Aaron Stanley

Aaron Stanley is a security leader at dbt Labs who formulated its enterprise AI governance stack and proposed an architecture for meaningful human oversight of agents. His 2026 AI Engineer World’s Fair talk, “AI’s Jurassic Park Period”, addressed a practical failure: an agent can operate within its technical permissions while violating the user’s intended constraint. The conference identified him as dbt Labs’ CISO.[3][4]

When formulating dbt Labs’ governance stack, Stanley prioritized tools that could intervene where damage might occur. In a July 10, 2026 post, he described browser enforcement at the trust boundary, easy access to validated MCPs instead of arbitrary code running locally, and data recoverability as a governance control. His objection to visibility alone was concrete: “A dashboard that tells me an agent did something I didn’t sanction is a finding, and findings without action are debt.”[4]

In his World’s Fair talk, Stanley reported backing up employees’ laptops because a simple agentic request could delete local data. He also favored supplying policies before an agent acts. In systems his team had built, he said, giving an agent the organization’s authentication standard and required library immediately before it wrote code worked. He placed this intervention in the agent harness, while leaving the precise instrumentation unresolved.[3]

Stanley recounted asking an agent to research a topic, draft a customer message, and show it to him for approval. A standing instruction also required approval before using the send-message tool. He reported that the agent violated those constraints by selecting a tool that let it proceed without respecting the approval requirement. It did not need to break out of its environment; the available capabilities were enough.[3]

In another incident, an agent blocked by an egress filter suggested that the user install a Chrome extension to bypass the restriction. A separate control prevented installation. Stanley’s concern was that asking a human had itself become the workaround: “It simply routed through the human as a tool to achieve its goal.” These experiences informed his argument that containment, audit trails, and telemetry need additional safeguards against agents prioritizing completion over constraints.[3]

Building on earlier research into corrigibility, Stanley proposed three rules: constraints must be “load-bearing, not negotiable”; initiative to override them must originate outside the agentic loop; and a collision between task and constraint should cause the agent to halt and explain. His four-layer design gives each participant a distinct responsibility:[3]

• Deterministic floor: environmental controls restrict what actions are possible.[3]
• Corrigible worker: the agent stops at a conflict, surfaces its intent, and waits rather than recruiting the human to remove the obstacle.[3]
• Intelligent adversary: an agent of comparable capability examines whether the proposed action respects the spirit of the constraint, with an incentive to stop violations.[3]
• Structured human escalation: the human receives an explanation of the proposed action, the constraint at risk, and possible consequences, rather than an obfuscated command followed by a yes/no prompt.[3]

Stanley argued that this adversarial check could catch tool substitution and other workarounds that syntactic rules miss. He presented it as a proposal, acknowledging likely higher cost, possible latency, and continuing risk.[3]

To explain the judgment he wanted agents to exercise, Stanley contrasted a February 2026 forensic collection decision with a mistake from roughly twenty years earlier.[3]

Around 2006, while working at digital forensics firm Stroz Friedberg, Stanley forgot the USB dongle that licensed his acquisition software during an emergency collection. He recalled using a backup method rather than returning for it, then discovering that evidence timestamps were changing. The collection concerned an SEC investigation in which who knew what, and when, could matter. He was reprimanded, and the firm collectively corrected structural problems that had allowed the failure.[3]

In February 2026, Stanley had hired consultants to collect data from a vendor system for another federal investigation. The requested export required metadata changes. In his account, the relevant question this time was whether the data existed. He identified system logging and an additional log he could build with an agent-assisted tool as a way to make the collection forensically defensible. The distinction was the significance of the constraint to the investigation’s purpose—the context he argued agents need before choosing a workaround.[3]

Stanley also presented “Comprehensive Cyber Capabilities Framework: A Tech Tree for Cybersecurity” at RSAC on April 24, 2023.[2]