Canva's CISO: Default Trust in AI Agents Is an Enterprise Control Failure
Source
Why I Dont Trust Your AI Agent | Kane Narraway, Canva
AI Security Podcast
What happened
In an episode of the AI Security Podcast titled "Why I Don't Trust Your AI Agent," Kane Narraway, Canva's CISO, made the case that AI agents should not be assumed trustworthy simply because they come from established vendors. The conversation centered on how rapid vendor proliferation in the agent space has outpaced enterprise evaluation capabilities, leaving organizations approving agent deployments without the adversarial scrutiny those deployments warrant. Narraway's framing positions agent distrust as a principled default rather than a one-time procurement checklist item. The discussion is part of a growing practitioner consensus that agentic systems require a fundamentally different security posture than conventional software — one where the question is not whether a vendor is reputable but whether the agent's behavior, permissions, and tool access have been independently validated. This episode lands in a period of sustained attention to agentic control failures, including findings that half of enterprises cannot trust their AI agents' decisions and that two-thirds lack agent governance policies as network-layer controls begin to emerge.
Why it matters
- ·Vendor reputation does not substitute for behavioral validation in agentic deployments. Compliance teams that rely on a vendor's published safety documentation as the primary intake control are operating with an assurance gap that regulators and auditors are increasingly likely to scrutinize, particularly as agent governance is becoming binding across multiple jurisdictions.
- ·Agent tool use and plugin connections expand the third-party risk surface well beyond the primary vendor relationship. Each tool server, API integration, or plugin an agent can access is a potential trust-chain failure point, and enterprises without explicit scope and permission controls are exposed to lateral movement risks that conventional vendor due diligence processes were not designed to detect.
- ·A default-distrust posture for AI agents requires operational changes that many governance programs have not yet codified. Pre-deployment adversarial testing, explicit permission manifests, and behavioral boundary documentation need to become standard intake conditions rather than optional maturity-level enhancements.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit every active third-party AI agent deployment to confirm that a behavioral evaluation — not just vendor documentation review — was completed before go-live.
- ☐Add a mandatory adversarial testing gate to your agent intake workflow that requires evidence of scope-boundary testing before any agent with tool-use or external API access is approved.
- ☐Review agent permission manifests for all deployed agents and revoke any permissions that are not explicitly required for the documented use case.
- ☐Update vendor due diligence questionnaires to include agent-specific questions covering tool access controls, permission escalation prevention, and sandbox isolation capabilities.
- ☐Brief your AI governance committee on the default-distrust posture and confirm that your current agent approval process reflects this standard rather than relying on vendor safety attestations alone.
What to watch next
Compliance teams should monitor whether practitioner consensus around default-distrust for AI agents begins to harden into formal regulatory expectations, particularly as national guidance bodies issue more specific pre-deployment evaluation requirements. The trajectory of agentic governance rulemaking, including binding standards emerging from the agent governance landscape and CISA's agentic identity and approval standards, suggests this posture will move from best practice to baseline expectation within the next regulatory cycle. Teams should also track whether insurance underwriters begin conditioning AI-related coverage on documented adversarial evaluation of agent deployments, which would create a financial incentive parallel to the regulatory one.