How to Build AI Systems People Can Actually Trust | Cillian Kieran, CEO & Founder, Ethyca

The podcast discusses critical concerns around AI decision-making and data governance, emphasizing the risks of autonomous AI systems accessing sensitive business data without proper oversight. It highlights the growing need for ethical AI frameworks, responsible data handling, and technical solutions that go beyond legal compliance to embed governance into system design. A key focus is on building trustworthy technology through structured approaches like purpose-based access control, open standards (e.g., Fides), and semantic layers that ensure data is used appropriately and securely.

The discussion also explores the long-term societal implications of AI, advocating for proactive safety measures - such as harnesses and guardrails - to guide AI behavior rather than restrict progress. It critiques the current "move fast and break things" mentality in tech, calling for a shift toward accountability, especially as AI moves into machine-to-machine interactions. The vision presented centers on creating responsible, human-centric systems that prioritize privacy, transparency, and long-term safety, with an emphasis on solving complex governance challenges over the next decade through engineering rigor and ethical foresight.

• What if you audited your AI agent's data access like a civil engineer inspects a bridge?

  • Move: Conduct a full permissions audit of any AI agent connected to your business tools (e.g., CRM, Stripe, Shopify), mapping exactly which data types (PII, financial, behavioral) it can access and whether that access aligns with its intended purpose.
  • Why Now?: As AI agents become more autonomous, the risk of silent data exposure grows - especially when non-technical founders grant broad permissions without understanding jurisdictional or compliance implications.
  • Expected Upside: Prevent unintended regulatory violations, reduce future liability, and position your product as privacy-by-design compliant before customer or investor scrutiny demands it.

• What if you embedded purpose-based access control into your solo-built SaaS from day one?

  • Move: Integrate an open standard like Fides (or model its logic) to label data types and enforce usage rules - e.g., "This biometric data can be processed only for authentication, not marketing."
  • Why Now?: With AI models increasingly accessing live systems, defaulting to least-privilege, context-aware access prevents misuse even if models are compromised or misdirected.
  • Expected Upside: Differentiate your product in crowded markets by baking in trust; avoid costly refactors later when scaling across regions with conflicting regulations (GDPR vs. CCPA).

• What if you treated your software like critical infrastructure - designing guardrails before launching your next feature?

  • Move: For your next AI-powered feature, build a "harness" (e.g., input/output filters, stateful rule engine) that limits actions based on compliance boundaries, mimicking how race cars use safety systems to maximize performance without losing control.
  • Why Now?: The gap between AI capability and governance is widening - users assume safety, but solo developers are on the hook when things go wrong (e.g., data leaks, hallucinated decisions).
  • Expected Upside: Launch faster with confidence, knowing your system won't act outside ethical or legal bounds - turning trust into a scalable advantage over competitors who move fast and break things.

• Implement purpose-based access control in your software to restrict data usage based on context, ensuring sensitive systems (e.g., Stripe, CRM) are only accessed for legitimate business functions.
• Adopt or integrate open standards like Fides for data labeling and classification to maintain compliance, improve interoperability, and reduce governance complexity across jurisdictions.
• Build explicit data deletion workflows into your product (e.g., using tools like Leithy) to enable automated, auditable removal of user data upon request or policy trigger.
• Design AI agent permissions with least-privilege principles by default, preventing non-technical users from inadvertently granting excessive access to financial or personal data.
• Treat data governance as an engineering problem - codify regulatory requirements (e.g., GDPR, jurisdiction-specific rules) directly into your system logic rather than treating them as separate legal compliance tasks.