The Hidden Access Problem Behind AI Agents | Maya Kaczorowski, Oblique

Who can actually do what inside the apps your company uses, and what happens when an AI agent inherits that access? In this episode of Trust at Speed, TerraTrue founder and CEO Jad Boutros sits down with Maya Kaczorowski, co-founder and CEO of Oblique, to explore why SSO doesn't tell security teams what someone can do inside an application, and why that gap matters even more as AI agents act on people's behalf. Drawing on her work at Google Cloud, GitHub, and Tailscale, Maya explains why a first security hire should build trust with engineering and leadership before prescribing tools. She shares the corporate security basics worth tackling early, from SSO and MFA to logging and understanding the environment. Maya also contrasts automated SOC 2 checks in systems like GCP and GitHub with the human work of vendor reviews and evidence auditors still request separately. Her six-person team uses more than 50 apps, making it hard to know what people can actually do after they sign in. She explains how Oblique approaches access at the role level, why many OAuth scopes remain too broad, and why agent permissions should reflect the task being done rather than a fixed time limit. Topics covered include: • What a first security hire should do first • Why SSO doesn't reveal in-app permissions • User access reviews and the manual side of SOC 2 • Human access as the foundation for agent access • Task-based, context-aware authorization • Why integrations are harder than writing the code Trust at Speed is a TerraTrue podcast about the people building, securing, and governing the future of tech. Subscribe for more conversations across security, AI, governance, and product. Learn more about TerraTrue: https://terratruehq.com/ Connect with Maya:   / mayakaczorowski   Explore Oblique: https://oblique.security/