Trusting Autonomous AI Agents with Business Data Presented by Snowflake | Utilizing AI Episode 38

As AI becomes autonomous, trust is becoming a foundational consideration. In this episode of "Utilizing AI," Christian Kleinerman, EVP of product at Snowflake, and Nick Patience, AI platforms practice lead at the Futurum Group, address the power that correctness and confidence bring to agentic applications. Welcome to "Utilizing AI," the podcast focused on practical applications of artificial intelligence and part of the Futurum Group Podcast Network.

Every Wednesday, we explore news and use cases of the ways in which AI is transforming enterprise IT and the industries it serves. I'm your host, Steven Foskett, president of the Tech Field Day business unit here at the Futurum Group. Before we dive into this episode, which is brought to you by Snowflake, let's meet who's on the panel today.

Hi, I'm Christian Kleinerman. I lead the product team at Snowflake, and I spend lots of time these days ensuring organizations can leverage their data to improve productivity, rethink business processes, and overall, improve their business outcomes. Very excited to be here, Steven.

And, hi, I'm Nick Patience. I'm the AI platforms practice lead here at Futurum. Nick and I are discussing agents, AI, the emergence of AI applications, and the whole world of trust and context on this podcast regularly.

I also want to call attention to an episode that we just published on the July 30th of our sister podcast, "Agents of Dev," where we spoke with Snowflake about some of the ways in which trust and agentic AI are impacting security. And today we're going to continue that conversation. What we'd like to talk about here is the importance of trust and the importance of building applications that can be trusted to act autonomously, because whether we're ready or not, autonomous agents are coming.

So let's kick off the conversation, Christian. Talk to me a little bit about how you see this emerging world of agentic AI and the need for trust. Yeah, I obsess, and I spend a lot of time thinking about the word trust, and not just the word, but the concept.

I think about what it means for two people to trust each other, and you'll realize that it's something that happens over time. You don't come to be 100% trusting of someone. No, it's just a set of actions that, over time, give you a consistency and predictability, so much to the point that you are willing to depend.

And trust takes some time to get built. Trust can be destroyed super quick. And I think the same process happens with technology in general.

But now where pretty much every organization in somewhere in the spectrum in the process of understanding how much can they trust AI and what types of operations they can delegate to AI. In the 12 to 18 months before where we are right now, I think there was a lot of questions on can I trust AI to give me answers, give me insights on either my data or my business or my operations? And what we see right now is a transition towards, I would like AI to start taking actions and modifying systems, making decisions on my behalf.

But every organization is being careful on the what types of decisions, what type of verification you have, what type of human in the loop there is, because that trust needs to be built over time. And something that we focus on at Snowflake since the very beginning is about ensuring that our customers can trust our technology, that they can entrust us with their data. And we've transitioned in the last couple of years to ensure that they can entrust us with their AI-driven processes so that they can answer questions, they can take actions, but they can do that with confidence that security, privacy, and even correctness are in place.

And Christian, in that context, is the decision to allow an agent to take action, that's the kind of governance decision, isn't it? And how do you, who in your experience, I know we're early, but in the organization sort of decides what counts as an action serious enough to need some sort of authorization versus things that just will happen autonomously? Yeah.

So, on the first part, Nick, governance for sure is the broad set of actions that help you sort of guide the system to behave according to your guardrails or company policies or regulatory requirements. And so for sure, this is a big part of governance. And I would say companies are in different states of trusting AI.

Some of them are still early on in just being able to answer questions. Much has been said about customer experience agents, and if you look at the progression from what happened, I don't know, a year or two years ago, most people were starting with internal knowledge bases. " Now you're starting to see similar actions on or similar patterns on taking actions, making decisions.

I'll give you an example of a policy that we rolled out in Snowflake, which was We can have agents send email on behalf of different employees, whoever created the agent. Internally, it is okay to just send the email directly to a Snowflake recipient. But if it's going to an external party, whether it's a customer or partner, we're requiring a human-in-the-loop verification so that someone is reading it, making sure that what is being said is correct, and then you get to press send.

I think for pretty much every business process that is getting augmented or improved with AI, there's that type of calibration going on. Where do I trust and I have confidence that AI will act in the way that I expect it to? And as we get more comfortable, and then sometimes it requires a feedback loop with AI and say, "Okay, don't do this, do that," taking into account this, I think we will all be delegating more and more to AI.

To the specific question, I've seen companies that are making really important decisions, paying invoices automatically with AI, and I've seen others that are barely getting comfortable with, "I can get a sum total of invoices from last week," and just for read-only operations. So I would say most organizations are somewhere in that journey, but I think we're all headed towards let's get confidence and trust in the technology so we can get the productivity benefits that AI promises. Yeah, that's a really important question, and I should point out, too, that there's different aspects of trust here, of course.

There's organizational trust in applications. Then there's individual trust among the employees of that organization, the management team, and of course, there's the question of customer trust as well. How are you seeing that play out with your customers?

I love that you say that, Steven, because trust is definitely multifaceted. And there are all of those dimensions, for lack of a better word, that you mentioned, which is the is my data and analytics and AI team trusting of the technology that they're using? Do they have the right policies to decide who has access to what data?

So that's one vector. That implies or informs what type of self-service analytics, self-service agentic decisions can you make available to the rest of the organization, and then the organization has to trust the technology. Similar with the customer aspect that you mentioned.

Customers ask us all the time, how is Snowflake different than the alternatives? And I frequently say trust. Actually, the three things we say is Snowflake is easy, Snowflake is connected, Snowflake provides trust.

But the trust thing is so big, and it's not what I mentioned on security and privacy. But interestingly enough, these days it also implies things like correctness of the answers. I was telling a customer a couple of days ago that I didn't think that in 2026 I would be communicating that a key advantage of Snowflake is correctness of answers.

And why do I say that? Because AI has this amazing ability to reason and process lots of data and give you answers, and it'll almost always give you a confident-sounding answer, whether it's right or not. And one of the things that we have focused in Snowflake with what we do with Cortex Agent, with what we do with Cowork is if we don't have confidence in the answer, it's better to say, "I don't know.

I don't have enough information to answer this question," as opposed to still be very confident and go and say something that may be completely decoupled from reality. So those are all the facets of trust, and I think correctness and dependability of answers, but also taking decisions is an important part, and we take trust as a core capability, core differentiator of what we do. So Christian, when organizations start treating agents a lot like employees, with their own identities, their own permissions, audit trails, and all those kinds of things, that's quite a conceptual shift from what we've had in the way we treat software before.

Do you think enterprises are ready in some ways to hold an agent, and by extension, whoever built it, accountable the way they would for a person? It's a very interesting question, Nick, because in some organizations and in some use cases, yes, you can say, "Here is an agent. " We have Snowflake customers that have that.

They even give them a name, and they talk about the agent's name as a team member. And they add it to a Slack channel, and it's one of us. And that has been working well for a number of organizations.

But something interesting that has emerged in the, I don't know, maybe last six months, is the need for agents to operate on behalf of one of us and yet not be fully one and the same with each one of us. Let me give you an example. If I were to create an agent and I give it a completely different identity, it's like a separate employee, it stands to reason that that agent would have its own email inbox and its own document repository.

But oftentimes, what most of us need in organizations is an agent to operate on my email, my documents, and make decisions about what I need. So the need for agent identity has emerged, and it has emerged as it can share identity with the creator of the agent. So in my example, I can say it's my agent, and it has access to all my documents and my email.

But also there's the need for restrictions and policies where I can say, "Okay, this agent has access to all my email, but hopefully cannot go and delete all my email," or something like that. And we've introduced exactly those concepts of Snowflake. We have an agent identity concept.

We have a set of restrictions on what agents can do. So, for example, I could do something like, this agent can operate on my behalf. It has access to data and reports that I do.

It has access to my inbox, but I can also say, "You're only allowed to read data. You're not allowed to modify, or you're allowed to modify but not delete," something like that. And it's a very interesting dilemma because we all think of agents should be separate employees, but it's sort of separate employees that are allowed to act on my behalf on a regular basis.

And there's a lot of innovation, both at Snowflake and in the industry, around agent identity, agent policies, and we're excited to be at the forefront of this. It is interesting because that is how I'm seeing people treating agents. That's how I think that Futurum is treating them as well, is not 100% as employees, but essentially as research assistants, as people who help us out in various ways.

That's certainly how I treat and address my agents. But to your point, I don't have a separate inbox. I don't have an identity.

I'm very careful not to anthropomorphize them too far, so they don't have names . Though I do talk to them as if they do have that. But what I find is, again, it's one of those sort of it is as it does questions where the more satisfied I am with the answers, the more I develop trust.

And on the contrary to your point as well, the less satisfied I am with the answers and the more often it makes mistakes, the less satisfied I am and the less trusting I am. And I find that that can sort of poison the whole relationship, if you want to pardon that phrase. How can we ensure that we're getting quality from our agents so that we can build that level of trust?

Yeah. Super important, and what you say, Steven, aligns with my statement earlier that trust needs to be built over time. We have conviction at Snowflake that the best way to get value of agents, at least in the enterprise, which is an important qualification, is by having a sound data strategy.

We've been saying it now for a couple of years, which is there is no AI strategy without data strategy. And why is that? Because the AI models, they're incredibly capable, but what they can do and the results that they provide and the insight that they provide is a function of the context that you make available to those agents.

And what we have been helping organizations do since the 12 years that we've had our product in market is organize your data, eliminate silos, and have sound security policies on who has access to see what data or with what fidelity of data. In the last several years, it's not just do you have access to a Social Security column or not? It's maybe you have access to the last four because your job requires that type of verification, or maybe nobody has.

And having that deep foundation, data is broadly accessible, silos are torn down, and permissions are properly configured. That is what enables now an AI agent to come and say, "I can help you answer questions. I can help you take actions.

" And you can sort of sleep well at night that the agent is not going to leak information to the wrong constituent, that the agent is not going to give you incorrect answers, all of that. So data strategy and governed data, I think is the most important prerequisite to unlocking and unleashing the value of AI in the enterprise. Yeah.

It all starts at the data layer, I guess, and Snowflake knows more about that than most companies. So pushing it a little bit further, if I can. So when agents start talking to agents and they start talking across companies, so across boundaries, have you put any thought into, I'm sure you have, but into where the trust boundaries lie?

And there's not a kind of standard for this yet, really, is there? But is there a way for an agent to vouch for another agent or anything like that? This is, again, pushing the cutting edge a little bit, but it's interesting to see perhaps which direction we may be going.

Yeah. Great topic. I don't think we've gotten into agents vouching for other agents, but what is very clear as an enterprise need is visibility across my enterprise on what are the agents doing, and most importantly, how are they interacting with my business systems?

I mentioned a few minutes ago that enterprise data and enterprise context is a key input into AI models being useful in the enterprise. The other aspects, especially as you think about agents making decisions and taking actions, is does it have access to my email system, my ERP system, my HR system, and can modify it? And being able to see those interactions matters a lot The last thing you want is a purchase order got open, or got paid, or got closed by an agent and there's no visibility or trace of those operations.

We recently announced the acquisition of a company called Natoma, which provides an MCP gateway that has been now folded into something that we have recently launched. It's called Cortex AI Gateway, and the purpose is exactly to provide that central infrastructure that gives organizations visibility into which tools are being called by which agent. And A, you have visibility and auditability, which is already a lot of value.

But also, then you can have policies and governance, and that's when you have the example on send emails, don't send emails, modify records, et cetera. So it is very important, I think that because many vendors, many organizations are providing some form of agentic capabilities, we want to make sure that our customers can have enterprise-wide visibility and governance of those activities. We're very excited about what we're doing with the Cortex AI Gateway.

And I was at Snowflake Summit in the summer. Well, it is still summer, but in June. And I think you said something along the lines of organizations don't have one platform, one vendor, and I thought it was quite refreshing from a data platforms company to acknowledge that not everything is going to end up in Snowflake.

To your earlier point, though, so given that, and I think you're obviously correct, to your earlier point about the data governance layer being so crucial, what role do you see for Snowflake as either as a governance plane, control plane, or something like that for data that's not necessarily stored within Snowflake? Yeah. We have fully acknowledged that enterprises' realities are complex.

They have multiple technologies. They may even want to have multiple technologies. I understand that putting all the eggs in one basket is a risky proposition, and that you may want to either hedge for a renewal or have a business continuity strategy.

So I think the reality of are there multiple vendors in our enterprise stack, 100% true. Our commitment to our customers is we're 100% aligned and motivated to have Snowflake be interoperable, and it's interoperable at the data level, interoperable at the catalog level. A topic that is very timely these days is semantics.

What really makes AI be able to provide those correct answers and those correct actions is semantic understanding, ontological understanding, business definition understanding. And not only we have provided a number of capabilities in Snowflake to capture those semantics, but because we want to be able to ensure that no customer of ours feels locked in and know that we're interoperable, we started this open semantic interchange working group. It has recently graduated to an Apache project called Apache Ozzy, and it helps semantics be interoperable between different platforms and systems.

And that is my answer to your question, Nick, which is we are committed to interop, but we want to provide the best catalog and the best governance with the Horizon catalog, and we want to provide very rich semantics, but also make them interoperable. So yes, we'll help customers embrace a heterogeneous environment, but to the extent possible, we want to help them manage the broader data and AI estate. It's interesting because semantics is essentially a synonym for context, and what you're providing there is you're giving the model context to understand the data.

And now, when people talk about context with AI models, a lot of the time what they mean is sort of the prompting aspect of context. I need you to understand that you're a helpful assistant and you are able to use this tool or that tool. But too often, what they don't give the model is context for the data itself.

Where did this come from? What is this? How should I process this?

And what level of trust should I have in this? Can you talk a little bit more about that aspect of semantic and connect that as well with this whole aspect of trusting in the data? Super important, Steven.

We actually, at the conference, Nick, you were there, we introduced something we call Horizon Context. So it's exactly what you say, Steven, context. And a key aspect of that context is the ability to capture semantics on the data.

Semantics can be either metrics or metric relationships between what does unit economics and revenue mean in my organization. There's something also very important that not all definitions are the same to everyone. " He likely is thinking about GAAP revenue.

When I say revenue, I mostly want to know how much consumption happened in the Snowflake service the day before. I care a little bit less about some GAAP adjustments and accounting adjustments. And being able to capture that richness of definition, richness of semantics is not only very important, but is one of the things that helps us with that trust that we started the conversation with.

With Snowflake, you can create an agent, or you can create multiple agents. Each agent can have associated semantics. So you can say, in this context, the word revenue usually refers to this set of data sets, and this is how you answer those questions.

And that's what truly leads to the Frankly, very impressive results we're seeing from our customers where they can benchmark Snowflake against other solutions, and oftentimes they tell us just the quality of answers, the correctness of the answers stands out, and it's because of semantics. So in that context, does it follow therefore that the data model within the organization, the schemas, the semantic definitions, the lineage, that has to be treated as part of this kind of trust infrastructure, not just as data plumbing? And if so, well, yeah, let's just go with that and see what you think.

Effectively, data teams used to do this in some ways. If you look at how we operated 10, 15, 20 years ago, a data team would come and create some definitions in a BI tool, and when the dashboards were made available to the rest of the organization, there was some implicit trust built into those dashboards. Right?

The same thing is happening now. So you can have, again, a data or an AI team go and specify the semantics for a data set. " We've even introduced the concept of verified answers.

There are some instances where there are some questions that have only one well-known answer. " There's only one answer. And in that semantic model, we provide the capability for the curator of the semantic model to say, "These are well-known questions.

" And again, all of this contributes to the trust, and this is the journey that we're working with our customers to get on. I have confidence that the technology is pretty far along, and it's the process of companies, organizations getting comfortable with how much they can delegate, how much they can depend on AI, and I think we're going to see amazing productivity enhancements in the future. Do you think we're going to get to a future state where, building on the kind of data bit and the agent bit, where a data model itself or database of any kind refuses to give access to agents whose identity has not been verified?

I guess, well, maybe we're already there. Are we already at that stage? That exists today, and it goes back to you need to have, I spoke about a sound data fabric and a data governance.

Your data system hopefully today already says no if I don't know who you are. So yeah. And by the way, the question is very interesting from the perspective that the same foundation applies to agents.

If someone is saying, "I want to go and start implementing AI," and they do it by starting from scratch, ooh, they have to rebuild all of that. If they build on top of the foundation that they may have been building with Snowflake, now either the agent has an identity that has access or not, and if not, there's no access. That is the beauty of building on top of the foundation that we've been helping organizations build for years.

Yeah. So we're coming full circle, aren't we, from what we were talking about at the beginning. That all makes sense.

And I think you've always been quite refreshing and honest also about how the models are not the application. The models are not essentially where all the great value comes from, is it? It's the data layer and then the application's on top.

But obviously, yeah, that's where the value gets created. So, I don't know if your customers you talk to are kind of still thinking models are everything, or do you think they've all moved beyond that by now? I think there's a massive shift away from that sentiment.

And I will be clear, models are phenomenal. The ability to reason, the ability to consume large amounts of data and reason, and analyze, that's amazing. But they're only as good as the data that they get fed or given.

I like to say AI models, without the context that we talked about, without the enterprise data, it's public web information, which is super useful. That's what ChatGPT does. Super useful, but in an enterprise context, it's not as interesting.

What makes it really shine is the data. And I think there's a big shift right now in organizations and the realization that the model is not what provides AI, it's the semantics that we just talked about, it's the data that you plug in, it's the MCP servers that you attach to it. That is what truly leads to AI being successful in an enterprise.

And the other thing that is probably front and center, you're probably hearing from organizations of all sizes is using the best model for every single task is not ideal, is not cost-effective. And there's a lot of emphasis on what is the right model for what task. And that includes not only a family of models from any of the frontier labs, a partner of ours, OpenAI and Anthropic, but also there's an increasing amount of pressure on can you leverage open weights models, which come with lower cost and oftentimes more efficiency because they're smarter.

So that is an acknowledgement of what you're saying, Nick The model is becoming less front and center. What matters is the hardness, the control plane that brings those models together with data and with enterprise systems. Yeah, it's interesting because I think people make the mistake sometimes of thinking that these large models have all the answers baked into them, but they absolutely do not.

The training of the model is a way to develop the model into something that can effectively use tools and effectively communicate. I've been saying here on "Utilizing AI" for a long time that an LLM is really a user interface. It's akin to a graphical user interface or a command line interface or any of these things that we've been using in IT for so long, but it's one that has some information baked into it, and so we can fool ourselves into thinking sometimes that it has the answers.

But that's not the best use of it. The best use of an LLM is to better interface a person, whether that's a customer, an executive, or an employee, with the data that that person needs to access. And I think everything that you're saying really goes to that.

Nick, let me throw it to you. I know that you've focused on this area. Give us a summary.

What do you think of this answer about AI and trust and context? Well, I think the organizations I speak to that, obviously, trust is the biggest barrier to scaling in some ways. There's obviously infrastructure issues in certain companies.

" Sometimes it's an amorphous thing. But as they start to think about agents in the same way they've been thinking about employees over the decades, I think that gives them a very good framework, and what we've been talking here kind of puts that into perspective and makes it real. I also think I totally agree with Cristian about the, it's a multi-modal world we're going to be living in.

There's going to be commercial models, there's going to be open weight models, there's going to be models on-prem, there's going to be models in clouds, and all those kinds of things. So I think it's that combination of models to data to agents all wrapped up with trust is the way we're going to be going. Yeah.

I think I would summarize that the core thesis for Snowflake as we're working to help every organization be able to leverage AI, but do so with peace of mind, sleeping well at night on topics like security and correctness and all these things that we discussed about trust. The mental model that we have is you need, of course, AI models. That's a big part of it.

You need the data, and that's what we help with that foundation. You need access to enterprise systems. I mentioned email and CRM and all that.

And then you need an orchestrator, which is the control plane that helps bind all these elements together. That's what at Snowflake we deliver with Co-Work and Coco, one for knowledge workers, the other one for builders, and that is what brings the value to the enterprise. And trust is front and center, and we're very excited about our ability to help our customers help get the value of AI.

Yeah, and I think that that's really where a lot of companies are focused right now, but I think that Snowflake is maybe in a better position simply because you have this incredible background of helping customers, helping enterprises with data for so long across a variety of areas, and so it basically sets you up to be able to support these AI applications as well. " Cristian, before we go, where can people connect with you and continue this conversation? Yeah.

Thank you for having me, Steven, and multiple ways. com has all the latest information on what we provide. And we're about to kick off what we call the Snowflake World Tour.

We stop on 20 something cities around the world. I'm personally going to be London, Tokyo, New York in a couple of hours, and that's the best place to go and learn next level detail on how Snowflake can help with AI. So excited to connect with a lot of your audience.

com, and in my biweekly newsletter, "Patience on AI," which is available via LinkedIn. Absolutely. Thank you very much for joining us, and thank you everyone for listening to this episode of the "Utilizing AI" podcast today, which was brought to you by Snowflake.

If you enjoyed this discussion, please subscribe on YouTube or in your favorite podcast application and consider giving us a rating and a review. This podcast was also brought to you by the analysts and experts from the Futurum Group, where insights meet AI. ai, the "Utilizing AI" YouTube channel, or the Techstrong TV app, and check out the special Snowflake episode from Agents of Dev last week.

Thanks for listening, and we'll see you next Wednesday.