His Own AI Agents Leaked Patient Data — Here’s What He Built Next

Chris Hutchins: Welcome back to the Signal Room. I'm your host, Chris Hutchins. My guest today spent more than 20 years in operations before getting all in on AI agents, and he sits in a rare spot. Travis Garland is the CEO of Kickstand AI, where he puts AI agents to work inside of healthcare and medical practices. He's also the co-founder of My Compliance Citadel, which is the control layer that keeps those agents in line. This is an interesting combination because He's building something to control the other thing he built. very I'm very excited to hear this conversation. So he's one these few people who both deploys agents in high-stakes care, but also builds the guardrails behind them. That's tension that really building the agents today really needs to have. And building the agents versus governing them is exactly where we want to go. And this is not the first conversation we've had, Travis. I've been looking forward to just Letting the letting everyone letting everyone else in on it. It's it's just been fascinating for me. So, Travis, welcome to the signal room.

Travis Garland: Yeah. I'm excited to be here, Chris. The signal room I think is a a fantastic place to get some of this stuff aired and to make sure that we're we land in a place where folks can continue to get good information, insightful thought leadership, and I'm here to be part of it. So thank you for having me on as a guest.

Chris Hutchins: I'm excited. There's no no one better to talk about it f from my perspective. So before we go too far into anything of substance, can you maybe tell us a little bit about, you know, who you are? how does a healthcare operations guy end up going all in on agentic AI?

Travis Garland: it it it's a question worth asking because it seems very unexpected and for me as well. there's a couple of things you know, as I as I look back, you could probably start at at point zero and see how far we get before you start seeing paths unexpectedly start popping up, frankly. But I began in graduate school in psychology, went to to study to become a psychologist, frankly. Loved Data, love statistics, love research. And it kind of propelled me into that data analytics world. fast forward a lot of time. And I started getting into total quality management and Six Sigma. Then I started going into utilization management and eventually land in a place where I'm overseeing s large healthcare systems, helping run health plans, and then ultimately with the largest healthcare in the world, healthcare payer in the world. And As the CEO of some of the regional, the government health plans, that afforded me that bandwidth to really kind of see what was happening across healthcare payer spaces, get to know a lot of providers, get to know how the system works. And the last four years were really spent in the data analytics space of that same government health plan operations space. And that's where you really start to begin to see the crossing over of the timing of when AI comes in and my interest in data analytics and starting to continue to grow. my skills in those spaces. And as a healthcare executive, AI was not something we spent a lot of time talking about, but we'd spent a lot of time talking about broken systems and fragmented stuff and stuff that took long and stuff that was wrote you had to do over and over and over again. And AI started to chime into people's ears maybe three years back. We were talking about data analytics and how we could better solve problems and get deeper details on the insights and have a better sense of where to go and make better decisions and.

Chris Hutchins: Yeah.

Travis Garland: Everybody talks about let's have you know data informed decision making. and a lot of people just didn't know what the heck that meant, Chris. So we all just it's like I looked at some numbers and that's I made my decision. AI changed that world completely. So when you think about what that really means, the data's truly at everybody's fingertips. We'll get into this, but how you harness that, how you make sure it's right, what you do with those sort of data points that sit in front of you is a whole different story. but that was sort of the

Chris Hutchins: Right. Yeah.

Travis Garland: the matriculation of really just seeing it coming our way and realizing there's a lot of fragmented spaces that are gonna get sped up and are we gonna solve those holes before we speed everything up or we're gonna have better decisions because we have faster data. You know, you get into those kinds of conversations. but you could see that coming around the corner.

Chris Hutchins: Yeah, well well it you know it's it's it an interesting topic because I I think recently I've had a few different conversations with with some some physicians and they're still wondering if we're ever gonna get around to solving interoperability. I'm like I I don't think we've got a choice some on some level just because the AI is gonna force that issue. But you know, it's it's been unfortunate, but that's been the battle that's been going on for probably twenty years now. Probably most of which you spent inside of a healthcare organization. So

Travis Garland: Yeah. Yeah.

Travis Garland: Yeah, yeah.

Chris Hutchins: You know, w doing data and analytics and w working in the re with the real machinery of how care gets delivered. less we how and w and what did you see from that perspective that kind of convinced you that you needed to get into this AI agents and what do you think most people miss about this?

Travis Garland: Yeah. It you know, it began quite benignly enough. sitting down with my team, asking some questions about the same kinds of things that keep coming up. I've got the same request from a health plan that's hitting our corporate data analytics and reporting desk. Why am I recoding the same thing over and over again? Why am I starting at zero to write the same report that goes to just a simply another market? That happens a lot. Then how do we make sure that the

Chris Hutchins: Right.

Chris Hutchins: I got T shirts from that place.

Travis Garland: Yeah, yeah. I I we all do. We're all surviving this pain, right? the data space of of why are we all asking the same metrics, but we all we but we can't combine it? The metrics are just slightly different and the stratifications are different, the silos and the slices and blah, blah, blah. And it it became such a a sticking point that at one point AI was drifting in and we said, Well, what do we do about this? And at that juncture, it wasn't really AI, it wasn't a gentic, it was mostly like automation AI.

Chris Hutchins: Right.

Travis Garland: Very kind of early stuff, natural language processing was coming about, and we were really getting interested in how that could help us. That was probably the first time that we really started to put some real use cases on it, which was how do we take our system of thousands and thousands of reports and millions of data points and develop a natural language processing mechanism that could allow us to identify not keyword filters with reports, but the contextual space of the reports to say. What was it that it was trying to solve? And so we could use just natural language to help pull together reports that previously were never brought together because the keyword wasn't there, the title wasn't the same word. And that really facilitated a lot of shift for us. And we we after, you know, after moving from an on-prem to a cloud, which was at the time one of the largest migrations of data that I was a part of from United Healthcare space, that movement precipitated this. We moved to the cloud. It allowed this capability to happen. NLP came in, started to build this interface to be able to manage that content. So we started to see that work really start to come about. And then we started to see where the misses came about. And this pr that was probably the first few cues that we knew, okay, like something's a little bit off. Maybe it's pulling some sort of SQL code element and got the context a little bit wrong. and you start to see this thing. You start to realize that humans. Ask questions that you don't expect sometimes. And so they start doing things. I'm going to start cueing that into things like humans prompting. At the time, it was just them kind of typing something in unknowingly because we didn't know what the word was at time. but that's where we started to see those first little hiccups start to happen is that even with that that cloud-based work of millions and millions of data points and the speed that we could now move because we were in the cloud and the the NLP that we thought was gonna just solve the world because people didn't have to. type stuff in, they could just say, here's exactly what I'm thinking about. Just give me the report for it. and then boom, we start seeing problems. and that's that's probably within the last year or so before I started moving out, but that space was sort of the predecessor of some of the considerations to to see what was next as far as AI is concerned.

Chris Hutchins: No, it it's interesting you you you mentioned the automation part. I'm like, I I if I were you, I would just be saying, you know what, I was doing RPA when it wasn't even RPA. Right. largely now a lot of things are just labeled as these techniques. But you know, in the real world, people like you and I had to solve these kind of problems just because there was such a a massive data flow problem. Back then we kind of had this

Travis Garland: Yeah. This is true. This is true. Yeah.

Travis Garland: Yeah.

Chris Hutchins: big data tag that got put onto everything. But it it was really in the weeds that we we had to figure out all this stuff. now the volume is just it's too overwhelming. We've got to figure out the ways that that we can use the you know any technology. But right now with obviously AI agents is is a hot topic. let's let's talk about some really grounding things. just from a basic stamp link because don't know that everyone's dealing with this.

Travis Garland: Yeah.

Travis Garland: Yeah, yeah.

Chris Hutchins: but but I'd love to hear you just talk a little bit about what's what's it really like inside a real practice when an AI agent gets involved, when maybe someone's c calling in and and w what's actually changing when the person on the other end of the phone is a patient and not a lead?

Travis Garland: Yeah. It's it it is where I really think AI has a stronghold and it has a a a a real value to give in this space. in a in a practice, of course everybody's familiar with the ambient transcription space, but if I take a few steps back a little bit from the that 10 by 10 space of the exam room, when a practice stands something up like that. It often comes at the front desk kinds of stuff. You often get scheduling as as a part of the AI space, the calendaring kind of work, a little bit of the work an MA might do with respect to kind of moving notes back and forth between the EHR and that ambient transcription that's kind of standing out there. but what you really feel are some things that came out of some of the other conversations I've had with providers, I did not expect. some really forward stretching physicians doing things like. I'll liken it to kind of Ray Band glasses where there's like cameras and there's lenses and there's some AI capabilities in there. But think of it more in like a you know a a generic kind of set of glasses for the physician to be able record palpitations and what he's doing to help. the the place that kind of struck me in his comments was I have to express things out loud that I didn't expect my patients to hear. Or maybe I didn't want to hear, but I needed to have in the ambient transcription things that were a little scarier. Technology that was being referenced, terminology that was frankly unknown, unheard, sounded like some kind of disease. And people were just kind of leaving that few minutes, feeling really tilted on edge. And his comment was really that's something that I didn't expect AI to really bring to the table, was me trying to navigate the waters of my patient's experience while I use AI. So that was kind of an interesting space with the providers.

Chris Hutchins: Yeah.

Chris Hutchins: Yeah.

Travis Garland: The practice itself, I'll sort of give another one tied to the transcription and the note-taking piece and EHR work here, which is it a MA was making a comment to me, medical assistant was making a comment that they use two things to help craft notes: one, the transcription, and two, the interpretation from the physician. So MBA transcription would come in and the MA would then hear an interpretation. The physician would go in, read the summary, interpret what that meant, and then the MA was to use those two things. what they were doing instead to speed up the process, instead of trying to put those two pieces together, they would download the transcript, download the interpretation or the summary, and also download the the audio note interpretation of the physician. Three different documents, put them together, drop them in a large language model, a prompting field, whether it be you know a a a Gemini, a perplexity, a a chat GPT, open AI, it doesn't matter, dropping it into those and sending it out. and you can imagine. All the amount of PI or PHI that was involved in that process of doing it. And that's the opening up the can into that space of the compliance and the governance space and where AI is really launching itself powerfully, you get all those areas. You get ambient transcription, you get the tools and technologies and the the the the the devices that can be used, the ancillary equipment that can be used, plus you get the interpretation speed, then you get

Chris Hutchins: Right.

Travis Garland: risks associated with that on the downstream. And you start seeing physicians start to say things like, Well, then the summary isn't quite right. So I spent quite a bit of time. And they're spending sometimes more time interpreting the summary because the EHR summary that has ambient transcription didn't get it right to their liking. And so they would go back in and redo all that work. And you know, it was it's it's not glossy. It's not a staples easy button, right?

Chris Hutchins: Right.

Chris Hutchins: No, it's not. I I think you i you you highlight something that I don't know that people think about too much with this. I mean but I I I think probably we've we've all heard some some frustrations that we're we still haven't got to the point where we're completely removing the work. Sometimes we're just shifting it. And you know, the one of the things that doctors do by by nature after training for years is that translation piece of it. When they're talking to an individual like me.

Travis Garland: Mm-hmm.

Chris Hutchins: I I can maybe pronounce a word or two, but I don't really understand what it means. Right. So that translation is something that they do extraordinarily well. And we're actually putting something ahead of that that kind of defers that and they have to go back and deal with it later. it it's much like the the whole idea of you know having to review the outputs that's be that are being generated because of the additional things that we're introducing. So it's not really a complete

Travis Garland: Yeah. Yeah.

Chris Hutchins: improvement. It it's just a shifting of where it occurs in in this case I think.

Travis Garland: Yeah. Yeah. It it it it definitely in speaking to one physician that's that's out in Texas, she's in the whole healthcare space, very much in the sort of longevity medicine. a lot of lab work they do. And she said part of her her problem is lab work comes in in one format, her interpretation is another format. She doesn't trust ambient to come right out of her EHR, which is not one of the the most the largest ones. So maybe there's some hiccups there that are happening. But you you do, Chris, you nailed it right on, which is there's there's discrepant and fragmented AI outputs that are then being culled together into another AI output. And you you ask the question of validity, you ask the question of of of risk that's associated with the governance or the compliance associated with those things. But then you also just Ask yourself, is this even saving me time? Is it like what am I getting with this? and we we've at many times Chris said that AI should give you choice, right? And choice is not necessarily time. Choice is it can give you back opportunity to do other things, opportunity to do training, it can give you the choice to do all these different kinds of things, but really that's the intention of AI, at least in my view, in my view, and my role sort of sitting on the outside of clinics looking in. those that own clinics, practice managers, CMOs, they all have the choice to do what they see fit with the AI. And it doesn't always save time. And and I you know won't get into the sort of now maybe tired conversation about staff, but it I also don't truly believe that it's going to get rid of a whole lot of staff, at least in the next I I honestly don't think it's going to be in the next year or two because they're there's still An interesting dynamic that happens in healthcare with respect to agents. and you know, I I I have a sense we'll get to that that space in our conversation, but there's something that's in the healthcare space that I don't think is going to allow it. you ask me whether or not a software development company is gonna have some shortages. Sure, sure. But I I think there's some industries that are gonna have a a far slower slippage of staff.

Travis Garland: Even though they may be one of the fastest industries to try and absorb AI.

Chris Hutchins: Yeah. Yeah, I I I think there there's such complexity that we're dealing with and we get curveballs thrown at us randomly, whether it's a state or or or government, and if the federal government. So I mean it I I don't know. If there's a way to complicate it, we always come up with it. I think it was back in the like the early nineties, I think it was. I was working up in in Boston at the time. And I remember the CFO was having going to these national meetings.

Travis Garland: Yeah we do.

Chris Hutchins: For I don't know, probably better part of a year. And it was all about administrative simplification. And it was healthcare providers and insurers coming together to try to solve some of that. And then all of a sudden, the accountable care came out, and that stuff went out the window, and it got really complicated after that. Even more so. I had to hire more people just to be able to manage the additional complications because payers were you the we had to go we did this transition from a transact one transaction set to another.

Travis Garland: Mm-hmm.

Travis Garland: Mm-hmm.

Chris Hutchins: And at the time it was really ugly because they agreed on loops and segments. The government put these guidelines out there. So you got loops for this and segments for this, but they don't force you to use them all consistently. So payers had their own way of dealing with it. So it virtually every contract to have somebody had to maintain a a claim form and a remittance files interface that was all mapped. So it just got ugly. And it I don't think it's gotten any better.

Travis Garland: Yeah.

Chris Hutchins: But th that's the kind of stuff we do to ourselves. I say we do to ourselves 'cause you know, we elect our officials who do it to us. I guess it's technically us, right? But

Travis Garland: Yeah, yeah. Well, it and s and I would say sometimes the the system demands it of us. and you know, to hit on that that space, you know, if I think back to when I C D upgraded their coding, and we said, Hey, guess what? There's gonna be you know thousands of extra codes, but it's far more specific and you're you have to like learn a little bit of a different thing, but it's going to really help with pinpointing things like the appropriate billing and You know, a lot of other kinds of things were coming out of it. At least that was a storyline we were telling ourselves. and the same similar kinds of stuff was happening with AI. Now, here's one area that I really felt smaller practices are going are getting the short end of the stick on this. When all those codes in that example, or when the Affordable Care Act happens, or when a new set of policies comes out from a a specific payer, it doesn't matter who the payer is. those things seem to have a downstream effect on everything else. And they might give some period of time to make adjustments, but so be it. What all also is coming with that in the past year plus time are the speed at which those things dramatically impact the flow of information. And that does can really harm small providers. So case in point, prior authorizations. Case in point, Notifications for referrals. How about denials on claims? You get into conversations on things that are really sticky pain points for providers specifically. And the speed at which payers who are throwing tens of millions of dollars at AI and capabilities are thrown against small providers that might throw a few thousand dollars, maybe tens of thousands, maybe. those are not equal. Right. And so you get into this interesting dynamic of are they are they doing things to speed up the process that's making their lives easier? Or are they doing things to speed up the process to make the entire ecosystem sped up, make it better, make it faster? So decision making on denials, quick example. Maybe that is sped up by five days, 10 days, 20 days. You you have an ability as a payer to be able to deny things far more quickly because they don't go through the typical chains.

Chris Hutchins: Right.

Travis Garland: They might not be ever removed re reviewed by a human at that point in the game, right? Really early on in the denial process. But what does that do? It gets spit back directly to a provider who now has this onslaught of denials for codes that they may not have ever experienced because AI grabs things that might not have typically been spent sent to them as a denial. Those things now have to be researched. Well, they don't have AI, right? They don't have that kind of thing unless they're just dropping it into a public system, which shouldn't be doing.

Chris Hutchins: Yeah.

Travis Garland: So you you see this compounding effect, right? You see things kind of piling up at the door providers and they're experiencing such an an an immense amount of additional burn that that's what I really think is going to impact the staff more than anything else. I think if staff leave, it's not because the practice just got so efficient with AI, they just don't need people. I'll be honest, I think that people are going to leave because I think that they're going to be so, so burned out and tired.

Chris Hutchins: Yeah.

Travis Garland: of trying to to manage the flow of stuff that's coming their way, that that's going to create the burnout and the loss of staff. And I think that's the that's where the loss in healthcare is going to happen. I don't think it has to do with AI's efficiency generating protocols. Just don't think it's happening.

Chris Hutchins: Well, th there's definitely some some areas that are that are concerning, but let's talk a little bit about where you're seeing, you know, th this capability actually making a really big difference and where it can. And we we know it can make make things difficult or dangerous. but I'd love to hear your perspectives. I think there's just a lot of good things that can come from it. but but maybe you talk a little bit about what you're seeing.

Travis Garland: Mm. Yeah.

Travis Garland: you know, from from the space of as I mentioned or maybe touched on a little bit earlier, there are some hard rote kinds of spaces where AI really comes in hard. A scheduling piece I mentioned, that's a that's an easy one. Ambient, that's another one. the space where AI can really continue to expand itself is how far do you get until the judgment truly becomes a human call? And that is a that's a dynamic that I think a lot of people are trying to still figure out because healthcare, and I'm gonna side I'm gonna jump on a quick trail on the side of this one, just really quickly. On on the agent side of things, I think that healthcare is a little red reticent to to mention what they're building behind the walls. a little bit of that is the public space, right? It it's easy for me to say, hey, my you know, my Automobile is is being, you know, examined with AI now, and that's fine. Or, you know, my attorney is using AI to help craft in the initial drafts of briefs or whatever it is that they're doing, or maybe research a case file. Okay. Like they don't feel that personal. But as soon as you step into healthcare, like everything feels personal. And so the use of that becomes a topic that I believe is sort of the The growth and silence that happens within healthcare and and providers, that there's a lot of these building of new spaces. Agents are one of them that they may be built in healthcare. They might be growing in healthcare. But the reality is no one really talks about it in a loud way. Like, can you you can't you may have organizations sitting up and saying, we're automating something, we've got AI built into this. But they'll always qualify it with human review or human in the loop. They'll throw out some sort of qualifying statement around humans. And I don't know about you, but if I had a flow that was I had to review three files a day as a human and I can do it, and now I had to review a hundred files a day, okay. I don't I don't know how all of a sudden I could be 30 times faster. But somehow that's what's happening. So we'll we'll we'll examine whether or not.

Chris Hutchins: Yeah. Right.

Travis Garland: you know, the system is genuinely faster or not. But I think that AI has some impeccable space to grow in private practices, especially because it does help with things like peripheral spaces to start with, research and staying up with clinical research. Like that space, that ability to to truly understand what the cutting edge content is for physicians and for providers is a phenomenal space. Being able to have an agent designed to understand the research, tell you where it's going, lean you into specific medication protocols, understand how interactions can actually happen. We've had plenty of conversations with some formulary organizations that are building out formularies that have in them now operating systems that we've built to help support the idea now that they can cross, they can look across very different kinds of family classes. Tear out different pieces and see contraindications that they've never seen before. Cause AI has the capability to spot some of those things. We could see the federal government sending out their adverse events files and see what they're telling us and understand it and interpret it in a way we never have before. So people are safer, right? People are getting better medications, maybe. People are titrating down faster. I think AI just has some interesting spaces to to grow.

Chris Hutchins: Yeah.

Travis Garland: With respect to helping to support physicians in that respect. I I I really think if I touch on the EHR piece a little bit here, which is kind of the the giant's elephant in the room for most practices, I don't I'm not sure that EHRs are going to be that I'm not sure if I should say they're going to be or maybe they shouldn't. I'm gonna go on a limb and say this. I don't think EHR should be the customizing space of AI for practices. I think EHRs should be the platform source of data that they are. There are very much so capabilities within those systems to have HRB be built. But I really think AI, in order to be truly useful for practices, it needs to be tailored far more than a single EHR could do. And in that vein, the limb I'm going out on is EHRs should stay a little bit more tighter than I really think they believe they should be. And I think that. module AI components should be far more capable of being attached to those large systems. You can tailor them specifically for your clients. You can control them a lot better. And yes, it creates some fragmentation, but that's also where agents can step in and help support that. That's a little bit where my compliance Citadel comes in as being able to manage some of those agents that Kickstand AI built, right? So your point at the at the beginning of our talk here, I think that that's really where AI starts to to be known as something that's that's v infinitely more tailorable for the space that it's in and for the use case that it has. And when you can do that, now you're really seeing that you can harness AI in a way that a single s a silo of EHR just really can't facilitate that for thousands and thousands of practices.

Chris Hutchins: Right.

Chris Hutchins: you you you said you know the easy part about this is getting the agent to answer. And I I think it in my own experience recently I've decided that I have to be much more careful and pay more attention because the it's actually designed in a way to get you an answer. Right. And so it assumes you're telling it what it needs to know and it's gonna keep trying. If it doesn't find something where you tell it to look, I've had it go and start looking elsewhere.

Travis Garland: Mm-hmm.

Chris Hutchins: Which kind of concerned me a little bit. I mean, it was still inside of my own little ecosystem, but it was it it was it it really wanted to to get me the answer. And so to your point, that that is kind of the easy part, but what you're talking about in in you know your your your new business kind of gets into the harder parts of that, which really are the big the big G word that people don't like to talk about because they think it means something far less liberating than it really is and it's it's really governance. So I mean th this is why you built your new company, right? The moment you realize these agents needed a control layer, it's not a policy document, it's a it's an actual layer. I mean what what broke or almost broke that really got your attention?

Travis Garland: Mm-hmm. Yeah.

Travis Garland: Yeah.

Travis Garland: Yeah. It's the the example of what happens when a physician tries to pull down their schedule and set a better schedule. It's a very simple thing. but that was the first time that I started to notice it. Got an ask, kickstand AI. Can you help support our scheduling? We'd like to implement AI in order to facilitate the best scheduling we can to do outbound reach, to confirm appointments, SMS text messages, those kinds of things. And what we were seeing is that as we were leaning into that process to find out what was actually occurring before we stepped in to solve the solution the problem that they were experiencing, the front office staff were pulling down the schedule. And of course, in the schedule, it had provider and patient information, but they just pull down the schedule, drop it into their prompt and say, help me align this based off the history and the schedule that of these hours for different physicians. but clearly it was a moment of.

Chris Hutchins: Yeah.

Travis Garland: them releasing personally identifiable information along with physician information clinic information into a public domain and it was it was not a paid prompting space so it was an it open it was being used for training documentation that stuff can that stuff happens that was probably one of the first times where I was witnessing the potential extremely painful results of somebody doing something with the purest intentions to just get better right they were told Push the envelope. Try, like, do what you can to make things better. It's AI, it's gonna be wonderful. Got it. And that's really what precipitated the ongoing conversations with my business partner, Thomas McShane. And he and I started pulling our brains together because I kept saying, hey, I've got these agents, I've got these automations. What's happening in the governance space, internal governance space? How do I make sure they're built as strong as possible? And we hear people talk about that. Software developers that have their own material. Hey, we've got governed agents, they're doing their own thing. Put a pin in that for a second. We then have this conversation with Thomas, and he said, you know, there are ways to make sure that you never have an issue because you're putting up these particular clump compliance walls, external compliance. So when we think about it, I often describe it in this way. We all as as parents think that we raise the best children possible, right? They're all geniuses and they all are very well behaved. Like they never do anything. That's what we think our AI agents are. They're the best well-governed agents you could possibly build. They're never gonna go astray. Terrific. Yeah, I can tell you, I yeah. I I can say, I, you know, I've I've tried to skip school a few times myself. but but every time I got out of the classroom,

Chris Hutchins: No one's you haven't done mine, have you?

Travis Garland: Who was there to meet me, right? A hallway monitor, somebody that was like checking on some stuff. And that's how we like to think of it. We like to think of it as we're teaching our agents to do the best thing possible. Every once in a while they drift. We know agents do do this. They don't adhere to the governance and the exact standards by more than 50 or 60 percent over time. They will drift. So as that child tries to jump outside of the hallway, the hall or out of the classroom, the hallway monitor. Immediately, hey, do you do you have the bathroom key with that two by four hanging out the end of it? Cause everybody has to have a bathroom key to go wherever they're going. And the answer is yes, or it's no, or I don't know, let me go check. That's exactly what happens with my compliance citadel's compliance layer. So internally, we govern as tight as possible, and builders should do that. My CC, my compliance citadel is built on the layer that does that exact thing at the point of enforcing it at the layer of action, right? That action point that happens. Soon as somebody turns the knob to walk outside, that's when our work happens. At that point, then we either say, Yep, you got the pass, you get to go. Nope, you got to pause because I need to check with the teacher to see if you really should be doing this, human in the loop. Or nah, you're not even close. Get back in the classroom. That process, those three different verdicts that are rendered are then dropped to a hash chain and a tamper-proof audit chain. You can't do anything with them besides append to that particular chain. And then all of that content is just rallied in time. If an auditor needs it, an investor needs it, a board member needs it, point and click a button and that a report's sent off. that process, that process of making sure that while you may govern your agents as tight as possible, and you might be able to point those to internal governance things like. Is there a contraindication between two different prescriptions that are happening? And if there is, pop this up. AI agents will do that. They'll pop it up human loop. Let's discover it. In our system, when that happens, the human loop process automatically sends an SMS text to the escalated individual. Could be a CISO, could be a compliance officer. That person gets a text message, says, Hey, what do you want to do with it? Policy is written in it, the interpretation is written in it. Here's your actions. What do you, what do you want to do with this?

Travis Garland: They can approve it, do whatever they want to do with it, send a message back. The system will automatically release it if they approve it. and that will also be stamped just like it would be for a hash chain with their maybe as a passcode, maybe they're using the MPI number as an example, stamp with their MPI number, the date and time of all that stuff. So we know exactly when that decision was made. So you never have to go back to try and figure out when decisions were made about specific kinds of instances that maybe an auditor finds that are on this this tamper-proof audit chain that. Is you know, as you get farther into the definition of agent development and what they're doing, that's when you really get into sort of cryptographically I'll say verifiable. And I'm gonna I'm sort of cryptographically verifiable as kind of a the definition, the coin phrase that that's kind of inching its way towards reality. but that that space there I think is one that everybody should really stand up to and say, hey, that's what we want. And then the last piece, Chris, on that is As soon as you are doing that and it drops to the chain, what we've developed is a is a performance score and it mimics a FICO score. we call it the trusted agent sit a score, the tax score, T A C. And that tax score is a zero to one thousand score that does this. It says, What's the structure of your agent? How is it performing? And when individuals get involved with it, do they make it better or do they make it worse? And as we give a report. To the o to the agency owner or to the the the agent owner. We simply give them the report back and say, here's how it's doing. You you structured it very, very well, but guess what? It's starting to loosen its grip on reality. It's performing a certain way. And so it's it's a a silver, maybe it's a 775 tax score. But you did some great things and you made it better last month. So as during runtime, when it's when it's continuing to perform, it's getting stronger and stronger. And now you have a gold tier tax score. So That ability for an agent to be have a compliance layer put on top of it to be scored, to have your performance report given to the owner to say, here's how you make it better. And then have essentially a badge that says that you have a gold, a silver, or a bronze level agent in performance. I mean, it when agents make up 30%, 40%, 70% of an organization, and your board member comes in or your business insurer.

Travis Garland: Says, how can you, how do you defend the risk of this, this agent or these agents, these 80 agents? Well, that's when you get to step in and say, here's all the reports. All of my agents are gold level, 800 plus level scored agents. that's gonna be a far cry from that same insurer that goes across the street and talks to the other provider, that other company, and all of theirs are bronze, you know, and there's gonna be a sense where you start to understand that your agent's performance is just like a human performance. And if you get bad stuff happening with your agents, you got bad stuff happening in your company. And you have to really be sensitive to that.

Chris Hutchins: Right. No, I think w what you're describing is i I think is p really important for people to understand. I mean, you're you're instantiating s something inside of the workflow that's constantly trying to make sure it's it's staying on track. So the the the old fashioned way, we had a policy, every once in a it gets audited and we find out we've got a problem and there's you know, whether it's retraining or other consequences, it's an after the fact. the piece that excites me about it is y you already kind of touched on it. You're scoring it. And if you're doing this properly, your scores are gonna continue to improve indefinitely, presumably. So your opportunities to to really get at position yourself where you can trust it. I mean, I you don't obviously there's never gonna be a point you're just gonna yes at it and forget it. But you at least have an opportunity to be no monitoring and purposefully making strides to improve it.

Travis Garland: Mm-hmm.

Travis Garland: Mm-hmm.

Travis Garland: I mean, you yes. And you and I both remember the times when we had to sit in our, you know, compliance officer's training once a year to say you listened to the training, you remember that you gotta pick up the document off the printer within five minutes, right? You're not supposed to allow these things to like that stuff, that proverbial kinds of things is when you think about an agent that has autonomy to work 247 within the knowledge base of your entire organization and and has the authority to to

Chris Hutchins: Yeah.

Travis Garland: Do a whole lot of things, you're not talking about picking something off the printer. You're talking about releasing millions of data points of protected information or proprietary details on an algorithm or the structure of an application you're building for a client. Those capabilities are absolute within the space of the agent. And the scoring mechanism that we have not only scores, but it does two really important things. And the first one is it gives you a performance mechanism that Will inject the actual code back into the agent to make it stronger. So the report card that you get will automatically say, here's where your performance on your agent is drifting a little bit. Here's the code that you can put in to make it stronger. I mean, it's a that's a pretty powerful space to be able to to ensure that the agents will continue to do what they're supposed to be doing, which is it's pretty cool. It's a pretty cool thing. the the other space that that I think about AI agents is I really do think about the space that when drift happens, we really have a tough time understanding that as human beings, we don't just completely understand the 50 page compliance deck that our compliance officer just put in front of us. And that you we as humans have to ingest things more and more times. over and over again to get this right. Agents don't typically have to do that. The reverse is kind of true, which is they can absorb stuff right away and get it, but over time they lose it. They forget. So unlike humans, which we have a tough time absorbing it, but we and sometimes we tend to forget, but but the latter is the bigger thing for the agents. We have to continue to to manage that. So yes, it is definitely not a set it and forget it because it will begin to act poorly. And so

Chris Hutchins: Right.

Travis Garland: Part of our mission is to protect human data from badly behaving agents. It's not that AI is bad. It's just that AI doesn't always get it right. And you yeah.

Chris Hutchins: It w can talk about this for just for a second. So the the the the the the assumption that that you know w that I would make based on what you just said is that you know it's gonna just naturally do that. But I I think when we don't train people to you how to use prompts, just the difference in how they express the same thing they said yesterday, they say it differently today.

Travis Garland: Yeah.

Travis Garland: Mm-hmm.

Chris Hutchins: that in and of itself can cause it to go off off track, right?

Travis Garland: Yeah, yeah. It it's We typically talk about ICC. That's the framework that we use for prompting within my compliance setup. The intent of what you want to happen, the context that you want it to work within, and the constraint that you would say, don't operate outside of this. And it gives a reasonable, a reasonable amount of instruction. the ability for a for a prompt that as we as humans continue to get better, if there's a question of can you prompt your way into a better agent, I would say what you have is you have an ability to look across the table and say to your boss, I'll tell you what, boss, let's pinky swear on the fact that if you tell me to do this in the next quarter, I'll get it done. Now, that pinky swear with your boss, unlikely to be a reasonable KPI. They're not going to accept that as like, yeah, that's the way that we're going to make this happen. The reality is you can't prompt your way to a A better behaving agent. You can't prompt your way into it being governed in a better way, because the important thing here is that that's not the point of action. You can ask it to do something, you can instruct it to do something. You can have context all you want and constraints all you want. The reality is that you led this conversation, Chris, with the point of agents and AI love to make you happy. Unless you tell it not to. Unless you are just like stop being nice to me, right? Which many of us have done, right? For different reasons. it it its initial default is I aim to please humans, right? Like that's just what I do. I will go and find out the context. So let me run with that just for a quick second and say if you gave a five-year-old the infinite brain power of a PhD level expert and said,

Travis Garland: All I want you to do is go solve this problem. The first thing it's going to do is it's going to probably go rambling around, find some stuff, and come back and say, hey, does this make sense to you? And then if that's not right, well, how does this? How does it does this make sense to you? Is this, am I getting closer? There'll be this sort of success of approximation that happens with its logic, right? But there's also a feeling that what it takes with it into the world is not your prompt. That's an important thing here for people to remember is that. When you the words that you give it is not what it takes into the world. What it takes is the knowledge of all the stuff that it has access to to see if that helps with the context to answer your question. So if if you say, I would like for you to go and make help me better understand the formulary landscape of peptides, okay. Now, what it might do is it might come back with a generic definition of here's peptides and here's how you think they make things better. But then what happens if you say, my my panel is made up primarily of 50 year olds and they're primarily, you know, BMI of 42? What it's gonna start to do is it's gonna try and validate. It's gonna ask, is this exist? Who's in that space? What can I grab with me? And it starts pulling this stuff together because it it wants to know the context. Of what you're attempting to go and get context about, right? Before it pulls everything together. It doesn't go out there blindly, just looking for information. You give it information. Does it do it intentionally? I don't know. Does the agent understand when it should and shouldn't go outside of certain parameters? Most of the time, if you tell it. But that's the space of my compliance citadel's compliance layers, is that you don't know what it's picking up. The black box to some extent still exists. You have to just make sure. That when Pandora's box opens, that there's a way to close the lid. And that's what our layer does. It has the ability to make sure that that final umbrella over it is the final say before it does anything. Otherwise, it can grab all sorts of stuff just to go answer a simple question about your 50-year-olds that want peptides, right? and I I feel like there's a lot in that space of like calling together the information, but that even internal governance.

Travis Garland: Content is an important space, even if you don't have agents, just the space of AI internally or on your P and Ps and SOPs, that's a that's a big deal. You know, so gotta manage that stuff.

Chris Hutchins: Yeah, th th there's just there's so many layers. think we could talk about this all day and not exhaust even ta half of them. I wanted to make sure we pivot to some of the the the real f real exciting stuff that people really appreciate seeing in demos. Like how how are we dealing with all the regulatory things? You know, here we got HIPAA, the EU AI Act, you know, those things. and I know this is a space that makes you guys unique. maybe talk a little bit about what what what you d have done that that really is

Travis Garland: Yeah.

Travis Garland: Yeah.

Chris Hutchins: enabling you to help your clients to make sure that you're satisfying all these ever-evolving requirements that we're being asked to or insisted that we adhere to.

Travis Garland: Yeah. Yeah, it's it's a big space. And I would say that what we what we really focus on is the external compliance. We talked a little bit about governance. External compliance is where we sit at that that enforcement, the point of action. And what we've done is our organization has taken upon ourselves to frankly go out into the world. What are what are these standards that we can collectively agree to right now that is the standard of compliance? Right. So you think of the HIPAA and the high trust, the ISO. The SOC 2, you get into FERPA stuff and you get into Kinspan when you start talking about maybe media work, any of those rules and governance stuff, including the EU Act material that's sitting out there, all of those, regardless of where we're at. And we cover right now 151 different compliance packs, compliance standards. In in the US and healthcare, that's a set of frankly four. There are many others that that sit out there that we govern in in. Company PAC's methodology, which is anything that's internally governed, that you would say this is a policy because this standard exists in the world somewhere. And it may not be a regulatory standard, but it is a standard we want to adhere to. That company pack, which is the platform foundation of all the compliance work that we do, that governance falls into that pack and it covers anything that's within your company's explicitly derived regulatory documents. That's your compliance officer's training that you get all the time. And then Specific verticals have very specific compliance. So in the healthcare space, I mentioned those four. in the finance space, another set, real estate, banking areas, education, the the legal compliance stack is a whole nother space. And so you kind of walk your way down the various compliance packs, and each of those has a set of standards. So for us, depending on which vertical you're in, and depending on what agents you have and the volume of those agents, we build

Travis Garland: One, the foundation, which is your governance pack. Then you choose your compliance structure. And we say, hey, based on this content, we would recommend that you choose these packs because they're within your industry that gets layered on top of your agents, whether you have an internal governance and an external compliance layer. And I would then pause and I would say things like, You just said EU Act, right? EU act's coming out next month. We get a handful of weeks before it starts to go in in into full impact. And Here in the US, I would say most people don't don't pay a lot of attention to it. and they really should. They really should. Because in the US, there is no universal AI Act. There's not something like that that exists. we have constitutional references, we have federal stuff, the EOC, FTC, all of them. Name the acronyms, right? They have their own kind of pushed standards of what AI is. States are driving up their own Texas, Florida. Illinois got big ones, Colorado, California, all driving really large bills and amendments to drive toward an AI standard that they're defining. And the intention here, Chris, as you very well know, is we're seeing standards that our current administration is not stepping stepping in and leaning in to say there needs to be a collective thing. The states have always been. Within this current position we're in, sort of the defining entity. And it's driving, it's driving those definitions. So when when we start looking at it as a company, we spend a fair amount of time at the federal level saying, hey, here are your standards. But if a company is very specific to a a single market, there are very specific compliance standards that they would have to adhere to within that space as well. And we expect that to be something that continues to grow. And that's where we continue to invest our time and our energy in because you're going to have that EU act type stuff. NIST is going to be the one that's driving the guidelines, even though it's not a governing act, right? It's probably the closest set of definitions that you can have. Then you've got all the different federal governments and the states and the municipalities that are each doing their own thing. we're we're talking about here in my my part of the country, right? We're talking about e-bikes and

Travis Garland: Whether or not there should be helmets and the speed and where do they go. And that that conversation is just a microcosm of what happens in the AI space. Like, should we have data centers? Do I even echo I feel like I shouldn't even say that out loud because it's such a a topic right now that is all over the place with environmental and sustainability places and community organizations. And of course, everybody's leaning on what it what it's doing to the environment. So we've got some folks that. You know, Kelly Zow, Dr. Kelly Zhao from AI for purpose, she would say things like, Hey, we're we're we're trying to make some reasonable expectations of where it best fits. Sh do they fit in the ocean? Do they fit in the space? Who's governing those spaces? What happens when you have breakage? And what happens when you have bad actors? And you get into these kinds of conversations. AI for Purpose is one of those organizations that do that's doing its its fair share of trying to have those conversations. And Advanced AI Society is another one. I I would say that there are plenty of folks that are really trying to to manage what the definitions of AI should be. And Trisha Wong, who leads that organization with Michael Casey, would say, hey, we need to make sure that we're defining that cryptographic, you know, verification definition for agents. So we're all trying, Chris. Like we're we're all trying to figure the spicy stuff out. But

Chris Hutchins: Right. Yeah. Yeah.

Travis Garland: Man, it's it's a it's a world that is ever evolving. You have to constantly keep your space your your knowledge of what's happening AI, but then also its impact in where regulators are going, what auditors are asking about and the questions that they're starting to unpeel. They're putting a lot of pressures on compliance officers in ways that they've never experienced before.

Chris Hutchins: they're they're certainly making you know the the the work that you do very, very essential because there's so much there's so much confusion. And I I I think the piece that's always been concerning to me from the outset is the the the fact that we are not in a situation where regulators at a state level are are all like only worried about this one thing. but people like you and it's a career thing. We s we l we train and learn for years.

Travis Garland: Yeah.

Travis Garland: Mm-hmm.

Chris Hutchins: And we've got people who are, I would say, not even hobbyists. They don't they're not even full-time paid employees of a government agency. And they've got other things to do. So I'm not sure that we're gonna fare very well in in terms of having so much stuff decentrally regulated. I think we're gonna hurt ourselves a bit there. But I'd love to be wrong.

Travis Garland: Mm-hmm.

Travis Garland: Yeah.

Travis Garland: Yeah.

Travis Garland: you know, I I think that there's it it gets a little bit into what the multimodal risks are. and I I don't I yeah, just the space of of whether or not we have a firm understanding of what companies are doing when they build their models, what biases are inherent in those, where is the risk lie? re in my opinion, always lies in, I'm gonna say the last hand that touches it, but it's really in the deploying entity, right? It's whoever that is. developers are are not it, right? The model is not it. Do I do I dare say this, which is something that I I I recently had a conversation with in my own podcast and the conversation came up. Are we ever going to get to the point where we as an organization have to disclose the model? As an element of the culture of our organization.

Chris Hutchins: Interesting.

Travis Garland: And it's it's a moment of, you know what, we can we typically use this model, and every model has its own inherent biases. So does that inherently define some sort of culture? Well, how many of those model developed structures and elements and artifacts and outputs ultimately generate a culture of an organization? We know that you can change the the verbiage at a basic level of an output from a from a large language model, right?

Chris Hutchins: Maybe this one.

Travis Garland: And so if your model always talks this way, does it create a certain amount of culture? And so you you end up in these kind of sometimes a little bit esoteric kinds of conversations, but the reality of it is that there is this sort of quietness that's happening within certain industries of whether I should talk about agents. And then there's a sense of, well, I'm building and it's defining things and how much of that becomes a part of my culture as a display to the public. And then you end up in conversations around, well, who ultimately is responsible for the liability of something that happens in this space that was quietly built, that defined a culture, that changed the culture, that isn't even human. Like, do I even have performance evaluations for my AI agents? Like, I'm I'm getting into some weird spaces a little bit, but it's something that as you think about how you're piecing your pieces together as an organization, the your Your collective consciousness is being defined by your collective decisions of which model to use, whether you like it or not. And when certain things come out from your organization in specific ways, we've probably looked at it enough, Chris, that when we see a website that was built on a specific platform, you could tell what the platform was that built it. Has a specific kind of flavor about it. And the same thing happens, right? The same thing happens with outputs. And so We I think we we have to sort of collectively step back and not only assess for the risk that's inherent in having EI do stuff, but also just what it's what it's pushing into your company on the ethics side, on the culture side, on the people burnout side. Like I feel like there's a lot there, Chris, that I I I'm hesitant to get into, but I would say is a huge piece that people you know, as the funness of AI wears off and maybe as people get ROI defined, which is a whole nother conversation, maybe we get into that, but you know, I I think there's a lot to be to be said there for sure.

Chris Hutchins: And I I think you're you're nailing that. I think the the interesting challenge that we have i it it's not even it has nothing to do with the technology. It's it's really the it's it's culture, it's human relationship, it's trust. these are things that have just they they don't mean the same thing that they used to mean, unfortunately. Or may maybe maybe they it's not the meaning that's changed. It's that we've become less trusting, bottom line. And that that's that's really across the board.

Travis Garland: Yeah.

Travis Garland: Mm-hmm.

Travis Garland: Mm. Yeah.

Chris Hutchins: You know, I'm you you're talking about you know studying psychology. I had a a a a critical psych psychologist on the on the show a while back, and that was one of the things he highlighted. It's like over the last twenty years that the erosion of trust in human relationships is substantial. and it's really, really it it's it's terri it's really bad. most people w I think the numbers were about twenty five percent or fewer. Depending on the relationship, s say that they trust i the an individual, whether it's clergy, their boss, the CEO, the numbers are sort of really not good. And that's that's something we've gotta be aware of as we're working through h how do we implement these things and the w how does it impact our culture? And I think it's such an important factor for for leaders. as we wrap up wanna make I wanna make sure you you kinda speak to some leaders about what's important. but I I think the very least

Travis Garland: Yeah.

Chris Hutchins: thing that's getting attention right now is this cultural thing. It's that if we have to draw attention to it, we have to get per purposeful in really doing something to to make it more more transparent to the to the point where people can actually understand that what we're actually doing. if you're a leader, you're not willing to stand up in front and say I don't know when someone asks a hard question, that's going to be a problem. But the reality is we don't always know.

Travis Garland: Yeah.

Chris Hutchins: But then the other part is you're walking a fine line. You've got to keep the lights on in your company. And if you have a hunch something's gonna come, you don't want to say it prematurely, lose your best people, and all of a sudden you can't do the do what you what your whole function is. So there's a tough balance there. But the the hard part is just being transparent and honest and telling people what you know, what you don't know. And the communication, I think, is the most incredibly important part. So showing up consistently, doing what you say, those types of things. It's really basic. But we've we have to do it on purpose and actually hold ourselves accountable by letting people know that that's exactly what we're intending to do. Not an easy thing, but I think that's where we have to go.

Travis Garland: Yeah.

Travis Garland: It it's not. you know, I i if I if I can, I would say we also have to be very accepting of the fact that when younger junior staff step into our organizations and we as senior executives look at them, there's an there's inherently an expectations of what we have of them. We have to be very intentional about making sure that there's expectations that they have of us as well. And

Chris Hutchins: Desk.

Travis Garland: It's something that there's, you know, with it, with their ability to produce knowledge in a way that may not be in their brain, right? Admittedly, it's at their fingertips, right? In a in a device. But it's it is one of those moments where the open communication that you're referencing, Chris, has to be one of of humbleness, of trust, of collegial relationship building. And it it It makes for a dynamic that is something I don't know that has been felt in the workforce in a long time, which is how do you deal with the fact that sometimes junior staff have way more knowledge than you'll ever have on your on the topic, or maybe on your company's behavior on the topic. And that's that's something that when they come to you and they say, Here's how we're gonna make this decision, your ability as a leader to to dig into that is really where your value stands. And it's no longer I don't believe, Chris, your ability to have this 30 years of knowledge in your your brain to instill wisdom. but here's what I would say about leadership really quickly. And then then I think I I gotta stop on this one, which is leaders have been told for the longest time, I got this from one of my very first bosses that you have to be able to make decisions with 60% of the knowledge. And we spent a lot of time Developing the scars and the calluses of making bad decisions in boardrooms, in front of your financial advisors, in front of people who are strategists and consultants who'd come in and say, here's what you should do. And, you know, making tough decisions, standing on those decisions when you were wrong, applauding the team when you guys got it right. Those things develop a sense of acumen within executives. And my concern is that. As younger staff grow through 30 years, I don't know where those that scar tissue comes from. when you feel that you can get in 60% of your knowledge and the other 40%, which we have to had to battle through to figure it out and make decisions based on our hunches and our experiences over 30 years, do they get to fill that other 40% with AI knowledge? And so now they've got 100%. I don't know. And so there's an interesting dynamic of, you know.

Travis Garland: How do you learn to make tough decisions when you always have that last 30% or that last 40%? Because AI can give you that stuff. And that that's a that that is, I don't know how you solve that, but I I would also say that's the space of your comment, Chris, of the of the communication and the trust that has to be built as you develop that expectations back and forth. Because

Chris Hutchins: Yeah.

Travis Garland: There's gonna be moments when that young 24-year-old embarrasses the hell out of you because they know more about something than you do. And welcome to the next piece of scarring that you're gonna have as the as as an executive. But you have to have that. You have to know what to do with that. And that's that's being a leader, right? It's it's it's moving your company forward in a way that takes and harnesses the best of what your company has. If that's a 24-year-old with a tablet in their hand.

Chris Hutchins: Yeah.

Travis Garland: In the best programmer in the world, you gotta make that happen. You don't get to just like put that person into another team and just wait for the the four layers to work their way up to you. Like that's old, man. Like you don't I flat organizations are where stuff's going to happen. I feel like I

Chris Hutchins: Yeah, it it's a I I think you're absolutely right about that. I I can't even tell you. I mean, there's so many things in the last year, just the transition from being someone who worked inside of a health system to being you know outside of it and running my own business. I've had to learn some things and you know what? Some of the most profound things came from some couple of people who are in their twenties. And I was like I felt like an idiot. 'Cause I like w when they said some of these things to me, I'm like, my God. It's that simple. And I couldn't see it. I you know, but you just I think that's the hard the interesting things you mentioned humility and I love I'm gonna I'll I'll kind of wrap with this, but something my dad gave me was the best gift he could have given me. He gave me a definition of what real humility is, because people oftentimes think it means, you know, you know.

Travis Garland: Yeah, yeah. Yeah.

Chris Hutchins: lacking things or you know being being broke or something I don't know what the where it comes from but it it just simply means teachable and you know how he put it to me is like if you're willing to learn from anybody then you will do very well. but if you think you can't learn from somebody you're gonna miss the biggest lessons life can give you. And you know sometimes it takes me longer to pay attention than it should. It's

Travis Garland: Yeah.

Travis Garland: Yeah.