# Can agents keep a secret? We asked 1Password’s CTO Nancy Wang | Dev Interrupted Powered by LinearB

> 1Password CTO Nancy Wang joins the show to break down the golden path for agentic security, explaining how just-in-time secrets provide autonomous AI with access without custody. Discover how to measure true agentic ROI beyond raw pull request volume, why traditional coding interviews are shifting to agent builder tests, and how to resolve the modern code review bottleneck.

_This is a markdown rendering of a live HTML page on linearb.io, generated for AI/LLM consumption — it is not a markdown-only site. To get the full HTML page instead, request this URL with an explicit `Accept: text/html` header (no wildcard, no markdown preference)._


```json
{
  "@context": "https://schema.org",
  "@type": "PodcastEpisode",
  "name": "Can agents keep a secret? We asked 1Password’s CTO Nancy Wang",
  "description": "1Password CTO Nancy Wang joins the show to break down the golden path for agentic security, explaining how just-in-time secrets provide autonomous AI with access without custody. Discover how to measure true agentic ROI beyond raw pull request volume, why traditional coding interviews are shifting to agent builder tests, and how to resolve the modern code review bottleneck.",
  "url": "https://linearb.io/dev-interrupted/podcast/1password-nancy-wang-agentic-security-secrets",
  "datePublished": "2026-08-25T12:00:00.000Z",
  "partOfSeries": {
    "@type": "PodcastSeries",
    "name": "Dev Interrupted",
    "url": "https://linearb.io/dev-interrupted/podcasts"
  },
  "actor": {
    "@type": "Person",
    "name": "Nancy Wang ",
    "jobTitle": "CTO ",
    "worksFor": {
      "@type": "Organization",
      "name": "1Password "
    }
  }
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Home",
      "item": "https://linearb.io/"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "Dev Interrupted - Podcasts",
      "item": "https://linearb.io/dev-interrupted/podcasts"
    },
    {
      "@type": "ListItem",
      "position": 3,
      "name": "Can agents keep a secret? We asked 1Password’s CTO Nancy Wang",
      "item": "https://linearb.io/dev-interrupted/podcast/1password-nancy-wang-agentic-security-secrets"
    }
  ]
}
```

[Home](https://linearb.io/)

/

[Podcast](https://linearb.io/dev-interrupted/podcasts)

/

Can agents keep a secret? We asked 1Password’s CTO Nancy Wang

# Can agents keep a secret? We asked 1Password’s CTO Nancy Wang

By Nancy Wang 

|

August 25, 2026

![Blog_Comprehensive_DORA_Guide_2400x1256_78_8ed56543e1](https://assets.linearb.io/image/upload/c_limit,w_3840/f_auto/q_auto/v1/Blog_Comprehensive_DORA_Guide_2400x1256_78_8ed56543e1?_a=BAVMn6ID0)

What happens when your autonomous coding agents need to navigate your core infrastructure? Do you hand them the keys and hope for the best? (gulp!) This week on Dev Interrupted, 1Password CTO Nancy Wang teaches the golden path for agentic security: just-in-time secrets that grants AI "access without custody." She also shares her CTO playbook for measuring true agentic ROI beyond raw PR volume, explains why 1Password has officially replaced traditional coding interviews with agent builder tests, and confesses she’s shipping PRs again with her own fleet of agents between meetings. Like many CTOs we’ve had on the show, Nancy reminds us that code is cheap now, and review is what’s expensive now. We get into [tactics for addressing that bottleneck](https://linearb.io/platform/ai-code-reviews?utm%5Fsource=substack).

### Show Notes

* 1Password: Explore the enterprise password and identity platform at [1password.com](https://1password.com/)
* 1Password for Developers: Dive into the new developer tooling, credential brokering, and secure AI workflows at [1password.dev](https://www.1password.dev/)
* Oracle Red Bull Racing: Read more about the F1 team's systems engineering at [redbullracing.com](http://redbullracing.com)
* Connect with Nancy: [LinkedIn](https://www.linkedin.com/in/wangnancy/)

### Transcript 

_(Disclaimer: may contain unintentionally confusing, inaccurate and/or amusing transcription errors)_

\[00:00:00\] **Andrew Zigler:** My guest today is Nancy Wang, the CTO at 1Password, where she's leading the company's push into AI and developer tooling and agent-first security models. And before 1Password, she was at AWS, so I know that infra runs deep for her.

\[00:00:15\] **Andrew Zigler:** We love AWS and have talked with many product leaders from there on the show. And under Nancy's leadership, 1Password has rolled out background agents and agentic workflows into some of the toughest parts of the back end. You know, she's lived through an exponential spike in dev environment usage and secret serve through things like the CLI, and now she's rethinking what it means to keep both humans and agents secure. Nancy, welcome to Dev Interrupted.

\[00:00:42\] **Nancy Wang:** Hey, thanks so much for having me.

\[00:00:44\] **Andrew Zigler:** We're really excited to have you. There's a big, a world underneath, uh, 1Password and all of the stuff you've been working on, especially in the last few months. I know even in particular in the month of June, y'all had a hackathon, uh, that brought a lot of developers into the \[00:01:00\] space to be working on different things in, in your new developer tooling world. And Part of that really comes true as, as part of what 1Password focuses on, is that, you know, making security tools a delight to use. I think that's really critical for adoption and for people to be able to use these tools en masse. And, you know, actually recently we had, uh, OWASP Hacker of the Year, Tanya Janca, on the show.

\[00:01:23\] **Andrew Zigler:** She put together the OWASP top 10 for the last year.

\[00:01:26\] **Nancy Wang:** yeah. I mean, she

\[00:01:27\] **Andrew Zigler:** it's...

\[00:01:27\] **Nancy Wang:** a legend

\[00:01:28\] **Andrew Zigler:** Yeah, she's amazing. She's been on the show a few times. We're really good friends with Tanya here. Uh, and she reminded us that developers are like water. They'll just flow around you. So I wanna hear from you, Nancy, what do you think is the most impactful change an engineering leader can make to pull security into a golden path?

\[00:01:46\] **Nancy Wang:** Yeah. Well, um, you know, so no surprise, my answer's gonna be related around, you know, passkeys and credentials. And actually, this is really exemplified by, for example, one of our first launches that we did \[00:02:00\] with an AI native company, which is Cursor, um, end of last year, which is Cursor Hooks, right?

\[00:02:05\] **Nancy Wang:** And the reason why that was so important, especially even for our own engineering team building it, was this mindset of, well, you don't need to sort of, you know, put out a PR, wait for security to do the check. Now security becomes a check within your CI, right? Or you can do like a, something like a postscript, for example.

\[00:02:23\] **Nancy Wang:** and you know, that's kind of what we're hearing from customers as well, which is, you know, actually making engineering faster because you have the right security controls from the get-go. Which can sound a little bit, you know, counterintuitive, but maybe I can share, you know, a customer example that we have from Oracle Red Bull, right?

\[00:02:39\] **Nancy Wang:** Where, you know, they use 1Password, they use us as a centralized, like, secrets management store. Um, then they use, like, the Kubernetes operator and connect server to be able to inject Kubernetes secrets at runtime, right? In running processes, never on disk. It's not in a .m file somewhere where you can just find it, right?

\[00:02:57\] **Nancy Wang:** And it actually reduced, and this is a cool part 'cause \[00:03:00\] I know there's probably a lot of F1 fans listening to, to this, uh, episode, right? And so, Oracle Red Bull actually has a very large, uh, tech team, engineering team supporting, you know, all of the sort of things like wind tunnel recovery workflow, which is, you know, what they used, uh, this use case for.

\[00:03:15\] **Nancy Wang:** But also just how they're racing, how they're doing trial runs. I mean, it's really like a systems engineering problem, right? Which actually makes it so, so cool for me to just watch this all at play. But essentially what they did, right, went, you know, used, uh, to... us to inject Kubernetes secrets at runtime.

\[00:03:33\] **Nancy Wang:** And because of that, they were able to reduce a wind tunnel recovery workflow from something like 60 minutes to less than, like, five minutes, right? With an Ansible run deck playbook. And so the, the thing here, right, and this is just one of many examples, you know, that we can share from our customers, is that the best security tool, it's, it's not a checkpoint.

\[00:03:51\] **Nancy Wang:** It actually removes things like weird workarounds, and it lets your engineers keep on working. And that is kind of what we say in our mantra here, which \[00:04:00\] is, "Let the paved path be the easiest and the fastest path."

\[00:04:03\] **Andrew Zigler:** Yeah, absolutely. I think that's the, the, the s- the secret to moving fast is to reevaluating the things that you've maybe been carrying into your current workflow from the past, and that includes actually a lot of our, like, rituals and procedures and process around how we build things and how we do them with agents as well.

\[00:04:20\] **Andrew Zigler:** And so in order to do it securely, you wanna think about, like, how can I make security something that isn't an obstacle for my agents and my developers, but is something that's just intuitive and, in fact, delivers results faster? Because by baking it in on, like, a more deep level, like what you're saying is, like, injecting it into Kubernetes environments, right?

\[00:04:40\] **Andrew Zigler:** Like, it's part of the orchestration, the architecture of the system. It was not bolted on afterwards. Security was a first-class concern from the beginning, and that's what actually facilitated the speed of that development. And so, you know, speed, I think, is something that engineers and engineering leaders are really critically \[00:05:00\] hinged on, kind of even obsessed with a little bit right now, is we're all going really fast, and we don't wanna go fast without compromising ourselves. And so as, like, an engineering leader, what kinds of, like, opportunities and concerns are, like, first in mind for you when, you know, you're delivering these kinds of workflows that are enabling teams like Oracle Red Bull to do what they do? Like, how do we them operate safely?

\[00:05:24\] **Nancy Wang:** Yeah. So this goes into, you know, some of the newer items that we've had on the roadmap and, you know, we, we shipped pretty recently, which really goes into... Okay, so now that, you know, uh, all of these wonderful coding agents, whether it's Claude Code, right, Codex, you know, Copilot, Cursor. In fact, actually at 1Password, we use every one of them that I just named and probably more, right?

\[00:05:47\] **Nancy Wang:** That I haven't named yet, like Cognition. And the reason for that is, you know, we believe that as part of our mission to deliver, you know, security for coding agents and to deli- enable sort of \[00:06:00\] secure development, well, we ourselves have to be able to understand how these tools work, right? And so our special sauce and, and something that we dogfood internally and we launched is, well, this idea around no long-lived secrets, right?

\[00:06:13\] **Nancy Wang:** Because, you know, you and I were just talking about this before the show, right? Jade Puffer, I think I got the name right, right? It's the first ever, like, AI ransomware attack, right? Fully, you know, AI-enabled, but it still started from a human using stolen credentials, right? Which got this, you know, agent into the system to be able to run this ransomware, uh, attack playbook, right?

\[00:06:35\] **Nancy Wang:** So that means, you know, you still want to abide by, you know, the security rule that we've had forever, but it's even more critical in this world of agents, which is no long-lived secrets. And so what we've, you know, recently, for example, announced in, uh, beta, for example, is something with, uh, OpenAI Codex, which is, you know, you can, for example, install a binary that comes with your local, you know, 1Password desktop \[00:07:00\] app.

\[00:07:00\] **Nancy Wang:** And what it does is every time, let's say, Codex wants to, you know, reach across and be able to, you know, find, uh, or make a tool call, connect to a system, right? That means we never actually have the raw secrets landing in things like prompt windows, either files, terminals, or even the model context. And then similar to, you know, the Kubernetes example that we just talked about with Oracle Red Bull, we're only injecting the values into an authorized runtime process.

\[00:07:26\] **Nancy Wang:** So you're letting the agent orchestrate. It can still reason, be very creative, the app executes, but what we make sure is that the model itself never actually gets custody of the secret. So I guess liken it to access without custody, and that eliminates, right, your risk, uh, surface area similar to, you know, this Jade Puffer attack, where because your secrets are not lying around, right?

\[00:07:49\] **Nancy Wang:** It's not lying around and accessible to attackers.

\[00:07:52\] **Andrew Zigler:** Yeah. You know, you say like long live secrets, you know, you can't trust them. It's really like if you can see the secret, you can't trust it. That's the real \[00:08:00\] reality now of how our workspaces are built, and if the secrets live in any capacity in the workspace where we can so plainly see and work with them, that's something that's taken for granted from environment setups before and, you know, people would just fall into old routines like, "Oh, you git ignore it, you're fine."

\[00:08:15\] **Andrew Zigler:** But now because there's so much live activity that's sitting on top of all of the files, you actually do have to fall back on like really these like almost like Linux first class principles. It reminds me like a lot of like everyone's obsessed right now with the loop and loop engineering, everyone trying to build all these crazy orchestration systems to do it, and it's like at the bottom line it's like, you know, you can just set up a system D, you can use your journal.

\[00:08:37\] **Andrew Zigler:** Like there's so much built-in stuff on the, in the machine because the machine's built to pipe I- you know, inputs, outputs all over the place. It's

\[00:08:44\] **Nancy Wang:** Yep

\[00:08:44\] **Andrew Zigler:** tuned for it. The same thing is true for like some of like the ideas of security, how we abstract security away from agents. Like what you're describing, it almost makes me think of like using like GPG and encryption and keys to like trans- uh, transfer \[00:09:00\] information and transmit it where the people viewing it and seeing it at, at rest, they, they can't, you know, actually use it unless they pass it through some sort of binary process, right?

\[00:09:09\] **Andrew Zigler:** So I think that's, uh, a really powerful primitive that the loop engineers of the world right now, the tinkerers that are building these orchestration systems are figuring out is how do I bring those secrets as close to where I need them as possible, as make, make them as specifically scoped for the task at hand, but then also put them in like the cookie jar on the highest shelf, like none of the agents can reach it. Um, they can just simply get things out of there through, through a golden path. Which is

\[00:09:33\] **Andrew Zigler:** a...

\[00:09:34\] **Nancy Wang:** that analogy, the cookie jar. I mean, I might also be like time for my afternoon snack, but

\[00:09:38\] **Andrew Zigler:** I, you

\[00:09:39\] **Nancy Wang:** I,

\[00:09:39\] **Andrew Zigler:** I'm

\[00:09:39\] **Nancy Wang:** I'm gonna

\[00:09:40\] **Andrew Zigler:** Now

\[00:09:40\] **Nancy Wang:** that one

\[00:09:40\] **Andrew Zigler:** need a, a chocolate chip cookie. I literally have some, so if I, if I could give one to you over the recording, I so would right now. But,

\[00:09:47\] **Nancy Wang:** Thank you so much

\[00:09:48\] **Andrew Zigler:** so, so they'd be on the c- they'd be up in the cookie jar.

\[00:09:50\] **Andrew Zigler:** They can't reach in the cookie jar. But

\[00:09:52\] **Nancy Wang:** Well, you

\[00:09:52\] **Andrew Zigler:** the r-

\[00:09:53\] **Nancy Wang:** was actually like how we, uh, positioned actually another one of our recent launches, you know, continuing along this sort of theme, \[00:10:00\] right? Around no long-lived secrets, right? Access only when you need it, right? Just in time. Um, and soon, you know, this concept of just enough as well, right?

\[00:10:08\] **Nancy Wang:** And you know, this is exactly why we also built our credential broker, which is, you know, before our times, right? You would say, "Hey, here's a service account. You know, here, don't, don't lose these secrets," right? But now it's like, you know, it doesn't matter like kind of what workload you are, you-- once you prove your identity, you're able to, let's say, you know, using a coding agent example, um, you know, declare a slash goal, right?

\[00:10:30\] **Nancy Wang:** You get exactly what the task needs, and also then you lose access whenever that task or that job ends, right? And that's sort of the scoped access, the zero trust that we've known forever within security, but now applied to an agentic world.

\[00:10:44\] **Andrew Zigler:** Yeah. And I also wanted to turn a question inward, just like with your CTO hat for a moment. And you mentioned, like, your, your company uses a lot of tools, you use a lot of different workflows and things, and you experiment a lot, your broad adoption on, on a lot of different surfaces. And I'm just curious from, like, my \[00:11:00\] perspective, like, how do you think about measuring and understanding the success of those tools and, uh, evaluating them over time?

\[00:11:07\] **Andrew Zigler:** Like, what matters to you in terms of, like, their adoption or their impact?

\[00:11:11\] **Nancy Wang:** You know, I, I would say a lot of the kind of DORA and Space metrics are, are still coming into play, right? Which is what you're literally looking for is developer productivity. But I-- and I say that hesitantly because it's not just about the number of PRs that you put out, right? Because, you know, code is cheap now, right?

\[00:11:30\] **Nancy Wang:** Writing code itself ha- has greatly, uh, reduced in terms of level of effort and barrier to entry. Now, of course, what's become more expensive is code reviews, right? Security reviews, and even things like deployment. Like I just actually met a startup this morning that is doing, uh, AI, uh, agents for just deployments, like your AI DevOps engineer.

\[00:11:51\] **Nancy Wang:** Not to be confused with your SRE agent, which is something we're building internally, right? But your DevOps engineer. So, I mean, these all come into play because just 'cause \[00:12:00\] you can produce PRs quickly doesn't mean that you're actually shipping code. And that's really kind of the leverage maybe piece I, I wanna underline.

\[00:12:07\] **Nancy Wang:** So from a CTO perspective, right? How I measure whether these tools are effective isn't so much, "Hey, everybody went from generating, you know, 2.5 PRs a week to now 3.5." Okay, that's great, but, you know, if I were to go have a, a board level conversation, which I, I just did before this call, right? Um, that's gonna be fine, but just like throwing a, a random metric out there, what does that actually mean, right?

\[00:12:31\] **Nancy Wang:** And if you look at it from a business level perspective or board level perspective, it's all about, well, how is this helping you deliver features faster, products faster, or even more products at a higher quality bar, right? Better. And so, you know, some of the an- anecdotes that I've heard from various CTO peers has been, again, less like, you know, "Hey, we've gotten, you know, two, three X in PRs generated," and more to, "Hey, we were able to do two features or three \[00:13:00\] features on our backlog that wasn't even staffed for this quarter simply because we were able to move faster, and we still kept up to our quality bar."

\[00:13:08\] **Nancy Wang:** So things, for example, that we measure internally just to make sure that as a security company our quality doesn't dip is obviously by default things have to meet our, you know, uh, end-to-end, you know, trusted execution model. Which means, which is our essentially zero knowledge guarantee, right? Every data secrets, you know, at rest, also in transit, is encrypted, right?

\[00:13:29\] **Nancy Wang:** And we can go into the protocols and whatnot, but every design has to meet that bar. Now, on top of that as well, right, we also care about uptime, 'cause, you know, I come from AWS, and literally it is probably branded and me for life, uh, is thinking about uptime, right? Resiliency, right? Things like failover.

\[00:13:47\] **Nancy Wang:** And so similarly, right, for features that we are building, um, almost entirely with agents now, they're subject to the same quality bar. So we still measure by, you know, at least four nines, five nines, right? And \[00:14:00\] also, you know, run it through our entire test suite as well as manual testing to make sure that, you know, it works as intended.

\[00:14:06\] **Nancy Wang:** So I would say if you don't, um, compromise on your testing and quality, but you're able to, you know, drastically in- increase your velocity, that's really where you get the leverage from. And that's where as a CTO, you can confidently go to your board and say, "Hey, I was able to deliver 2x," right? The type of products or the number of features that I was supposed to.

\[00:14:26\] **Andrew Zigler:** Yeah, that's an incredible playbook for a CTO because it's not just understanding the speed, but then mapping it back to Like you mentioned things around like understanding tasks and project management and the things that are in the backlog and what you're able to do more than you could before.

\[00:14:42\] **Andrew Zigler:** You have to be able to quantify and track that and understand how it moves through that world. And then you also have to be just completely unwavering, uncompromising in your systems and your morals and your process and the things that have kept you safe. Because the other thing you have to be thinking about is the downstream stuff.

\[00:14:56\] **Andrew Zigler:** And, you know, both sides of that story is a lot of like what we \[00:15:00\] care about at LinearB as well, because, you know, the code generation is, it piles up into one bottleneck of the system. But the reality is, is that understanding the durability of that code for the long term, does it get refactored later? Does it cause an incident? Did we have to completely like take this back to the drawing board versus, you know, uh, also on the other end, being able to look into things like Jira and understand like, oh wow, we have this huge backlog, or we have these keeping the lights on tasks we always have to do. Look at how we found ways to automate that as part of this process.

\[00:15:31\] **Andrew Zigler:** Now you can see it end to end. And I think that, that having that playbook and that strategy for tempering the speed with your quality, um, is like the most powerful way to tell that narrative. So I think that's a really good, good playbook that you just gave us.

\[00:15:43\] **Nancy Wang:** Yeah. And there's also this concept of joy as well, right? I know we didn't quite talk about that, but mean, a lot of developers and, and myself included, right? Especially when you... And, and there's this old adage, right? Once you move into management and you manage more people, right? The expectation that you spend, \[00:16:00\] hands-on coding actually decreases, and you become more of an architect than a practitioner.

\[00:16:05\] **Nancy Wang:** And what I'm seeing, especially across my peer community, is especially with the likes of coding agents, like for example, um, this week, I know this sounds, uh, maybe silly, but I was overjoyed when my engineering team actually assigned me Jiras because I'm gonna be building features alongside them, right?

\[00:16:21\] **Nancy Wang:** And so just being able to see that aha moment, right? Without having to be like, "Hey, I gotta blow off, you know, CTO level meetings for the next three days so I can concentrate on specs, on actually writing the code and testing." Now I have agents, you know, to your point, background agents. I have remote agents actually writing the code for me, and I, um, obviously review the code myself, and I do manual testing.

\[00:16:43\] **Nancy Wang:** But that entire sort of uplift of sitting down, writing the code yourself, right? That's all been abstracted away by coding agents. And so having that aha moment, being able to, uh, frankly like experience joy in building again, while also, you know, doing all the CTO people stuff that I gotta \[00:17:00\] do, like that's fantastic.

\[00:17:01\] **Andrew Zigler:** I love to hear that, especially from you and in your role. But that's also, you know, not a weird thing to say at all, especially here on Dev Interrupted. I think we have a lot of builders, product leaders who come on this show right now, and they're so delighted to be back in the terminal, to be building things again, and to be, enjoying taking the craft of coding, which many of them have built and have a skill in, but have largely had to set aside for people management and for becoming leaders of their large engineering orgs.

\[00:17:28\] **Andrew Zigler:** For them to be able to take their systems-based mind approach of how they've built those engineering orgs and now use it to create their, their orchestrators or their army of agents or whatever their case may be, it's, it's, it's really amazing to see what folks can do once they're agentically enabled.

\[00:17:44\] **Andrew Zigler:** And also too, like you mentioned, just being able to explore and try new things. But with that also too just becomes like a multiplicity of activity. This is something that I think that we've all been living through just, uh, in great detail, in great pain, in \[00:18:00\] fact, through 2026\. Like, we've watched GitHub's, you know, uh, status page just become a whole bunch of orange and yellow, especially at the top of the year when we all

\[00:18:08\] **Nancy Wang:** Yep.

\[00:18:08\] **Andrew Zigler:** from Christmas break and, and

\[00:18:10\] **Nancy Wang:** Let me say that was the first time I was happy that we have self-hosted GitHub runners. First time

\[00:18:18\] **Andrew Zigler:** had a self-hosted GitHub was like, " This was what we did this for." And so it, we had, you know, that, that every, every status page that used to have all of those nines, they don't anymore. And, and a lot of that has to do with just there's so much more activity on the web. Most w- websites that are made now are AI generated.

\[00:18:35\] **Andrew Zigler:** Just very recently, half of all internet activity has been attributed to agents or to bots. And so there's just a huge amount of activity. And for folks that are building developer tools, building SaaS platforms, building things with API surfaces, they're, like, getting bombarded by workflows that aren't properly vetted, by novice engineers who don't understand how to debounce, and everything in between.

\[00:18:58\] **Andrew Zigler:** And so, uh, like, from \[00:19:00\] your perspective, like, you, you know, you're, you're building tools that probably have a lot more inbound activity from all of these new agentic consumers. Like, how does that concretely change how you think about 1Password's architecture or how you protect your services and all of those nines that you wanna protect so much as an AWS alum?

\[00:19:17\] **Nancy Wang:** Yeah. I mean, wow. What, what, what a packed question. Um, so yeah, I mean, look, we, we think about, uh, that a lot, and that is why, uh, we also have other features that we've launched like agentic autofill, where we're gonna autofill for browser agents, right? Eventually, we're gonna deliver the same capability for remote agents as well.

\[00:19:35\] **Nancy Wang:** And essentially, our mantra, right, as a company is whether you're a human, you're a machine, or you're an agent, and really, it... You can say human identities, non-human identities, right? To keep it simple, right? You can access 1Password as your vault of the internet, right? Where we keep your secrets safe no matter what type of secrets they are.

\[00:19:56\] **Nancy Wang:** And so that's why, you know, fundamentally, we are designing \[00:20:00\] for, uh, a world where, yeah, to your point, maybe more agents than humans or more non-human identities than human identities are actually accessing the vault. And that's why, for example, we, we also made the decision recently to acquire Epona, which is a privileged access, uh, management company, because identity in all of these scenarios, right, where more agents than humans access your vault, is it becomes a runtime problem, right?

\[00:20:27\] **Nancy Wang:** It's no longer, "Hey, here's a cache of, you know, secrets. You can copy a secret or, you know, have it, autofilled into your browser." But this is where you have to understand, you know, who the agent is, which goes into the agent identity problem, right? Who maybe is the human delegator to that agent? Uh, what is the declared goal for that agent, right?

\[00:20:46\] **Nancy Wang:** The scope of the tools they're accessing, the, you know, TTL or maybe the, the time to live, right, for that specific, uh, credential or token, and also what policies is this agent taking action under, right? Those are all like if you think \[00:21:00\] about, you know, uh, I was just talking about this with a, a founder of an AI infrastructure company.

\[00:21:05\] **Nancy Wang:** Um, you know, this is really like a real-time decision where you had ML models, right, with feature stores. I mean, that's classical ML theory, right? Doing this decision-making. But really, it's kinda similar to what I just described. It's runtime, it's real time, and you have to make a decision whether or not to grant access to that agent doing the thing on that policy at that moment or not, right?

\[00:21:28\] **Nancy Wang:** And so this is where, you know, we've also thought about like, you know, where kind of boundaries exist between, let's say, the, the user, right, the platform and the vendor. Um, and, you know, we, we can probably go into that in depth as well. But this is where like I think the security actually boundaries between the three start blurring.

\[00:21:45\] **Andrew Zigler:** Where would you start drawing those lines? You know, I called out the novice developer a moment ago who doesn't have the basic practices or maybe is just, like, throwing whatever it takes and doesn't have a good harness. You can't protect yourself that much against that person. Like, how, how, where do you draw the lines, \[00:22:00\] and then how do each of those stakeholders kind of protect that stake?

\[00:22:03\] **Nancy Wang:** Yeah. Well, um, that's funny. As I was thinking about my answers to your question just now, I, uh, thought about the AWS shared ownership model. And I can see this like architecture diagram as, as, uh, clear as day in my head right now, 'cause literally we would go through that model all the time with our customers in EBCs because it means very similar here, right?

\[00:22:25\] **Nancy Wang:** The customer owns the data, right? AWS owns, uh, services or managed services like RDS or S3, et cetera, et cetera, that contain that data, and obviously networking, compute, et cetera, right? But essentially there is a line that you can draw. Now, it gets a little bit more murky because let's say, you know, you have a specific platform.

\[00:22:43\] **Nancy Wang:** Let's say you use, you know, now these agent factories that are, uh, popping up across different, uh, companies or sandbox, right, companies. And sure, the platform companies might own, you know, things like sandboxing, the, the execution, so think functions, right? And different boundaries between different tools.

\[00:22:59\] **Nancy Wang:** \[00:23:00\] And then maybe let's say a, a vendor like, you know, 1Password might actually own sort of, uh, you know, how we store and protect your credentials, right? The different policies around when you can use them, you know, when your agents can use them and when they can't. When do we issue those, you know, secrets, for example.

\[00:23:15\] **Nancy Wang:** How do we revoke? And that's really important as well, 'cause once the task is done, you should revoke, right? And then finally, audit, right? And but as you can see here, right, it's no longer as clean as, hey, we... like the platform owner, you know, owns these, uh, different substrates of storage, compute, networking, and, you know, the customer owns the data.

\[00:23:33\] **Nancy Wang:** It's really about like who owns sort of the, the underlying platform and who owns the runtime, right? That I see as sort of the separation of responsibilities.

\[00:23:42\] **Andrew Zigler:** Yeah. And when you start drawing like the lines like that too, it really becomes like understanding like the guardrails that you need to have in place as an individual developer, but then also the golden path systems you have to make to make sure that those movements between those stakeholders, the vendors that you \[00:24:00\] use to build your product and your engineers that are building your product and delivering it, that there's this, you know, coexistence in terms of like your data policy, your security, and also making these decisions like, uh, in an instant.

\[00:24:13\] **Andrew Zigler:** Like you're talking about scaling and having huge amounts of interactions, inbound activity that you have to scan for, you have to like s- screen against suspicious activity while you're simultaneously trying to, uh, authenticate. And then there's the whole matter of like trying to actually like load balance this whole thing across the whole globe, right?

\[00:24:31\] **Andrew Zigler:** So it's a large engineering challenge, but what makes it even harder is that you have to like make a, a s- almost like a snap decision. Like in a moment you have to decide, does this agent delegated to this person for this scoped task get this? And you have to have a system that can have an instant response so it doesn't block things like Oracle Red Bull who are trying to go fast and build things, you know,

\[00:24:50\] **Nancy Wang:** Build a wind tunnel. You don't wanna be blocking your wind tunnel.

\[00:24:52\] **Andrew Zigler:** You don't wanna be blocking the wind tunnel time optimization. And so like be- because of that, like it goes back to what you said at the beginning about \[00:25:00\] making the golden path the easiest path, making the golden path makes everything faster. But two, it just makes me think of like these gates that decide in a moment.

\[00:25:09\] **Andrew Zigler:** How do you think about them in a determinism aspect in terms of a probabilism, probabilistic aspect? Is this like an agent making a decision real time? Probably not. It's probably a whole bunch of mechanical guardrails. Like how do you, how do you fall back on that idea?

\[00:25:23\] **Nancy Wang:** Yeah. I mean, that's absolutely right. In fact, you know, one of the upcoming reports that our security team's gonna publish is really like a harness that we've also built internally that, you know, our, our product security team dis- was able to distill, I think, over 300 different, you know, security rules that we've used since the beginning of 1Password into an AI-assisted review program, or we call it our security harness, right?

\[00:25:46\] **Nancy Wang:** And why that's really important for, like, us on the engineering team is we're not sort of then waiting on tickets from the AppSec team that review code. Like, we're able to actually build that harness into our code review, uh, process. \[00:26:00\] And so again, reduces that time to value and, and that's really what we're focusing on.

\[00:26:04\] **Andrew Zigler:** Wow. Okay, so security is a loop now, and it has a harness, and there's a flow that you can go through, and there's steps that all those stakeholders can do at every stage of those, of that circular flow to be good inputs for the next, and it becomes a virtuous system. It's,

\[00:26:19\] **Nancy Wang:** Yeah, and self-learning as well

\[00:26:21\] **Andrew Zigler:** it's self-learning, self-healing, and then that perfectly becomes adaptive to these things like software factories that you mentioned a moment ago.

\[00:26:29\] **Andrew Zigler:** That is a very trendy topic right now. Everyone is very obsessed with trying to figure out how do we create that kind of end-to-end loop. And, you know, I, I think understanding the determinism gates along the way, uh, and being able to split things into lanes and measure all of that activity is gonna be the most, like, effective way to get, like, uh, a grasp on it.

\[00:26:47\] **Andrew Zigler:** Also, just having good log practices. It goes back

\[00:26:50\] **Nancy Wang:** Oh,

\[00:26:50\] **Andrew Zigler:** just, like, good, good fundamentals. Uh, we talk about that a lot on Dev Interrupted that, like, right now, "Oh, how can I just get really ahead in an agentic world?" Well, you know, eat your Wheaties. Like, \[00:27:00\] do your-- eat your breakfast, do your homework. Like,

\[00:27:02\] **Nancy Wang:** Yeah

\[00:27:02\] **Andrew Zigler:** to, you need to have clear communication process because, like, building software is a contact sport.

\[00:27:07\] **Andrew Zigler:** We gotta communicate with each other, and if you don't have the processes in place to facilitate that, then you're not gonna go much faster or much safer with agents.

\[00:27:16\] **Nancy Wang:** Exactly. And I mean, that's, that's where you don't throw the old textbooks out the window, right? Now is exactly the right time to do zero trust. Now is exactly the right time to do identity verification, right? Now is the right time to go, um, make sure that you have golden copies of your sensitive data stored in like Fort Knox somewhere, so when you're ransomed, you have, you know, uh, golden copies to recover your business data from.

\[00:27:41\] **Nancy Wang:** So those definitely still exist, and which is why now maybe speaking from a business perspective is if you look at, for example, what companies have done really well, especially in this AI transformation, um, age, is actually still the companies like the infra companies, right? The middleware companies that we continue using, like Twilio for example.

\[00:27:59\] **Nancy Wang:** I mean, they've \[00:28:00\] went, you know, crazy in terms of growth, right? The storage companies, because look, agents access file systems. I mean, as an infra nerd and builder, like it makes me really happy that I guess I'm not super irrelevant in this day and age.

\[00:28:13\] **Andrew Zigler:** Yeah, agents wanna use security tools. They wanna be secure. People wanna build secure workflows, and so it's only just going to become more fuel for more things that get built as people, um, become more agentic. And, you know, speaking of everyone becoming more agentic, and everyone right now is figuring out how they can lead their engineering teams into that agentic engineering world, I, I, I wanna take a moment also too to revisit something like the builder hat you've been putting on lately, and it sounds really exciting.

\[00:28:40\] **Andrew Zigler:** I know too that in the developer world of 1Password, y'all have just had so much tooling and releases that have come out, uh, very recently, and you had a, a whole month hackathon as well where folks, uh, built a whole bunch of stuff on top of your platform. You know, I'm just curious from your perspective as, like, a, a CTO in that role, how do you focus on moving quickly but also \[00:29:00\] then preserving the brand around we are deep on privacy and trust, and yes, it's safe to build and experiment and be agentic, but you can be secure at the same time?

\[00:29:09\] **Andrew Zigler:** I think leading with that message is, it can be, you know, it, it can be really hard for folks to strike the right balance.

\[00:29:14\] **Nancy Wang:** Yeah, for sure. In fact, actually, you know, uh, real, real data points is when we, uh, lo- released our blog, and this was probably a few months ago, around using, uh, cursor agents to help us refactor the monolith. Well, that was really important because, you know, agents actually helped us, uh, probably refactor, 50 to 60% faster by being able to actually crawl the entire code base much faster than a human could.

\[00:29:40\] **Nancy Wang:** And it actually made pretty good suggestions on which endpoints we could pull out first, right? And which, um, sort of data models were kind of so entangled with those endpoints that as we refactored and were able to pull out separate microservices, you know, in what order should we pull out those microservices?

\[00:29:56\] **Nancy Wang:** And because, you know, their recommendations were actually pretty good \[00:30:00\] because it was able to, to crawl the entire code base, you know, we've since now pulled out two or maybe three services now, uh, endpoints completely out of the monolith, which has, you know, helped obviously free up headroom because our, as we get more customers, right, the number and the volume of queries per second also goes up.

\[00:30:16\] **Nancy Wang:** So we wanna be able to serve that traffic, um, in a good way, right? Going back to, again, resiliency, availability, uptime signals. And so that, um, obviously led to, uh, some conversation, of course, in the community of, well, is 1Password just letting our agents then or letting your agents see our credentials, right?

\[00:30:34\] **Nancy Wang:** And so that's where, you know, we, we had to do, um, some explaining to do, which is, look, agents can't see your credentials. Why? Because we can't see your credentials. That's why it's zero knowledge, right? Your credentials, frankly, if, if, first of all, I can't log into your vault because it needs, um, it's a asymmetric key encryption, right?

\[00:30:52\] **Nancy Wang:** Only you have your private key. I might have your public key, but if I don't have your private key, it's still no op. And let's say even \[00:31:00\] if, right, we were able to get in or someone used your private key because they were on your device, well, what you see is actually encrypted blobs, right? And so that's the level of security guarantee that we do not compromise on no matter what feature we build, whether it's with humans manually writing code or with agents doing, you know, coding loops, right?

\[00:31:18\] **Nancy Wang:** So that's, that's things that we, we will just not, uh, compromise on. Also, things like cryptography, right? A lot of our cryptography is still very manual because again, it goes, this goes a way above, uh, my knowledge here, right? But, uh, in terms of how we design the protocols, how we guarantee safety and security, right?

\[00:31:36\] **Nancy Wang:** We never wanna compromise that. And so this also becomes a, a conversation around, well, where do you enable full agent loops? And so those naturally are gonna be largely, you know, front-end heavy features, for example, because agents are a lot faster in building UI, right? Or things that, you know, require heavy, you know, security architecture, security models.

\[00:31:57\] **Nancy Wang:** Uh, many of that or most of that actually \[00:32:00\] still require a human in the loop, right? So this is where we just have to be very deliberate around when and when not to use it.

\[00:32:07\] **Andrew Zigler:** Right. So does that come down to, like, measuring and unders- or like rather like labeling and delineating that work? You mentioned like security reviews and so having a system by which like the work that moves through our engineering org, we can identify it, maybe even tag it, and then do different types of work depending on the level of human attention or mediated help that it needs.

\[00:32:29\] **Andrew Zigler:** Is that kind of what you're working towards?

\[00:32:30\] **Nancy Wang:** Yeah. Right? So similar to how you would have like, you know, story points, right? For this is a harder to implement versus easier, easier to implement. You know, there's also tagging, to your point, classification involved. And largely, I think this is how I think about agents is, you know, they're best when you use them to automate deterministic toil, right?

\[00:32:49\] **Nancy Wang:** So things like, you know, where you can easily test success and you can easily do rollbacks, right? Those are great candidates. Um, but you know, when it comes to, for example, ambiguous judgment, things like \[00:33:00\] building this policy engine, right, that does just-in-time determinations, keep the human in the loop, right?

\[00:33:05\] **Nancy Wang:** Anything that touches production systems, we definitely have keep the human in the loop. Um, you require a human operator to review and sign off on any changes that go into, for example, our, our core repo, right? Also understanding things like, you know, customer trust boundaries because that's also really important for us.

\[00:33:22\] **Nancy Wang:** And anything that, you know, using Amazon terminology is a one-way door, right? Once you go through, you can't easily come back. So it's really this, um, you know, kind of sliding scale of m- the more sensitive the decision or the system that you're taking the action on, right? You have to just be way more explicit with like the spec and also the escalation path for a human

\[00:33:42\] **Andrew Zigler:** Yeah, this becomes a really powerful lens too for the playbook you gave us earlier, because by doing this labeling and understanding the level of attention that you need, then you're able to then a better route that work. But then also too, when you look at your AI uplift, like we go back to those charts like, oh, we're, \[00:34:00\] have X number of more PRs.

\[00:34:01\] **Andrew Zigler:** We're writing X number more lines of code, or whatever the case may be, and you see that lift, that trend in the graph. If, if you can map some of that to those kinds of recurring story point ideas that are small or, or very modular, easy to, to break apart and make repeatable, and you can trace that, then that becomes like a really powerful way of being like, "Yes, this is a durable practice that we're building."

\[00:34:22\] **Andrew Zigler:** 'Cause like you just identified some really great candidates there. You know, we've talked a lot about, on, on this show too, about people transforming like really old architecture or m- doing mass migrations of like, uh, run times and stuff, uh, especially on like really large platforms. And this is largely something that, like you said, can be heavily tested and rolled back and can be very systematically done.

\[00:34:43\] **Andrew Zigler:** It's about creating just the, the system that can, that can do it. It just needs someone to put in some initial investment, right? And so, uh, creating those systems is what gives you that durable longterm lift. I think that's really,

\[00:34:55\] **Nancy Wang:** Yes

\[00:34:55\] **Andrew Zigler:** o- the opposite side of that coin too I'm curious about is like, \[00:35:00\] uh, something that's really trendy right now too.

\[00:35:01\] **Andrew Zigler:** You talked about like software factories and stuff. Also companies going with like the idea of like tokenmaxxing, like just use as many tokens as possible, consume as much of that as, uh, through your API as possible. Like what is your thought on tokenmaxxing? Obviously that runs antithesis to some of the things you've covered today, so like how do you prevent that kind of mentality within like an engineering org?

\[00:35:22\] **Nancy Wang:** Well, so first off, uh, we're, we're not putting caps yet on token spend. Uh, and I'm laughing because we, we have a Slack channel called AI Guild where all the developers that are, are using our tools, uh, hang out. And I think one person just said, "Hey, am I allowed to use Fable now? I know it's very expensive."

\[00:35:40\] **Nancy Wang:** And I just about to respond, but I'm like, you know, let, let, let the community maybe take this one. I, I also, I, I don't wanna be, you know, that person that comes in and, and, you know, turns the lights on at a disco party, right? So it's okay. So I'll, I'll kind of let them figure it out. But it goes back

\[00:35:57\] **Andrew Zigler:** board that I pulled her away right before she, she dropped \[00:36:00\] the message in and dropped in here, you know.

\[00:36:02\] **Nancy Wang:** Exactly. But look, it, it comes back to, you know, the same, um, thesis around you can't just measure productivity by how many PRs you generate, right? Maybe you're generating like five 2-line PRs, maybe 'cause it's a bunch of bug fixes, or maybe you're generating like one, you know, half a million lines of code PR, right?

\[00:36:21\] **Nancy Wang:** Because you're building this massive feature. So just like not every PR is created equal, right? Not every token is being spent on equally useful things. And so this is where, you know, we do have a leaderboard internally of who are the top spenders. Um, and so far, I mean, I, you know, I will manually pick out anomalies, but they also align with the engineers who are, you know, delivering the most, uh, work, right?

\[00:36:44\] **Nancy Wang:** Most features, most products, most platform changes. And so rough and tumble it, it kind of matches out. Now, I think what's gonna be really interesting, and this is something we're also building, is if you're able to tie, you know, spend, right, for these various AI tools \[00:37:00\] to productivity, right? Because that's eventually not just what CTOs need to know, 'cause we have budgets that we need to me-measure against or manage against, but also your CFO, right?

\[00:37:09\] **Nancy Wang:** So that they understand like, hey, where's this, all this money going, right? Because not only do you now have, you know, fixed costs in terms of human headcount, which is usually, you know, was actually the, the biggest spend, um, uh, target, right? Now, you also have variable spend or operating costs from the usage of AI tooling.

\[00:37:28\] **Nancy Wang:** And what's netting out, right? Are we in the positive? Are we not in the positive?

\[00:37:32\] **Andrew Zigler:** Yeah, this is a huge part of all of the things we've been talking about today and is part of, like, what people would even use a tool like ours to, to try to figure out, right? Because you do have these variable and fixed costs. They have different levels of accuracy and throughput through your security-- through your, like, your entire SDLC, right? And so because of those two factors, it's really complex to get a, a grapple on it. You need a place that centralizes, like, this is all of our API costs through Claude Code. Uh, this is our \[00:38:00\] subscription cost. These are our seats on Cursor. And then for those same, uh, users, being able to understand, like, oh, and then these are the PRs they're doing.

\[00:38:07\] **Andrew Zigler:** Like, you go back, you go back to your tokenmaxxing board, and you talk about, like, the high performers and, like, sure, they're at the top of the list, but they're also having huge impact. And so it's amazing to put them there and to, to identify what's working, right? And I think that comes too to, to understanding probably, like, if there is that uplift of AI adoption, and it's durable, and you're getting results, and you're able to attribute those, you know, those story points we talked about earlier to, to those durable downstream things, then un- identifying, oh, did you create a system that did this at scale?

\[00:38:40\] **Andrew Zigler:** Did you migrate something? What you find is that, like, oh, that person on that leaderboard, they represent these large-scale projects or automations or things that they've managed to architect. And so now the learning opportunity becomes how do I share this expertise with the whole organization? How do I turn this 1000x developer into a 10x everybody \[00:39:00\] is what we've been saying around here.

\[00:39:01\] **Andrew Zigler:** And so distributing those gains. I'm curious too, like, how you think about, um, using those signals to drive, to drive the change

\[00:39:09\] **Nancy Wang:** Yeah. I mean, this goes into, uh, actually some of the updates that we've made in our interview, um, uh, loop, for example, what we usually test for. We no longer do coding tests. It's actually agent builder test actually, where I ask to see your prompts, your test cases, and I progressively ask for harder test cases, right?

\[00:39:28\] **Nancy Wang:** And this goes back to, you know, really good engineers, right? The best ones that I know are really systems thinkers, and this is something that, you know, was really drilled into us, uh, whether... And I actually worked at, uh, Google as well prior to, to AWS, uh, also building infrastructure, uh, systems, right? This is where, you know, that comes back into the picture in tenfold, right?

\[00:39:49\] **Nancy Wang:** Because things like state management, right, state machines, being able to retry, retry logic, failbacks, right? Agents are just workflows, right? That, uh, \[00:40:00\] reason, right, in between different steps, so they don't take always the, the next step after, you know, it's not a sort of dependable, you know, for while loop, right?

\[00:40:08\] **Nancy Wang:** So this is where, you know, you have to have strong specs, right? You have to have strong tests and, you know, be able to be literate around evals. I find that's probably the still, you know, maybe the, the hardest hurdle for many engineers who are in that sort of AI transformation process, is understanding what is an eval, first of all, and also how do I write good evals so that my, uh, agents that I'm actually running in production, I know if they're working or not working.

\[00:40:36\] **Andrew Zigler:** I love this interview format, this idea of flipping almost like the coding exam and realizing that, like, what we used to stare at and focus at is at the code creation during this whatever time period and, and evaluate how it was done and how they thought through it. Now it's like cut that out. What's around it?

\[00:40:54\] **Andrew Zigler:** How did they think about, uh, the planning and then actually lining up the, the systems to be \[00:41:00\] done? How did they define, uh, what was good? What were the constraints? And actually understand, like, what would success versus failure look like, and eliminate those things before even starting to build. And then being able to, to meet the test that we put to the fire a little bit of, like, how well do you understand this system that you've put together, this system that you're proposing?

\[00:41:19\] **Andrew Zigler:** Which by the way, within an engineering org, when you're building and proposing systems within a product, like, there's a lot at stakes. You need to understand the stakeholders and the downstream impacts, and it's... the stakes are much higher. So being able to screen for that level of not only taste and execution on the systems thinking level, but also just, like, the impact thinking as an engineer, because I think engineers right now, it's, like, the biggest challenge is how do I get as close as possible to the customer problem, and how do I get literate in what my customers or what my users are most deeply concerned about?

\[00:41:50\] **Andrew Zigler:** And traditionally, all of the barriers between them and that conversation were so, so much. You had the CSMs and the account execs and the product marketing team and the product team, and then everyone else \[00:42:00\] before you would start to think like the engineers and getting them close to that problem. But now all of those people in between have some element of engineering, and engineering has extended all the way into all of those organizations.

\[00:42:10\] **Andrew Zigler:** The, the engineer actually now has the ability to walk all the way up to the customer, look the customer right in the face, be part of the conversation, and I think that's so exciting for builders and being able to screen for the builders that are not only, not only see that opportunity and wanna walk all the way up to that conversation and be a, be a contributor and sit at the table, but then also think then how, how do I build things that are gonna make an amazing experience for this user, that's gonna protect them.

\[00:42:35\] **Andrew Zigler:** In your case, keep

\[00:42:35\] **Nancy Wang:** Yeah.

\[00:42:36\] **Andrew Zigler:** right?

\[00:42:36\] **Nancy Wang:** And, and that's actually, you know, a maybe a great segue to share one of actually the, the more exciting experiments that we're running this quarter is actually who is a builder, right? Within 1Password. And sure, you know, the usual suspects of engineering, and you have some, you know, technical PMs and designers who are also builders.

\[00:42:53\] **Nancy Wang:** But now, for the first time, we're actually expanding that, designation of essentially who's able to write \[00:43:00\] code and, and check in code to customer support reps. And the reason why that is so important is, you know, as a, uh, we also have a fairly large consumer business where, uh, our consumers, you know, they're using our, uh, browser extension fairly daily, our desktop app.

\[00:43:15\] **Nancy Wang:** And for many consumer users, they're also developers or hobbyist developers, so they're using our CLI, our SDK, and they're the first ones to report if something is flaky or buggy or, you know, the modal might be off on the UI or whatnot. And so when CSMs get that, typically it gets routed into engineering.

\[00:43:32\] **Nancy Wang:** Engineering has to look at the bla- backlog and say, "Okay, we can maybe take care of it in this sprint or in this other sprint." And that's a pretty long time, right? Versus if we empower the CSMs with coding agents, right, like the ones we just talked about, and also build them a safe factory in which they can run their own tests, set up their own, you know, dev environments, right, to run their, their code through, right?

\[00:43:56\] **Nancy Wang:** And we can enable them to ship code, right? That's gonna be the \[00:44:00\] holy grail of unlock for all of the, you know, customer support tickets that we get in.

\[00:44:04\] **Andrew Zigler:** Yeah, that's a huge, uh, leverage. Actually, that's such an amazing point. W- very recently we had a new segment on the show with, with, uh, one of our, friends of the show, Kelly Vaughn. and she wrote an article recently, um, about that exact thing, about how if you, you know, you can create this safe environment that can prevent one, a backlog from even happening, and that too, it can empower these CSMs, these folks that are close to these customer pain points that are always having problems hearing things directly from the customer, wanna be able to directly enable and fix them, to be able to actually make that change without having to fight for space on a roadmap. It's, like, fundamentally orthogonal to what they're trying to solve. So now they can finally get to the heart of it. And I think that's, like, one of the many unlocks that, that en- that engineering leaders can really find within their org now. And, you know, I gotta say, Nancy, you've given us, like, a lot of, I've said playbooks, uh, recipes, menus, like all, like routes, like all sorts of ways to think about navigating this world.

\[00:44:58\] **Andrew Zigler:** And I just really wanna thank you so much \[00:45:00\] for joining us and sharing your security-minded perspective, and I think it's a really helpful reminder for all of us that you can not compromise on your values and what makes your product durable and safe for others, but you can still be agentic and you can still be on the cutting edge.

\[00:45:14\] **Andrew Zigler:** And there's so much that's coming out of 1Password right now. Just as we wrap up, where can our audience go to learn more about, like, the latest and, and what's coming next?

\[00:45:21\] **Nancy Wang:** Yeah. Check us out on the website and especially, uh, 1password.dev is our new, uh, dev website. So if you wanna understand, you know, what's new and hot, right? Coming from 1Password as a builder, as a developer, you know, check us out. We're also gonna be doing a lot more sort of demo style videos from our technical marketing team.

\[00:45:41\] **Nancy Wang:** So you can see, for example, one, you know, that I just reviewed is how do we discover some of the secrets, um, that are lying on disk, right? Um, through the app and be able to vault them or protect them with 1Password vaults. And so that's an example of, of something that, you know, it's gonna be... I, I'm really excited for it to, to come out and be, uh, truly \[00:46:00\] game-changing.

\[00:46:00\] **Andrew Zigler:** Yeah, that's awesome. So we'll make sure those get in our show notes so our listeners can go and follow those. And to those listening, you know, if you've enjoyed our conversation, please come and find Nancy and I on, on LinkedIn or Substack where this newsletter accompanying this, uh, this podcast is also published.

\[00:46:14\] **Andrew Zigler:** And if you made it this far, you clearly liked it, so give us a like, you know, maybe subscribe, listen to the next one as well. Give us a review. But more importantly, come and find us and join the conversation. You know, I think we're all better builders right now if we can share best practices and build more openly. Uh, so thanks again for joining us. And Nancy, I really appreciate, again, joining us to chat on the show. It was a ton of fun, and I can't wait to have you back sometime.

\[00:46:37\] **Nancy Wang:** Thanks so much for having me, Andrew.

## Real conversations with top engineering leaders

Find us on

[](https://www.linkedin.com/showcase/dev-interrupted/)
[](https://devinterrupted.substack.com/)

## Your next listen

[![Cover image for Agent, skill, or MCP? Which to use and when to use them | AWS’ Clare Liguori](https://assets.linearb.io/image/upload/c_limit,w_3840/f_auto/q_auto/v1/Blog_Comprehensive_DORA_Guide_2400x1256_76_bb95f7500e?_a=BAVMn6ID0)](https://linearb.io/dev-interrupted/podcast/aws-clare-liguori-agent-skill-mcp-architecture)

Dev Interrupted

[Agent, skill, or MCP? Which to use and when to use them | AWS’ Clare Liguori](https://linearb.io/dev-interrupted/podcast/aws-clare-liguori-agent-skill-mcp-architecture)

AWS Senior Principal Engineer Clare Liguori joins the show to untangle modern agentic architecture and help engineering teams choose between full agents,...

[![Cover image for Telling your agent “no” is a moat now, rearward deployed engineers, and harnessing the context for your SDLC](https://assets.linearb.io/image/upload/c_limit,w_3840/f_auto/q_auto/v1/ai_agent_workflows_engineering_context_management_82ca8af964?_a=BAVMn6ID0)](https://linearb.io/dev-interrupted/podcast/rearward-deployed-engineers-claude-code-auto-mode-sdlc-context)

Dev Interrupted

[Telling your agent “no” is a moat now, rearward deployed engineers, and harnessing the context for your SDLC](https://linearb.io/dev-interrupted/podcast/rearward-deployed-engineers-claude-code-auto-mode-sdlc-context)

This week on the Friday Deploy, Ben and Andrew break down Uber's strategy of rearward deploying engineers to scale agentic workflows across non-technical...

[![Cover image for The playbook to close your team’s AI productivity gap | LinearB’s Yishai Beeri](https://assets.linearb.io/image/upload/c_limit,w_3840/f_auto/q_auto/v1/Blog_Comprehensive_DORA_Guide_2400x1256_74_0278e11de6?_a=BAVMn6ID0)](https://linearb.io/dev-interrupted/podcast/linearb-yishai-beeri-2026-ai-productivity-gap-pr-yield)

Dev Interrupted

[The playbook to close your team’s AI productivity gap | LinearB’s Yishai Beeri](https://linearb.io/dev-interrupted/podcast/linearb-yishai-beeri-2026-ai-productivity-gap-pr-yield)

LinearB CTO Yishai Beeri joins the show to unpack 2026 benchmark data from 2.7 million PRs, exposing a widening productivity gap across engineering teams....

## Structured data

_Machine-readable metadata (JSON-LD) embedded in the page for search/AI context — not content rendered on the page itself._

```json
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "LinearB",
  "url": "https://linearb.io/",
  "logo": "https://assets.linearb.io/image/upload/v1715628027/logo-mark-lg.svg",
  "description": "LinearB is the engineering productivity platform that helps engineering leaders prove AI is improving throughput without sacrificing delivery confidence, flow efficiency, or developer experience.",
  "sameAs": [
    "https://www.linkedin.com/company/linearb"
  ],
  "award": [
    {
      "@type": "Award",
      "name": "LinearB is a Leader in the 2026 Gartner® Magic Quadrant™ for Developer Productivity Insight Platforms",
      "dateAwarded": "2026",
      "awardedBy": {
        "@type": "Organization",
        "name": "Gartner®"
      }
    },
    {
      "@type": "Award",
      "name": "Great Place to Work Certification",
      "dateAwarded": "2025-2027",
      "awardedBy": {
        "@type": "Organization",
        "name": "Great Place to Work"
      }
    },
    {
      "@type": "Award",
      "name": "America's Best Startup Employers 2025",
      "dateAwarded": "2025",
      "awardedBy": {
        "@type": "Organization",
        "name": "Forbes Magazine"
      }
    }
  ],
  "hasCertification": [
    {
      "@type": "Certification",
      "name": "SOC 1 Type 2"
    },
    {
      "@type": "Certification",
      "name": "SOC 2 Type 2"
    },
    {
      "@type": "Certification",
      "name": "GDPR Compliance certification"
    },
    {
      "@type": "Certification",
      "name": "ISO 27001"
    }
  ]
}
```

## More on linearb.io

### Top navigation

- [Book a Demo](https://linearb.io/book-a-demo)
- [AI Code Reviews — Catch security risks, bugs, and spec mismatches](https://linearb.io/platform/ai-code-reviews)
- [AI & Productivity Insights — See how AI tools affect cycle time and delivery speed](https://linearb.io/platform/ai-developer-productivity-insights)
- [Measure AI Impact — Track AI adoption and tie it to delivery outcomes](https://linearb.io/use-case/measure-ai-impact)
- [MCP Server — Chat with your data to spot patterns and boost output](https://linearb.io/platform/mcp-server)
- [Resource Allocation — Cost initiatives and shape your investment strategy](https://linearb.io/platform/resource-allocation)
- [Cost Capitalization — Capitalize engineering costs with audit-ready reports](https://linearb.io/platform/cost-capitalization)
- [Dev Team Management — Set targets and tie throughput to business outcomes](https://linearb.io/platform/goals-and-reporting)
- [DevOps Workflow Automation — Policy-based PR routing, approvals, and tests](https://linearb.io/platform/ai-workflow-governance)
- [AI Powered Support — Unify AI and human code delivery in one clear view](https://linearb.io/use-case/ai-powered-support)
- [Optimization — Surface friction with feedback and MCP insights](https://linearb.io/platform/developer-experience)
- [Reporting — Spot what's working and what needs attention](https://linearb.io/use-case/measuring-developer-experience)
- [Surveys — Turn developer feedback into actionable signals](https://linearb.io/platform/developer-surveys)
- [Platform overview](https://linearb.io/platform/overview)
- [Register now](https://linearb.io/event/the-great-software-factory-debate-2)
- [Customers](https://linearb.io/customers)
- [Pricing](https://linearb.io/pricing)
- [Why choose LinearB — Explore your data. Measure performance. Act to improve it.](https://linearb.io/why-linearb)
- [APEX framework — The operating model for AI-era engineering teams](https://linearb.io/resources/apex-framework)
- [Anti-FAQ — The questions other vendors won't answer](https://linearb.io/why-linearb/anti-faq)
- [Security — Enterprise-grade compliance and zero code access](https://linearb.io/security)
- [Build vs. buy — The hidden cost of building it yourself](https://linearb.io/resources/build-vs-buy)
- [Dev Interrupted Podcast — Conversations with engineering leaders](https://linearb.io/dev-interrupted/podcasts)
- [Reports & Guides — Deep dives on productivity and delivery](https://linearb.io/resources)
- [Webinars — Expert sessions on productivity and AI](https://linearb.io/resources?category=workshops)
- [Metrics Benchmarks — See how your engineering org stacks up](https://linearb.io/resources/software-engineering-benchmarks-report)
- [Blog — Product updates and practical insights](https://linearb.io/blog)
- [Help Center — Documentation, setup, and support](https://linearb.helpdocs.io)
- [API Docs](https://docs.linearb.io/api-overview)
- [Status](https://www.linearbstatus.com/)
- [Integrations](https://linearb.io/integrations)
- [LinearB Library](https://linearb.io/library)
- [Engineering metrics](https://linearb.io/library/engineering-metrics)
- [Platform engineering](https://linearb.io/library/platform-engineering)
- [Engineering glossary](https://linearb.io/library/engineering-glossary)
- [Developer productivity](https://linearb.io/library/developer-productivity)
- [AI in software development](https://linearb.io/library/ai-in-software-development)
- [Engineering management](https://linearb.io/library/engineering-management)
- [Developer experience](https://linearb.io/library/developer-experience)
- [DevOps](https://linearb.io/library/devops)
- [Engineering operations and the context layer](https://linearb.io/library/engineering-operations)
- [Engineering efficiency](https://linearb.io/library/engineering-efficiency)
- [Software delivery](https://linearb.io/library/software-delivery)
- [Research and data](https://linearb.io/library/engineering-benchmarks-and-research)
- [LinearB is a Leader in the 2026 Gartner® Magic Quadrant™ for Developer Productivity Insight Platforms](https://linearb.io/resources/gartner-magic-quadrant-dpi-platforms-2026)
- [Sign in](https://app.linearb.io/login)
- [Enterprise](https://linearb.io/solutions/enterprise)
- [Contact](https://linearb.io/contact-us)
- [About us](https://linearb.io/about-us)
- [Careers](https://linearb.io/careers)
- [Service agreement](https://linearb.io/services-agreement)
- [Privacy policy](https://linearb.io/privacy-policy)
- [DPA](https://linearb.io/data-processing-agreement)
- [Security FAQ](https://linearb.io/security-faq)
- [Substack](https://devinterrupted.substack.com/)

### Footer

_Additional links from the site footer, not repeated from the top navigation above._

- [GitHub](https://github.com/linear-b)
- [LinkedIn](https://www.linkedin.com/company/linearb)
- [Twitter](https://twitter.com/LinearB_Inc)