AI Agent Governance on the Desktop | Michael Levan, Solo.io | TFiR

Swapnil Bhartiya: When it comes to AI, an enterprise can govern every container, cluster and pipeline it runs, but it cannot govern the AI agent working on a developer’s laptop. And that’s where cloud code or Codex, that’s where they run outside the governance built for everything. So in early September, Solo announced Agent Desktop and open source product that extends agenting governance to those end user machines. And today we have with us Michael Levan, principal AI architect at Solo, to deep dive into this. Michael, it’s good to have you on the show.

Michael Levan: Hey, thank you so much for having me, really appreciate it.

Swapnil Bhartiya: Let’s talk about this problem. What were you or Solo were seeing in the field that made this the right moment for agent desktop? Was there a pressing need or it was more like this is something nice to have.

Michael Levan: When we’re thinking about agents, like a lot of people in production, we’re thinking like, hey, maybe I’m going to have an autonomous agent. It’s going to run on a server, just like any other type of workload that we’ve seen over the past X amount of years. You know, a server or I’m sorry, a workload typically runs on a server. Right. And it’s hosted there and it does what it needs to do. But what everybody quickly realized in the space is the new production server, so to speak, is somebody’s laptop or desktop. Because, you know, roughly 75 to 85% of agents run on the desktop and that’s where the production workloads are coming from. So yeah, like there are agents running in servers and you have autonomous agents and all these different things. But the reality is, you know, for an engineer, for somebody in marketing or finance or whoever, like if they’re using AI, it’s pretty much coming from the laptop or the desktop.

Swapnil Bhartiya: And if you look at some of these agents, or let’s say cloud core or Codex, that run on developer’s machine, local machine, what does that agent actually get access to? That can also be a concern.

Michael Levan: Yeah, so the agent itself can literally have access to whatever you have access to along with whatever the agent can get outside of the internet. So like for example, let’s say I’m using Google Cloud platform or Azure AWS or whatever else. If in my terminal I have credentials to hit those cloud providers, my agent has those same credentials. If it needs to hit an MCP server that’s maybe public facing without any credentials, it can hit it. Or if the MCP server has credentials, I can hit it. And then along with hitting any other type of LLM as well, as long as it has access and it can reach out to the public internet, it can reach that destination. And that’s a major problem. Right. Especially for organizations that care about security and governance, which is, you know, I would say 100% of them.

Swapnil Bhartiya: Yeah, yeah, so true. Now, we have also talked about production gap between the governance organization, their infrastructure, and of course, what they need for agent gate. Can you talk about when developers are working on the desktop, where and why does that gap start to show?

Michael Levan: Yeah, so I think the primary reason of when it started to show was when you saw like, Claude code start to get really popular and codec start to get really popular. Because before that a lot of people were kind of just like in the browser, right. And they were going to chat gbt or anthropic.com or whatever, and like they were talking to their agent there and within there. Yeah, like that agent could go reach out to the public internet and do a web search or whatever. But it was pretty condensed in terms of like, what permissions it had. But when the agent came to the desktop or the laptop, that’s really when people were like, oh, because this agent has full access to whatever I have access to on my computer. That includes things like configs and credentials that may be stored locally.

Swapnil Bhartiya: Ooh.

Michael Levan: Now this is a real problem because the agent can literally do whatever it wants based on my level of permissions.

Swapnil Bhartiya: Can you talk about the machines that agents run on? They already have. They are being managed with MDM and firewalls. Why? The existing toolings which are being used for corporate laptops are not sufficient to govern the agent themselves. Why we need agent desktop.

Michael Levan: Yeah. So to your point, like these tools, these MDM tools, these mobile device management tools exist. Like I remember years ago working with Air Watch before they were acquired by VMware. So, like, I’ve been in the MDM space for quite a long time and those tools are really great for I want to manage the laptop or the desktop. Right. What software can run on them, what the laptop can and can’t do, when you can log in, when you can’t log in. Right. Like all these different things. But what they’re not doing is thinking about what the agent itself can do. Okay, so like, what MCP tools are connected, what MCP servers are connected, what LLMs can be hit, even down to the what harnesses are you allowed to run? So for example, let’s say you’re in an organization that, that organization has an enterprise agreement with OpenAI or Anthropic or whatever. So the gist is like, hey, you can only use Claude code or you can only use codecs. Like getting down to that level of granularity is something that’s drastically important in the AI era and that may be something that current MDM solutions can’t solve.

Swapnil Bhartiya: Just to get our hands dirty and get into the weed. What does Agent Desktop actually do when an agent runs on a developer machine?

Michael Levan: Yes. So what ends up happening is you will have a controller, right? Or like a control plane. Right. The brains of the operation where you can manage your fleet of devices. And then you’ll have devices that are enrolled within that fleet manager. So what you can see and what you can do is the whole organization, let’s say you have 500 machines or a thousand machines, you’re able to see all the machines that are enrolled. And not like, you know, Big Brother style where I can see everything going on in the machine, but strictly things like what harnesses are running, what agents are running, what MCP servers and tools are connected, and ultimately from an agentic perspective, what that machine can and cannot do. So you have the ability to see the full fleet as a manager, right. Or as an admin or a root user or whoever in the organization. And then as the user, you’re able to see like, oh, I’m enrolled in Agent Desktop. These are the harnesses that I have, these are the tools that I have, et cetera. Which is really interesting even from a user perspective. Right. Because there are so many harnesses, there’s so many different MCP servers and tools. Sometimes maybe you might not even know what you have running on your laptop. So you have the ability to see that in a visualization perspective on your machine as well, even without looking at the fleet controller.

Swapnil Bhartiya: Can you also talk about how does governance on the desktop changes the day to day life for a developer working with these agents? Before Agent Desktop was there and after they started using Agent Desktop, what changed in their day to day life? What improvements they felt at the same time, what confident enterprises felt that, hey, you know what, this is making things better.

Michael Levan: Yeah. So from the developer perspective, it made a lot of sense to understand what was truly running on your machine and what you did and didn’t have access to. Just as an example, you know, maybe your agent wants to go and hit some MCP server that it doesn’t have access to and you’re like, well, why? I thought it was enrolled in Agent Desktop. Okay, I am enrolled in Agent Desktop, but I don’t have access to that MCP server, maybe. So therefore I need to go and reach out to the appropriate party. So from a developer standpoint, it gave them the ability to see what they can run and how they can run it. Now the biggest benefit is from the security teams, maybe even from the IT teams and the platform engineering teams, all the way up to the CISO and the security leadership, because now they have the ability to see what’s running across the entire organization in terms of agent harnesses, in terms of MCP servers and tools, etc. So they have a full level of governance across the organization. And this is great from like, hey, we want developers to be able to run these specific harnesses and these specific tools. But even taking it a step further, when a CISO or security leader needs to go and audit an environment to see what’s running within the organization, to see how it’s running and why it’s running and who’s running it, that’s very crucial for just about any financial institution, for government, et cetera. So now they have these report capabilities to really understand what’s running within the environment versus just, hey, this team uses these tools, this team uses these tools, but nobody really knows until you actually go onto the laptop and see it for yourself.

Swapnil Bhartiya: Now this is launched as an open source project. Talk a bit about why did you folks release it as an open source project and is there any, is there going to be any commercial angle? Because I love open source, but enterprise needs are different. They do need, you know, more capabilities, more function and also commercialization always supports open source. So talk about these two aspects.

Michael Levan: Yeah, so conceptually Solo is an open core company, which essentially means we run and build and deploy a ton of open source projects constantly. Like if you go over the past year, I mean there’s been a plethora of open source tools that we’ve deployed ourselves and that we’ve contributed to. So the core community aspect of things and really giving people what they need from an open source standpoint and really believing and caring about their community, I mean that’s at our core and that’s for everybody working at Solo, like so many of the engineers, so many of the product folks, etc, all the leadership have come from open source backgrounds. So having that at the core of our messaging and at the core of what we do is drastically crucial for us constantly and moving forward now in terms of the enterprise piece of it, yes, you’re absolutely right. Like there will be an enterprise solution or feature around Agent Desktop that gives organizations the extra capabilities that they’ll need, things like reporting, things like overall fleet management, etc. These are the core capabilities that an organization may need across an entire enterprise versus you know, an open source project that is made to be deployed to a couple of machines. So there will be more fleet style capabilities when it comes to the controller and such. And of course we’re constantly working with our customers and our potential customers to understand what they need in the product. That way it’s not just a matter of like, hey, these things are built in because we thought they were great. These things are built in because this is what people actually need in the wild.

Swapnil Bhartiya: And if just zoom out a bit. How does Agent Desktop fit into the agentic stack that Solo is building? But this is focused more on desktop.

Michael Levan: Exactly. Yeah. So the deeper that the industry goes into the agentic era, it turns out there is not just one problem that needs to be solved. There’s the runtime problem. So where agents are going to run, there’s the gateway problem which is hey, I need observability, I need security, I need governance for all of my agents and my MCP servers. There’s the registry component which is, hey, I have an agent or a skill or a prompt stored. I need people to be able to use them in a secure fashion. And then there’s the desktop component as well. Right. So like what’s running on my laptop? What tools do I have access to? What harnesses do I have access to? So this is where the full Solo Agentic suite comes into play. It’s really not about just like solving one particular problem in the agentic era, it’s more about how can we solve everything for the enterprise when it comes to AI.

Swapnil Bhartiya: This is more or less like as enterprise customers plan their agent rollout for the. I mean we are all in this agent world. What kind of conversations are you having? What are they asking now that they were not asking six months ago? You know when you go to events like Kubecon or whatever it is and the kind of discussion questions have totally changed from the past.

Michael Levan: Yeah, I see it in two ways. So six months ago, eight months ago, the conversations around like hey, I need to secure the laptop and the desktop definitely were not coming up. And the reason why is because those conversations are typically like the sysadmins, IT departments, right? Your help desk departments, like the people that are managing the laptops and the desktops. So the conversations around AI were really with like the platform engineers, the DevOps engineers, ML Ops folks, data scientists, etc. Right now it’s coming down to like, oh, everybody in IT, the sysadmins, the IT departments as a whole are now jumping in because they’re like, well, I need to secure the stuff that’s running locally, and I need to understand what’s running locally. So those conversations have definitely started to come up way more now than they were six or eight months ago, which is why something like Agent Desktop came out at the time that it did. The other conversations that I’m having a lot around are maybe six, eight months ago people were still very much thinking about the, ooh, shiny aspects of AI. Right. Like this new protocol is coming out, this new tool. This is so cool. We got to try to implement it. Yada yada. Now the conversations are like, okay, I’m running AI in production. How do I productionize it? Right? Like, things like, hey, I have memory and context that are being stored. Where are they being stored? Oh, in a database. Oh, this database needs high availability and it needs disaster recovery. So, like, the production style questions and communication are now coming up way more versus six, eight months ago, when I think everybody was still trying to figure out where AI fit in. Now they know where it fits in, and they need to make sure that it’s production ready.

Swapnil Bhartiya: We talked about developers and of course, enterprise and large, but let’s talk about one team that actually worries about all of that, which is security. When they look at Agent Desktop, what do they see and what they feel they have control through Agent Desktop that they did not have in past.

Michael Levan: Yeah. So that primarily comes down to the harnesses and the tools that are running on a user’s machine. So conceptually, before you could manage it at, like, let’s say, the server level, and you could have everything go through your AI gateway from the server to this particular endpoint. Maybe it’s an LLM or an MCP server. But what they didn’t have before was where the majority of agentic workloads are running, and that’s on the laptop or the desktop. So you could have teams ranging from, again, you know, engineering to finance to HR to whoever else, and they could install, you know, ChatGPT desktop, they could install the Anthropic desktop. They could install whatever harness, like Claude Code or open code or Codex or whatever they wanted to do, they could install that. And pretty much there was zero visibility. I mean, there was no way to have any type of visibility. Right. Because that traffic wasn’t going through something like an AI gateway, like agentgateway, where that’s your line of communication to your LLM and your MCP server from your agents. So that’s where you can get observability data, that’s where you can put in policies for security and governance. And none of that was really readily available before something like Agent Desktop.

Swapnil Bhartiya: One more thing is that of course open source people can. But if a developer wants to try Agent Desktop to be where do they start? And also should or can developers go and do it on their own or it should be done through the enterprise security teams?

Michael Levan: Yeah, I mean I would say both. Like if you’re working in an organization, of course you don’t want to just install random stuff on your laptop or your desktop. So definitely talk to your security teams and your IT departments and everything beforehand. But yes, like it is readily available. Like you can go, you can install it today, it’s fully open source, you can go take a look at the code if you wanted to make sure that it follows all of your standards, etc.

Swapnil Bhartiya: Perfect. Let’s wrap this on camera. I’ll just do the outer part. Michael, thank you so much for joining us today and of course share great insights on Agent Desktop. And this is an evolving field. This is also very important field security and the whole agent agentic landscape. So I would love to have you back on the show, but I really appreciate your time today. Thank you.

Michael Levan: Yeah, thank you so much for having me. Great conversation.