AIANALYSISPODCAST
Role based access for AI agents, short lived credentials, and an AI 'judge' for intent. Datadog's CISO says the old perimeter is gone, and 4,000 engineers are why.
Datadog's security team protects one of the most agent-saturated engineering floors in the industry. According to show notes from a recent a16z episode, more than 4,000 of the company's engineers now work with coding agents, and nearly every employee touches AI in some form. The CISO there, Emilio Escobar, isn't treating that as a detection problem. He's treating it as a permissioning problem.
The a16z episode between Escobar and partner Joel De La Garza sketches a working model for AI security once agents stop being pilots and start running in production next to humans. Datadog's answer isn't another threat feed. It's a rebuilt access layer for non-human actors.
The old perimeter assumed a human speed of work. A developer would write code, push it, ship it, and security would scan it. AI agents collapse that loop. They read source, call APIs, and write to production repositories in seconds. Signature-based tools, CVE catalogs, and identity systems built for individual humans can't keep up, not because they're bad, but because they were designed for an attack cycle that no longer exists.
Datadog's response has three parts. The first is role-based Model Context Protocol servers. MCP is the open standard that lets agents talk to tools and data sources. Datadog scopes each MCP server to a specific role, so an agent acting on behalf of a backend engineer gets a different toolset than one acting on behalf of a customer-support analyst. The server, not the agent, enforces the boundary. The product documentation on the Bits AI MCP server and the Security MCP server shows how Datadog has split the agent's reach by purpose rather than by user.
The second part is ephemeral credentials. Long-lived API keys for agents are a liability. A token that lives for the duration of a single task, and expires, can't be stolen and reused weeks later. The third part is an internal AI "judge" that Datadog's security team built to evaluate the intent behind a code change or a new agent skill before it lands in the environment. The judge doesn't replace a human reviewer. It reads the change the way a senior engineer would and flags the cases where the stated reason for the change doesn't match the code.
Datadog's own security work, summarized in its DASH 2026 security roundup, treats agent scope, identity, and intent as first-class problems on par with runtime threats. The company is running the playbook on itself before selling it to customers.
Escobar says the much-discussed scenario of an AI escaping its sandbox is a lower concern than the everyday reality of AI surfacing thousands of latent vulnerabilities faster than any team can triage. The volume of newly visible risk is the actual problem. Permissioning is the answer because it shrinks the surface an agent can act on, so the volume of issues a defender has to chase goes down at the source.
The standard image of a corporate network, with a clean inside and a hostile outside, was already shaky in the cloud era. Agents make it obsolete. The new unit of trust is the role an agent is acting in, the credential it holds, and the intent of the action it's about to take. Detection still matters. Detection on top of an open access model is now too slow to keep up with the workload.
A16z's pitch for the episode, on its X account, is sharp: the permissioning model that worked for a decade broke the moment agents entered the environment. The show notes for the full episode and the Apple Podcasts listing are where most of these specifics come from, since the full audio transcript has not been independently verified.
The next test is whether other security teams can copy the architecture without copying Datadog's engineering culture. An MCP server per role requires knowing what your roles actually are. An AI judge requires having labeled examples of malicious intent. Ephemeral credentials require the rest of the stack to accept them. None of that ships out of a box. The question for 2026 is how many companies will build the same thing, and how many will discover the same wall the hard way.