Never give an AI agent an employee login

McCullus, thanks for having me. Appreciate it.

Yeah, I I was leading the Dodd Frank implementation at Bridgewater. And you know, what it really taught me is that regulatory change is only part partly legal. the law tells you what has to be true, but the real work lies in the workflows, the data and the systems that have to change so that it's true every day. And as you mentioned, I'd started as a derivatives lawyer at LinkLaders, where you advise on the rule and hand it over to someone else. And at Bridgewater, I was responsible for making that rule operate inside the firm. And I found I cared much more about that type of work than the former. And I could see banks everywhere face the same problem that Bridgewater was facing and most of them were trying to solve it with advisors who stopped at the recommendation phase. the big four are very good at at that piece of it. but they're really terrible at delivering change. So I saw an opportunity and as my background suggests, I'm I've always been entrepreneurial. So I I left to build a firm that would do the delivery work and That's what we still do today.

Yeah, I think the big gap is a know-how gap. finding subject matter experts, whether it's kind of on the regulatory front, digital transformation or AI, that's a challenge for most large institutions because they're competing globally for a limited number of resources. So I think that really speaks to what we do. Unlike the big four, we don't bring in, you know, kind of junior people and create PowerPoints. we bring in people usually with significant experience on the front lines. They many of them have come from banks or regulated institutions. And we pull them in as subject matter experts and we do the same thing on the technical side now with AI capability that we're able to source because that's our focus and you know, we can spread limited resources across multiple users of those resources and everyone benefits. So I I think that's kind of one of the big the challenges that we're meeting within those organizations.

Yeah, it's not like a quick swap or a rebuild for the bank. It's a redesign of one thing, which is who is allowed to do what. a human role is a bundle of permissions. A service officer can view records, change an address, freeze a card, adjust a limit, or issue a refund. And the bank relies on training supervision, and the limits on the speed of a person at a screen to keep the bank safe. An agent has none of those constraints and can touch thousands of customers in seconds. so a single systematic error can turn into a real catastrophe pretty quickly. but yeah, so it really comes down to what they can do. And the start the sorry, the fix starts with the mental model. An agent is a model plus a mandate, and while the bank can rent the model, it has to own the mandate. So we stop granting roles and start granting narrow mandates, one task at a time. From there, the sequence is the model proposes, policy permits. controlled service executes and the core system controls and records. so the agent really never holds the keys. They they're limited from the outset. And in practice, banks start with one high volume, low-risk journey and build control layers around it and prove it before it touches anything else. So the first journey is hard because you have to build a control layer. following journeys are usually easier because you can leverage the control layer you've already built. So that's that's kind of how we think about it. And you know, it's it's different with every bank, of course. every bank comes with you know different systems, different processes, and different quality of data. So we try to to to work around that. But you know the I think the key to it all is first building the the data, making sure that that's governed and the quality of the data is where it needs to be, and then building the control layer over it and then to put AI into production. If you haven't done that work first, it usually doesn't leave the demo phase.

Yeah, I think probably force three silences debt. experienced operators walk past it because they believe their experience has made them easy to bring bad news to. I think reality is it's it's office often the opposite. you know, the more successful a leader is, the the more it feels like his time is valuable and people don't want to waste his time, so they're less likely to you know, bring bad news into the room and expose that. So I I I think that's a real challenge. and it cost me what cost me a garrison was my own silence. I felt uneasy signing some documents that created the authority of the entity in in our banking relationships. but I was in a hurry, late for a meeting and we had assurance from from counsel that it was fine and so I signed the documents and ended up regretting it. I gave more authority to someone who shouldn't have had it than than I should have. But you know, in the time when you're you're making decisions quickly, it it feels like leadership. And so I think that's that's a a real struggle for for all people who you know come into positions where they have to make decisions quickly. It's how how Do you make sure that you're not overdelegating and and it's it's a real challenge. So we talk about that in the book. And I'd say probably the second force is force 10 systems fail at the seams. I think the problem there is most experienced people run their own function well and assume that handoffs between functions take care of themselves. And that's far from being true.

I would I I would say that there are eleven forces that if if you can recognize them, will allow you the opportunity at least to prevent things from becoming catastrophic. And we call out those eleven forces and help leaders to recognize them as they're happening and as they're going through their day-to-day. So you know, kind of the other the other takeaway and I caveat this in the book is knowing what to do and doing it are two very different things. it's a constant struggle. You have to be willing to look at bad things and not ignore them. I think the tendency of most people is to try to be optimistic and that leads to ignoring things that if you're looking at them from the right lens down the road at some point will lead to catastrophe because you know failure doesn't usually come from one bad decision, it comes from multiple decisions stacked on top of each other. So I think that's kind of the key takeaway.

Yes. Yeah, absolutely. And I think you know, wisdom and experience have a lot to do with that. you know, usually we learn the most from our failures, and it it takes time. and and I think that's why I'm inclined to, you know, bring in people with more experience because I think they have the judgment that younger people haven't had time to develop yet and that pays dividends when you're up against a regulatory deadline and you need to get things done. Knowing how to do that in large bureaucratic organizations with multiple stakeholders, having had experience doing it actually makes a big difference.

Yeah, it's I think it's changed the question banks ask. A few years ago, the question was, does AI work? And now they all have models and pilots that prove it does. So the question has really become why so few of those pilots reach production? And the answer is nearly always the data underneath, as I as I mentioned earlier. Really, a model is only r as reliable as customer and transaction data it reads. And for many banks, that data sits in fragments across systems that were designed over decades and never meant to communicate with each other. So the first work in our engagements is the foundation govern data, usually beginning with a a single unified customer file before anyone layers intelligence on top of it. And so I I think that's the the piece of the conversation is changing you know, not only what can AI do, but how do we get our data in a struct in in formatted in a way that that it can actually use it effectively. and this the second change is agents, where the conversation is moved from what can a model say to what is it permitted to do? And that's a question of controls. And when you frame it that way for people who've been sitting inside large regulated institutions, that resonates with them. probably the third piece is regulatory and Nigeria, the central bank, has set a deadline of January first, twenty twenty-seven, for payment data to be held in country and many many banks I think are meeting it by meeting Or sorry, by lifting their data from a server outside Nigeria and putting it on a cloud in Nigeria, which moves the problem without fixing it. so you know, Sohail, who you mentioned, has dealt with questions like these from inside the bank. And that is why you know, his views carry weight with the executives we talk to. He's he's lived the problem and solved the problem, and I think that that's quite helpful. w when we have those conversations. 'Cause I think i you know, and maybe that's a question of where where the conversation is versus where it needs to go. I think it it needs to focus a bit more on the quality of the data.

Yeah, so what we usually do is we'll we'll do a diagnostic to try to understand what the the reality on the ground is. And we will with you know their their their teams, internal teams, come up with the plan to go from where they are to where they need to be. It's that diagnostic gap analysis and we focus on the work that needs to be done and come up with a plan. And once we've put that in place, we usually put together a contract based on our our deliverables and and the work that needs to be done along with milestones and a timeline and that's how we how we usually proceed.

Yeah, well I mean, each of the companies I've worked at has taught me something and at workflows that's where I'm kind of applying it all. It's like a a living laboratory and so over the next few years, I really want workflows to be the firm that banks and emerging markets reach out to when they need AI running in production on data they can defend to their regulator. And so Nigeria comes first and then that's gonna be followed by Kenya and Tanzania and then we'll go far far afield i into other areas of A Africa but also Southeast Asia. so yeah that's that's really kind of where we are and what what I'd like to see for workflows in the next few years. It's and it's you know, kind of going back to the lessons of the book, it's really to build a firm that holds when I'm not in the room. with leaders in each market who are developing leaders in in their in their market. So that's kind of the kind of the high level vision.

Yeah, definitely. I would protect the the firm's principles at the point where I could no longer be in every room. when we started out pretty early, workflows had values, principles, and a North Star written down. And they were lived whenever I was standing in the room. But I brought on a senior person and he subtly undermined those when I wasn't in the room and I held on to him longer than I should have because at the time we were scaling and getting rid of him would have meant taking on the you know the actual day-to-day work that he was doing and that would have overwhelmed me as we scaled so but it cost us and you know we had to rebuild the organization and bring those principles back to the the center of it. r you know, writing down principles is the easy part and What I would do differently is act sooner when someone senior works against them, even when that's inconvenient or difficult. So.

Yeah, that's very that's very true. Yeah. if I could just add on to that, you're you're exactly right. I mean, it's it's having those difficult conversations that's so important. it's making sure that you're holding yourself and your teammates accountable at a at a high bar, so that you're really doing excellent work and improving your craft every day. little by little, the exponential difference that makes over time is quite significant. So that that's a really excellent point. I mean it's those hard conversations. And then I think also understanding what it means to act like an owner. you know an owner does what's needed to be done. He's not just kind of going down tasks and performing the the at the bar level of each task he has to do. but he's actually making sure that there's a focus on results and getting the right results. And I think helping people to understand that's a significant part of what they're they're charged with.

Well I'm on LinkedIn at Greg Wood, and that's where we that's where I do most of my writing and thinking. I'll usually publish there to LinkedIn and lessons from the book and things about AI and so so that's an easy place to find me. they could also go to drift.management and they can take a a free assessment against the eleven laws and kind of see how their own organization is doing stacked against those.

Thank you. I appreciate you having me.