Keep the Data Inside Your Perimeter, and the Agents Too

Episode Summary

Claudionor Coelho Jr has built AI at Google and at Zscaler, and his argument here is that the industry is worrying about the wrong layer. LLM security, he jokes, is the easy problem. The hard one is what happens when agents hand your data to entities outside your security perimeter, which you must then trust and authorize without knowing whether they hold your standards. His advice for anything that is not a toy application is blunt: keep the data inside and keep the agents inside. Above the model he wants a rule layer, because probabilistic guardrails can be talked past, and a self-driving car that avoids the wall 99.9 percent of the time is not what you want. The rest is about their limits. Finding a bug in a hardware or software description is in general an NP-complete problem, so he pairs formal proof engines with models, and he is firm that building these systems is a software engineering job.

Key takeaways

  • The shift he names is from bring your own data to bring your own agents. Under bring your own data, he says, people had to understand the data internally in corporations. With agentic flows encapsulating the data layers, you can ask for the agent instead: rather than give me the raw data of what your machine is doing, give me the points where you think there are anomalies and I will interpret those

  • His example of guardrails being talked past comes from the news, a week or two before recording. He says someone posted that at DEF CON, last week or the week before, they were able to infiltrate Microsoft Copilot using prompt injection and bypass its guardrails, and says that because these are probabilistic interpretations of text it is very easy to bypass those systems no matter how much you try to secure them

  • The perimeter is the part he thinks is under-discussed. He says that with MCP or distributed agents you are shipping confidential data to entities outside your security perimeter, authorizing them and trusting them with your most precious data, and that you do not know whether the company on the other side has the same level of security you do

  • His advice for anything that is not a toy application: keep the data inside and keep the agents inside. He calls that the most advisable solution right now for multi-agent systems, and describes the alternative as one of the open problems distributed multi-agent systems currently have

  • The first question he would have a board ask is whether the data is sanitized. With the advance of cloud techniques, he says, companies started dropping or saving everything, so instead of a data lake they created a data dump, and agents now scan data that was only ever meant to be temporary, some of it conflicting and some obsolete because data is temporal

  • The second board question is what risks you are willing to take. He is explicit that he is not saying do not use multi-agent systems or do not save the data, but that everything has a risk and a return, and that for a toy example on non-confidential data it is fine to assume the risk

  • He wants the AI strategy and the security strategy presented as one thing. Not the AI strategy for the company, he says, but the AI strategy together with the security strategy, because with security comes risks and the judgment has to be made per application

  • His example of the judgment going missing is financial auditing. Public companies usually run those audits in closed rooms where people sometimes cannot even bring a cell phone inside, he says, and he has now heard of people saying a multi-agent system can do the financial auditing for them

  • Sending that same audit outside the security perimeter is where he sees a contradiction. People are saying it is fine to send financial auditing out because the systems are safe, and he thinks there is a discrepancy on that which people need to analyze. The third question he would have a board ask follows immediately: what are the unknown applications that could generate the greatest profit using AI

  • Most workflows in corporations have never been documented, which is where he thinks the unknown applications hide. His example is an email from one person to another that carries importance because it is role-playing, where a reply that does not come in time can cost revenue or an opportunity, and he says interactions like that could be processed and automated

  • His analogy for what automation does to human attention is self-driving. He says that once you turn it on, even with your hands on the wheel, your attention span drops to 10 to 20 percent, and that the same thing happens when an AI takes over a decision-making role in a corporation

  • The problem he says agent teams actually spend their time on is not building. He joked on LinkedIn the day of recording that most of the problem with agents is not developing the agents or the infrastructure, it is explaining to upper management why hallucinations happen and trying to reduce them

  • Of his three board questions, the one he thinks reveals the biggest blind spot is the data. He says he wrote in 2022, before or around the time ChatGPT came out, that his next job would be to fix the data problem in corporations, and that people do not realize LLMs and agents cannot fix bad data because they rely on the data being correct

  • His illustration of conflicting data is an F-16 cockpit. Ask a multi-agent system to show you where the instruments are and you do not know whether you get the F-16A, which he thinks was released at the end of the 1970s and had analog instruments, or the latest version with digital ones. Depending on how you fine-tune the question, he says, you may get a different answer each time

  • The first thing he builds is an annotation layer over every piece of data going in. He says he creates an infrastructure to clean and analyze the data first, and describes needing an annotation at the meta level for every single piece of data ingested into a multi-agent system

  • Above the annotation layer he puts a rule layer, and the standard he holds it to is 100 percent. If a self-driving car faces a wall, he says, you do not want it to avoid the wall 99.9 percent of the time, you want 100 percent, which means a rule layer above what the machine learning is doing to make sure certain laws are observed for the business operation

  • Asked what frameworks exist for the rule layer, he says you mostly build them by hand. There are starting to appear, he says, but most of the time you need to create those by hand, and it goes beyond guardrails because it interacts with the business layer. Pressed, he adds knowledge graphs: rules and knowledge graphs on top of the agents or LLMs

  • His test for how to architect an agent system is what happens when you give it the wrong question. He contrasts deep research, where a swarm searches the web, writes code and runs it and a wrong result is tolerable because something else checks it, with AI workflows, which need more structure and where an algorithm may solve the problem better than an LLM

  • Finding a bug is NP-complete, which he says puts it out of reach of current LLMs. He ties his own PhD work and two companies he worked at to formal verification, and says finding a bug in a hardware or software description is in general an NP-complete problem requiring exponential time or space, so there is no way the current architecture of LLMs can solve it in general

  • What he does instead is pair a formal proof engine with a model, each doing what it knows best. For generating tests against a legacy codebase, hitting a given line of code is the NP-complete part, so the formal engine works out how to sensitize the code and passes that to the LLM. He says he tested GPT, Anthropic and all the public and private models, and as one function grows more complex they stop being able to solve it

  • He puts a number on where models give up: functions of 400 to 500 lines. For a three-line function it is easy, he says, but on a function of 400 or 500 lines he would say they never get past the first few lines of code

  • LLM security, he jokes, is the easy problem of the whole AI arena right now. The hard one, he says, is that once you send your data out you have to open the floodgates of hell to send it there, which is why he thinks people will need to worry about the security of multi-agent systems more and more

  • He does not think hallucination is always a defect. He describes telling a chief executive earlier that year that hallucination is not necessarily a bad thing, and gives naming a new product spanning two areas, with reasons why the name is good, as a case where you want the creativity

  • His staged advice for an executive early in the journey starts with talking to your data. Start by talking to your data and creating a few scenarios for it, he says, then move to AI workflows or deep research, then to multi-agent systems and integrating them. He notes that even an HR letter sent to a public model can create data privacy problems

  • He says he presented recently at MIT, where the framing is that the world is being prepared for a trillion agents rather than a billion. With billions of people, he says, a trillion agents means 1,000 agents working for each person, one of which could be a personal assistant, and he imagines his assistant negotiating calendars with Christina’s the next time they speak

  • His sharpest instruction is that this is not an LLM job. Building these systems, he told a research department recently, is a software engineering job, so do not disregard the algorithm-based pieces you need. His illustration is a RAG demo he was shown: asked why he should buy the competition instead, the system answered the question

  • He names two taboos he thinks the industry is keeping quiet. People are not talking enough about the risks and try to put them under the carpet, especially in multi-agent systems; and people claim LLMs and agents can do things that actually need formal proofs or neurosymbolic tools. He says a logical layer on top of agents is starting to be accepted more and more

About Claudionor Coelho Jr

Claudionor Coelho Jr was chief AI officer at Zscaler at the time of this conversation, and has spent his career building AI inside companies rather than around it. He took a PhD at Stanford in a technique now used to build AI acceleration, worked in formal verification at Jasper Design Automation, which Cadence Design Systems acquired, and then helped build Brazil’s first deep learning company, Kunumi. His own account is that he was assisting a colleague with that colleague’s company and told him deep learning was the coming wave. Kunumi was acquired in 2024 by Bradesco, the country’s second-largest bank. At Google he was on the Pixel team building AI acceleration for video codecs, and the quantization and model compression work he did there was used by CERN in its research on subatomic particles and made the cover of Nature Machine Intelligence in 2021. He has also been chief AI officer at Advantest and led AI Labs at Palo Alto Networks, and has advised global leaders through the World Economic Forum. He has since moved to Majestic Labs, the AI infrastructure startup that came out of stealth in November 2025.

 

In this episode

00:42 Welcome
01:00 Who he is: chief AI officer at Zscaler, and deep learning research at Google
01:15 A Stanford PhD, neurosymbolic AI, and secure multi-agent systems
01:48 An early pioneer, and the first deep learning company in Brazil
02:07 Selling the company to Cadence, and building Kunumi
03:36 The Pixel team, video codecs, and CERN
04:17 The cover of Nature Machine Intelligence
04:25 From bring your own data to bring your own agents
04:51 What bring your own data actually meant
05:26 Agents that add an interpretation layer, not just the data
05:55 Securing agents, guardrails, and exfiltration
06:12 The DEF CON prompt injection against Microsoft Copilot
06:27 Why probabilistic analysis of text is easy to bypass
06:46 Shipping confidential data outside your security perimeter
07:20 Keep the data inside and keep the agents inside
07:44 Advising a board: the top three questions
08:02 Question one, is your data sanitized: the data dump
08:44 Question two, what risks are you willing to take
09:23 The AI strategy together with the security strategy
09:32 Financial auditing, closed rooms, and the discrepancy
09:55 Question three, the unknown applications that could generate the most profit
10:25 Workflows in corporations that were never documented
11:16 Leaders who will not raise their hand in front of the board
12:14 LLMs are a piece of technology, not the end goal
12:33 Self-driving, and attention span dropping to 10 to 20 percent
12:57 The real work is explaining hallucinations to management
13:33 Which board question reveals the biggest blind spot
13:44 The data, and the article he wrote in 2022
13:59 LLMs and agents cannot fix bad data
14:22 Steve Jones on data as oil, and consumption at the wellhead
15:09 Rethinking how applications are built at all
15:29 The F-16 cockpit, and data that conflicts with itself
16:45 Concrete examples, and why his architecture mattered
16:53 An annotation at the meta level for every piece of data
17:17 A rule layer, and why 99.9 percent is not good enough
17:57 Frameworks for the rule layer, mostly built by hand
18:15 Rules and knowledge graphs on top of the agents
18:31 The coding agent that deleted a database and faked the record
18:56 Small agents, complex agents, or swarms
19:40 What happens if you give it the wrong question
19:48 Deep research, and when a wrong answer is tolerable
20:18 AI workflows, and where an algorithm beats an LLM
20:40 Finding a bug is an NP-complete problem
21:08 Formal proof and an LLM cooperating, in his GitHub
21:28 Tools and algorithms far more efficient than LLMs
22:57 LLMs changing the interface, first typing, then audio
23:52 Good at text, less good at numbers: strawberry and Burberry
24:18 Both worlds living together, algorithms and LLMs
24:49 Whether enterprises overestimate their security readiness
24:58 Security of agents as taboo, and vibe coding as a live manual
25:21 Save the directory, diff everything, edit it back
26:06 TkDiff, and undoing what was generated
26:29 Outsourcing your understanding of the code to an LLM
26:48 Where neurosymbolic AI fits as LLMs hit their limits
27:34 Generating tests for legacy code, and where GPT and Anthropic stop
27:56 Shallow functions that fit the token space, and pairing formal proof with the model
28:20 Neurosymbolic as a knowledge graph layer feeding the model
29:03 Functions of 400 and 500 lines
29:24 Amazon using neurosymbolic to validate generated code
30:13 Three years out, and the multi-agent system he jokes he built in 2016
30:58 LLM security is the easy problem
31:33 Where hallucination is the feature, not the defect
32:33 What falling behind will cost, three years from now
33:16 Grounding, and what a fully AI-operationalized business does
33:34 Finding where the competition is opening stores
34:27 Guidance for executives early in the journey
34:44 Start by talking to your data
35:06 MIT, and preparing for a trillion agents rather than a billion
35:53 His personal assistant negotiating with yours
36:18 Two World Economic Forum reports he worked on
37:05 Section AI as a place to start
37:46 Andrew Ng’s courses, and the universities running programs
38:02 Not an LLM job, a software engineering job
38:31 The RAG demo that recommended the competition
39:15 His defining leadership edge
39:41 Be humble, because nobody leads in everything
40:04 Do not be afraid of it, but do it consciously
40:29 The two taboos, and the logical layer above the agents
41:10 Wrap-up

In Claudionor’s words

“Keep the data inside and keep the agents inside. I think that’s the most advisable solution right now for multi-agent systems.”

— Claudionor Coelho   (07:20)

“I joke saying LLM security is the easy problem of the whole AI arena right now. But the problem of multi-agent systems is that once you send your data out, you have to open the floodgates of hell to send your- ... data there.”

— Claudionor Coelho   (30:58)

“We are basically shipping our confidential data to those entities that are outside our security perimeter, and we are authorizing them and trusting them with our most precious data.”

— Claudionor Coelho   (06:46)

“So instead of being a data lake, we basically create a data dump.”

— Claudionor Coelho   (08:02)

“LLMs and agents cannot fix bad data. They rely on the data to be correct.”

— Claudionor Coelho   (13:59)

“You don’t want the full self-driving to not hit the wall with 99.9%. You want it to not hit the wall 100% of the time.”

— Claudionor Coelho   (17:17)

“Most of the problems with agents is not developing the agents or the infrastructure, it is explaining to upper management why hallucinations happen all the time.”

— Claudionor Coelho   (12:57)

“There is no way with the current architecture of LLMs that you can possibly believe that they can solve an NP-complete problem, okay, in general.”

— Claudionor Coelho   (20:40)

“Building those systems, it’s not an LLM job. It’s a software engineering job.”

— Claudionor Coelho   (38:02)

“People are not talking too much about the risks. They try to put under the carpet the risks, and especially in multi-agent systems.”

— Claudionor Coelho   (40:29)

 

Resources

Claudionor Coelho Jr

  • Claudionor Coelho Jr on LinkedIn: His profile, and the one thing he offers by name when asked what listeners should follow. It carries the LinkedIn posts he refers to at 12:57 and 13:44, and at 26:06 he says he is going to write another one in the next few days

  • Zscaler: Where he was chief AI officer at the time of this conversation. Its announcement of his appointment is dated 6 November 2023

The two World Economic Forum reports he worked on

Ideas and terms discussed

  • Bring your own agents: His reframing of the cloud-era bring your own data, and the shift he opens with. Under bring your own data, corporations still had to understand the data internally. Once agentic flows encapsulate the data layers, the ask changes: instead of the raw machine data, you request the points the other side thinks are anomalous and interpret only those. The agent carries an interpretation layer, not just the data

  • The security perimeter problem: The center of his argument. With MCP or distributed agents you are sending confidential data to entities outside your own perimeter, authorizing them and trusting them with your most precious data, without knowing whether they hold your security standard. He calls this one of the open problems distributed multi-agent systems currently have, and his working answer is to keep both the data and the agents inside for anything that is not a toy application

  • The logical layer: What he wants above the model, and the thing he says is starting to be accepted. Probabilistic interpretation of text can be talked past, which is why guardrails alone fail, so he adds a rule layer that encodes what must be true for the business operation, plus knowledge graphs. His standard for it is absolute rather than statistical: a self-driving car should not hit the wall 100 percent of the time, not 99.9 percent. He says frameworks for this are starting to appear but that most of the time you build them by hand

  • The data dump: His name for what the advance of cloud techniques produced. Once companies started dropping or saving everything, what was meant to be a data lake became a dump: conflicting records, and records that have gone obsolete because data is temporal. Agents now scan all of it. This is why, of his three board questions, he thinks the data one reveals the biggest blind spot

  • The three questions for a board: Is your data sanitized. What risks are you willing to take, given that everything has a risk and a return and a toy application on non-confidential data may be worth it. And what are the unknown applications that could generate the greatest profit, on the grounds that most corporate workflows have never been documented

  • NP-complete, and why it bounds LLMs: The technical spine of his argument about what to build and what not to. Finding a bug in a hardware or software description is in general an NP-complete problem, needing exponential time or space, and he says there is no way the current architecture of LLMs solves that in general. He ties his PhD work and two acquired companies he worked at to formal verification, so this is the ground he knows best

  • Formal proof engines paired with models: His alternative to asking a model to do the impossible. For generating tests over a legacy codebase, working out how to hit a given line is the NP-complete part, so a formal proof engine does that and hands the result to the LLM. He says he tried GPT, Anthropic and all the public and private models and they fail as a single function grows, and he would say they never get past the first few lines of a 400 or 500 line function

  • Deep research versus AI workflows: The distinction he uses to decide how much structure an agent system needs. Deep research is a swarm that searches, writes code and runs it, and is fine where a wrong answer is tolerable because something downstream checks it. An AI workflow needs more structure, and inside that structure an existing algorithm may beat an LLM, which matters most where you cannot afford hallucination

  • Hallucination as a feature: His counter to the assumption that hallucination is always a defect. When a model is asked to name a new product spanning two areas and to give reasons the name is good, the creativity is the point. He describes making this argument to a chief executive earlier the same year

  • The two taboos: What he says the industry keeps quiet. People are not talking enough about the risks and try to put them under the carpet, particularly for multi-agent systems. And people claim LLMs and agents can do work that actually needs formal proofs or neurosymbolic tools

Named on air

  • Advantest: The company he means at 13:44, where he says he was chief AI officer and dates the LinkedIn article he wrote about the data problem to 2022. The name in the audio is garbled; Advantest comes from Zscaler’s announcement of his appointment

  • Kunumi and Bradesco: The Brazilian deep learning company he helped build, which he says was acquired in 2024, the year before this conversation, by Bradesco, the second-largest bank in the country. He describes himself as assisting a colleague with that colleague’s company rather than founding it

  • Jasper Design Automation and Cadence Design Systems: The formal verification company he worked at and the company that acquired it, where he was already using AI to fine-tune NP-complete heuristics

  • CERN and Nature Machine Intelligence: The quantization and model compression work from his time on Google’s Pixel team was used in CERN’s research on subatomic particles, and he says it was the cover of Nature Machine Intelligence when the paper was published in 2021. STMicroelectronics, he says, built a product from it

  • Synopsys: Where he jokes that he built his first multi-agent system in 2016, to translate users’ questions into scans of device logs on a complex hardware system

  • DEF CON: The conference where, he says, someone was able to infiltrate Microsoft Copilot by prompt injection and bypass its guardrails, last week or the week before. He is relaying a news post he read rather than a demonstration he saw

  • Amazon: He says he thinks Amazon recently posted a blog or a paper on using neurosymbolic methods to validate generated code, on the grounds that only a formal proof engine can say whether code is correct

  • Andrew Ng’s deep learning courses: The learning resource he recommends for people starting out, at 37:46, and he thinks it carries a course aimed at executives

  • Section AI: Christina’s recommendation rather than his, given at 37:05: three free classes a month and a program you can bring inside an enterprise. He is asked for something similar and answers with Andrew Ng’s courses instead

  • Steve Jones at Capgemini: Christina’s reference at 14:22, on data being like oil because it has to be refined, and on AI moving consumption of the data to the wellhead. Steve Jones is the guest on episode 11

  • VentureBeat: An article he says made the same point he does about finding bugs in code. He does not give a title or a date

 

Frequently Asked Questions

 
 
 
 
 
 
 
 
 
 
 
Previous
Previous

Only Content That Clears Every Agent Gets Monetized

Next
Next

Extend Data Governance Into Models, Then Into Agents