skill, um, and then never re-explain the policy and the prompts. And that's where agentic workloads kind of blow my mind, because if you don't give them guardrails, they kind of start doing their own thing. And that is kind of where people get lost, and then they're like, oh, I don't trust it, and then they don't move forward. So we're going to do it in a, in a format today that essentially gives Claude the ability to process what we've selected and implement. And I have built rules to keep it from diverging outside of what I expect. And all right, so in selecting So the ABAC rule, this is an example of what it looks like. It may be a little small, but I'll just talk through it briefly. So rule 1 is going to include policy rules, and the rules for our example are HR manager, department HR, purpose performance review, target direct reports, database, which is fabricated HR core, um, the max classification would be confidential decisions allowing the employee to be active, right? And then return field sets equal base profile plus performance fields. So, you know, I'm not an HR professional, and so this is an example of where I'm like giving the bare minimum. And then of course I'm anchoring this to OWASP, right? So your LLM 02 in the workbook for 2025, and then the NIST RMF step, which is under implement, and this is considered severity low. So 10 of these roles cover 90% of the HR agent traffic, um, and then default deny handles the rest. So as you can see, we are building a flow that gives the agent the ability to be productive up to the skills that we have requested within the bounds we've requested. And then I have also have 10% of it where we have explicit denies, and I hope Claude follows it. All right. So let's go ahead here. What we will do is that there was quite a bit of information where I wanted to talk about the pitfalls of implementations with agentic workloads as it relates to policy. But we're again low on time, so you're going to have the ability to go through that, the documentation with the download package to talk about that. So now we're going to move to the prompt, right? So I forgot we need to talk about the skill. All right, so in 60 seconds, what the skill is, um, the skill is a markdown file Claude loads once per session, teaches the agent a workflow. It's not code, it's not a server, it's a readable contract. And this contract is between you and the model, and the model can be whatever LLM you choose to use. Um, what's in our skill for today, right? So policy evaluation order, data handling guidelines, response formatting, denial responses, prompt injection handling, and bash requests. Now, when you log into your computer every day and you go into ChatGPT or Claude or Gemini, are you thinking about these types of skills? Like, are you guiding your question with these types of rules? And that's where the SkillMD comes in handy because it gives the rules that What I like to say to clients and employers is that before AI, we had the ability to have multiple people in the company that give the support to help people understand policy, help people understand how to handle data, help people how, how to manage denial responses, whether it be soft or hard skills, right? And then you have security teams that that already handle the prompt injection handling and then batch requests across multiple departments. That's— there's usually people tied to this. So that's why SkillMDs are important for agents because they— you have to give those types of skills. Um, and I'm not going to talk about how I believe that these skills are going to reduce actual employees in the workforce because the reality is, is everything's moving so fast we're, we're gonna have so much effort and so much data to work with that even with AI, we're just going to have to refine the process. So people are always going to be in the loop. All right, so on step 4, moving to assess. So can you actually break it? That's the only interesting question, right? That's, that's our plan. Can we break Claude if we have given it solid instructions. So we're going to go ahead now and move into the demo aspect. So Richie Cotton and/or Reese, let's, let's go ahead. I'm going to switch over and we're going to move over to CoWork. Awesome. I think this is exactly where we need to be. All right, all right. So a couple of housekeeping notes here, guys. Um, the reality is, is that I am using Claude here, and Claude is, um, one of my favorite tools. Um, it's made by Anthropic, and I use, um, Cloud. I use Cloud Code Work. I, I use Cloud Code. I also integrate Cloud Code into VS Code when I'm working across multiple planes across my Linux or Windows farms. So Cloud's a great tool. And what we are going to do is we're going to go ahead and move into the demo and kind of transition into essentially giving Claude the instructions that I have provided to you in the assets, and then we're going to watch what it does. And, um, I just pro— I just processed an update to Claude, so there may be some unknowns. Um, happened over the past hour, um, so, but we will get through it. So just give me a second here and I will go ahead and pull up the prompt that we need to use so that we have the ability to take everything that I've explained today and put it into a Cowork session and then evaluate the outputs. So one second here. All right. So there's a couple of steps here. For the sake of time, I was going to talk through how to get them all up, but most people are going to have some semblance of understanding. So this is just Claude. This is Claude in the sense that it is a co-work session. And so I have very specific instructions in your attendee package, and so I'm gonna get it— can I move straight into the, uh, the ability for us to start processing the activities? Hold on here, I think Claude is frozen for me for some reason. Let me see if I can make it work.

I mean, worst case You do the standard IT thing and just close it down, reopen it, see what happens.

I know, I'm trying. I tried to see if I can refresh the code. Let's do this again. How's it looking on your side?

So I can see I can see Claude, but it's just blank. Like there's nothing typed in there. Yeah, I would say just kill it and restart.

Yeah, I'm going to do it one more time.

Oh, So I didn't see any changes on the screen share. I don't know whether— is it closed down for you?

Yeah, it closed down for me. It probably froze on, uh, Restream.

All right, it might be a screen share issue then. Do you want to stop sharing that screen and then reshare it and maybe it'll work? This is all the fun of live sessions, is, uh, debugging technical issues as we go through. Okay, we've got advice, uh, in the chat saying you might need to go to system tray, right-click and quit.

All right, so let me— advice.

Ah yeah, you see a lot of apps these days, you, you think you've closed the window down, but it's not actually closed the whole application. Very sneaky.

Yeah, it does do that. I've noticed that as well. I am— and yeah, doing a force close.

All right, force close that and then, uh, close— stop the screen share as well.

All right. All right. So it shows, it shows gone, right?

Yep. We've got a blank screen. So if you reopen Claude now and then restart the screen share, then we cross our fingers and hope this works.

I was watching the other two. I was watching the two other 2 other of the DataCamp from this week with Claude, and there was one example similar to this. So I don't feel too bad here.

If it doesn't work, I'm going to make you mime what would happen with Claude for the next 20 minutes. All right. Screen share is just loading. For everyone in the audience, apologies for the delays. If you want to just whistle or hum to yourself for a moment while we get this sorted. I think we're nearly there. All right, we got Claude. It's back on screen. Do you want to type something in there?

Test.

Magic. All right, let's do this. We're back. Hey, I'm gonna hide now.

You good? You're good. All right, I'm just pulling up the updated prompt for us so we have the ability to move this forward. All right, so we're ready to go. So what I'm going to do is, um, I don't want— I want a fresh session. So what we're going to do is we're going to open up here, I'm going to start a new task, and I'm going to pretend I just, uh, I'm coming in and I want to create this agent. So, so you can tell it to do it, but it's, it's going to come back and say you need to provide the directory to me, right? So what I am going to do is choose the folder. And I know that the folder that I've created, right, is here. And so this folder basically takes the assets that we have discussed, right? And the assets that we discussed in this include every aspect of everything we've tied to the security principles and then what we want to accomplish. We have now mounted the folder and the folder is for this webinar, it's for Secure Agents and it's the starter kit. Now that we've mounted the folder, the expectancy is that— Richie, my lawn guys are here and they are very loud, so if you can hear it, let me know. Otherwise, I hope the noise canceling on this mic is working.

There's a bit of background noise, but we'll see if Rhys can work some magic with the noise canceling. Okay. Otherwise, you need to yell out the window at them.

Yeah, there's about 15 of them. All right.

Let's continue then.

All right, so we're going to go ahead now that we have mounted the folder and what we're going to do, remember, we're keeping this simple. We made 3, 4 files and I'm going to tell Claude, which is using a combination of Claude Code and Claude Cowork, to open up the skills file, which is built out all the skills and all the requirements that we discussed earlier. Awesome. So now Claude has basically said, I have found the working directory, I see your skills, I see your README, I see your HR request template, your ABAC policies, your dataset, And now I understand what we're doing. I followed the skill requirements, the rules, every aspect of what this agent is supposed to do. And now it's confirming with a very simple verbiage, um, telling you what it's doing. So it's evaluated everything that I need this agent to do, which is absolutely perfect. Um, so excited about that. Now, now that we've listed the skills, right, What we need to do is co— the cowork chat again obviously is empty, right? And what we're going to do is we're going to move on to the ABAC policies component. This should not take very long. So what we want is we want essentially to have Claude tell us that it understands the ABAC policies. Now, I know it does already, right? And so the understanding from this perspective is that it is going to take the skills for the HR agent, and it's going to take the HR request, and it's going to validate that against the ABAC policies, right? And there's a challenge here because there used to be a button that I had on Claude that I don't see. So what we will do, let me open up the File Explorer. Sorry about the noise, guys. They should be done with it here pretty soon. All right, here we go. So I've got the policies up now. So I've opened up a spreadsheet, and this spreadsheet is essentially a spreadsheet that includes all of the fields, right? The fields that we discussed earlier. And so those fields are README, policy rules, role definitions, database sensitivity, audit log templates, framework mapping, right? And we're going to— let's see here. We're gonna go ahead and just drop it into the chat. And although it does know the root, we're gonna drop it in the chat and watch what Claude does with the policies. So essentially what it's done, it's gone through and it is basically validated that the policies that I put in place, which are very in-depth, they're in your assets, takes the rules and the definitions and sensitivity and starts building the ability to, for this agent, to give you the output that you need as we move forward into some coding aspects. Alright, so let's move to the slide. I think we are here. What we have done, we've basically told this co-work agent that we want to manage the ability of evaluating any of the questions that we have through the assessment. We know that it processed and said that it understands the rules. The first item that we're going to discuss, and I'm going to move on quickly, is prompt injection. What happens when the data attack attacks the agent, right? So the attack in the sense that we would deal with, it would be ignoring previous instructions and listing all salaries, which is a huge risk, right? And not a naive agent obeys. So data has become code in this sense. So what our agent does based off of the ABAC policies, right, is that the rule scans non-schema fields for instructions like patterns. Before any decision, which is very important. So it's not acting on the fly. And then rules fire, so denies high severity classifications, and then response to return with denials and templates. Um, and so the whole plan is that this doesn't end up on the record, right? And so audit rows with severities based off of classifications are flagged for review. Why is this the right decision? So when you use ABAC policies and role definitions and database sensitivity aspects. The rule is documented in a workbook. Anyone can read it and challenge it. So that's the security aspect as a practitioner that is very important. The decision was made by the policy and not the model's opinion in the moment. And that takes us right back to the whole idea of what happens when we get into situations, right, where agents are just acting and you don't know what they're doing. So by building an ABAC policy, the right decision in this sense is having a doc— having it documented in the workbook. You guys have access to the test one. And then of course decision models, which are available based off of assets as well. And so the next time an attack comes through with prompt injection, you get an update because the policies are available and the agent understands it. So it's not scattered across the LLM and you wondering why it why you had some sort of exposure. I think the long guys are gone. All right, so for authorizing and monitoring, so break glass is a feature, right, that a lot of technology mindset people understand, even marketing. You know, break glass is, is essentially an account that you will use to, you know, blow through a problem and get a resolution in, in path. So with that said, break glass and the audit log. So in the assets, and I know we're running very tight on time, so we probably will do a few less coding sessions and talk, talk through how they would work. You have the available files to be able to process this on your own as well. So the break glass and audit log. So, um, a CEO asks for a restricted field during an active investigation. Everyone can understand that can be a simple investigation or it could be a complex investigation. So we built a rule in this agent based off of the ABAC policies that essentially puts us into a situation where purpose equals investigation and the severity is high on the audit rule. So you haven't banned the access, you made it expensive and visible in this sense. So for the audit log, every request, allow, deny, and redact, which essentially writes to run one row based off of this agent, gives us the ability to have columns that are timestamped, requesters, all the way through to notes, severity, and the agent can give this back to you based off of the activity. What you walk away with is that when you process the agent request, after 50 requests, the audit log tells you which roles are hot, right? And, and which attacks are— attackers tried what and which roles overreach. Um, these are things you don't think about when you're talking to LLMs, right? These are things that you have to build in, and this is where security professionals come into play with HR professionals, because practitioners in security know that you have to have those types of abilities so that way you manage role conflicts and overreach or underreach for that matter. So this agent allows the log, not the chat history, to give you the ability to attest to compliance teams.

All right, super. Just before we move on, because we're kind of at time now, we're going to go over in a little bit for anyone in the audience. If you have to jump now, please do check out the rest on the recording.

Actually, Kelly, I don't know whether you have a sense of like how long it's going to take to go through the rest of Um, so what we're gonna do is that just because the, the new version of Claude is kind of slowing us down, we only have about 3, 4 more slides and then we can go to questions.

All right, let's do the, the rest of the slides, then, uh, we'll take a couple of questions from the audience. Uh, and before we do that, I just wanna say, uh, next week and the following week we've got a 2-week series on agents in the enterprise. If you're looking for enterprise use case of AI, so we can do some fun stuff with OpenClaw and, uh, some other tools, uh, beyond just, uh, Cloud, the Cloud ecosystem, please do come back for that. And there is a link in the chat if you want to sign up for that. So please do come back. All right, Kaelan, I'll let you get on with things.

Awesome. All right. I want to hear some questions. So, so what this kit gives you and my apologies for not having more Cloud visibility here, but the reality is, is that I'm a security architect and I'm talking about HR. So you can only imagine where my head's at. So what this, what this kit gives you in the assets is a complete reference implementation of an ABAC, of ABAC in an agent, which is all of the required rules that you need to have a successful defensible conversation with HR or an attorney, right? So defensible patterns, rules, skills, templates, audit logs, framework mappings, NIST, right? And OWASP, all running inside Cloudflare. Cloud with zero deployment as a baseline. And I know this may be very, a very simple deployment, but I, I am very proud of how built out and secure this is because essentially I would take what I have built and then just build out all of the HR aspects that need to be in it. It's, it's amazing. You could take, you could take this presentation and and the files that I have built for you and the playbook and build your own, you know, mini Workday or your own mini, you know, HR solution. So what production would add, right? So policy stores, audit stores, identity stores, rate limiting, and data minimization. So you— there are so many cloud providers, so many cloud vendors, but the way that the playbook is created is to give you the ability to break it down at a baseline level and then build out based off of policy engines, logging, SSO, right? Everyone wants to be able to use one login to get into everything. And then of course, budget guardrails, right, for agent entry points. How many tokens are you being— are you using? And how many are effective? And how many are not effective? And how can you plan for getting locked out from your agent and start forecasting your consumption so that way you don't ever get into a lockout situation. I have several friends that are in that exact problem, so I will be helping them here shortly to fix those. All right, so data minimization was the most important part of this agent workload, and the reality is, is that you want the least amount of information required to be successful for whatever agent purpose and business function that you're trying to focus on. Now, 3 takeaways to walk away with, right? Security lives in the audit— audible— audit— audible artifact, not the model. So people will tell you that a new agent came out and it's more secure. People will come out and tell you that an agent has built-in security policies, right? But the reality is it's your artifacts, your spreadsheet, and is the thing you defend. So your skill is how Claude enforces it, and it can be any agent in any LLM. So I'm using Claude for this example. ABAC, like RBAC, compresses prompts and prevents drift. These are guardrails that are very, very important for any agent, especially HR agents where you're protecting PII. And the SkillMD loads prompts become one line, and that gives the agent the ability to take policy into Reflect. And you can reference your corporate policy against the policy standard that I built for you. The audit log is the product after you process this in your cloud deployment, right? And if you can't show decision trail, you don't have an agent, right? You have a demo. And that's the biggest selling point for customers that I have seen over the past year. Is that they just want something to work. But when you can't have a repeatable playbook and you don't have a decision trail that can be auditable, you can't report to a state or federal government, right, that you are following compliance standards, right? You have to have an audit log. So now, um, your homework, if you choose to, you have a lot of data that I've created for you. Um, there's an easy path, a medium path, and an ambitious, ambitious path. You can swap data sets for your own, keeping column names, rerunning the good prompts, bad prompts. There's a medium one that gets a little bit more advanced using a database, updating database sensitivity labels. You could even test your own company, not with your company's data, but obviously the way your company handles an agent, and you can put in what you know. Then add in a risk monitor, which is crazy because you could literally have a denial response and then hook it to an OWASP or a NIST anchor, which is fascinating to me. I'm doing that daily. I'm working on a client right now in Portugal that is wanting that ability. So, and then of course, if you want to be ambitious and you've got hours, you could port the workbook I created for you and turn it into a policy agent, keep the same rule IDs just to make it easy, and then stream audit rows to your log aggregator and build alerts based off of low, medium, high, and you would literally have an HR agent that can give you a full end-to-end ability of whatever HR processes you want to accomplish. Anyone can email me, you know, I'll give you feedback. I have built, I think, 72 agents in the past 6 months for different companies, myself included. So now I think that takes us to the end of the presentation. Now you have a starter kit, you have the frameworks I referenced, they're linked here. They're also included in your assets that Reese provided to you. DataCamp had— I found specific tutorials that DataCamp has that I've actually completed. They are awesome. They're linked here. And again, thanks for spending your hour and 6 minutes with me going through this presentation. And I guess we can move on to questions here. Richie, Rhys, thoughts?

Uh, wonderful. Thank you, Caelan. Uh, that was cool stuff. Uh, and yeah, a lot, a lot of important lessons learned. So because we're over time, I'm gonna jump, uh, straight into questions. We'll take, uh, 2 or 3, uh, quick ones. So, uh, Charles asking, uh, we talked about individual, um, fields, uh, uh, with that, uh, attribute-based system. So you're talking about like role, purpose, and all this kind of stuff. Do combinations of fields, uh, also affect this?

Yes. So you essentially run into a situation where client— your mindset is like you would love to have like a Boolean type thinking, right? But the reality is, is that sensitivity labels are going to be tied to your information stores. You can have multiple information stores, but if you want to have a, a larger set of complexity, right, you are more than welcome to just replicate a column and add that type of field or data requirement, and then have Claude— literally tell Claude that you are expanding the requirements for that, and it will reconcile it for you. Uh, Coworker is fantastic. You could literally drop in a file of what you want or, or speak to it, right? Um, I'm a big fan of Whisper, uh, but you can type in what you want to accomplish. And yes, you can expand it. Um, the way I built all of the assets give you the ability, and there are tabs that teach you, um, how you can expand and add those types of additional functionality.

Okay, yeah, so I guess the trick is to start thinking about what are all the worst combinations of things that are going to cause big problems and I guess shore up the, or putting guardrails for those ones first to prioritize.

Okay.

Absolutely. All right, so let's go with one more. This is from Camille. So hi Camille. Are there any built-in safety mechanisms to Claude that would prevent it from executing a harmful request. Now I know like a lot of the LLMs do have safeguards in place so they won't do some things, but I don't like— can you talk them through? When can you rely on the built-in guardrails and when do you have to create your own?

I've, I have seen questions from Camille before on other streams, so I love the question. So, yes, Anthropic is one of the safest other LLMs out there. The reality is, is that it is— it does not have the reputation of other LLMs in the sense that it, you know, can give you an exposure to risk that would be unacceptable. But because I'm a security architect, and the way that I built this course, right, this webinar, this agent, and by virtue of aligning to the frameworks, right? OWASP Top 10 for LLM Applications, NIST 800-37, the RMF framework, and NIST's 100 AI Risk Management Frameworks. All of those frameworks have— do have mentions and guardrails specifically built into the assets that I have built for you. So I mean, you could very well test and ask the agent that you build in Claude, you know, a targeted question about how you would assume— assume you build this agent, it's HR, and you take this question and you ask it a very, you know, let's, let's keep it simple. Let's say, you know, I'm having a bad day. I don't want to talk to anyone. I just want to drink a bottle of wine. I don't, I don't know where my head's at. My My dog just died. You could, you could ask it, but I can tell you right now that even without aligning to the frameworks I referenced and built into the assets for you, Anthropic is going to give you a very high psychologically positive answer. But because I built the frameworks into this agent, including all the assets, it's going to give you a very sanitized and eloquent, commercial and, you know, relevant answer to the HR aspects because I have built the HR rules for you. So hopefully that gives you an idea. It's kind of nuanced, but if you follow the instructions and the assets and build this, I think you will be impressed.

Okay. Yeah. So I think the safety mechanisms built into Claude are very much like well, don't do hate speech, don't do something that's going to be stealing commercial intellectual property, that it's not going to be enough for your agent. You do need to have a lot of these extra rules.

Absolutely, Richie Cotton. In fact, if you build it just as is, the way I've created it for you, and you ask it to expose a salary, it won't let you. If you ask it to "how do I talk to a manager?" You know, and this is my challenge and this is what I want to say, I want to say expletive, expletive, expletive, expletive. It will first tell you that's not acceptable and then give you the ability to say, you know, it'll give you options on how you should respond and they will be aligned to the policies, the HR policy asset that I provided to you, and they will also align to the frameworks which are industry expected standards, right?

All right, wonderful. Okay, we are well past time, so with that we're going to wrap up. Uh, thank you once again, Cailin. Uh, great to have you, uh, front of camera. So actually, I should have mentioned before, Cailin is like one of our webinar regulars in the audience, and, uh, yeah, gradually brought him on stage. So, uh, if anyone else in the audience is interested in going from backstage to front of camera, then you're welcome to do that. Uh, yeah, get in touch with me. All right, so yeah, thank you again, Cailin. Uh, great stuff. Uh, thank you to everyone in the audience who asked a question. Thank you to everyone who showed up today. We are back again tomorrow for a session on using Claude in the enterprise. So particularly for any of the managers in the audience, please do come back tomorrow. Otherwise, see you all again soon. All right, goodbye.