Loading…
2026 September 10-11 | Tokyo, Japan
View More Details & Registration

IMPORTANT NOTE: Timing of sessions and room locations are subject to change.
Thursday, September 10
 

09:35 JST

Keynote: The State and Future of A2A - Kaz Sato, Staff Developer Advocate, Cloud AI, Google
Thursday September 10, 2026 09:35 - 09:45 JST
As organizations build more capable agents, those agents will need a common way to communicate and work together across frameworks, vendors, and platforms. This keynote examines the current state of A2A, the problems it is designed to solve, and where the project is headed. We'll also see A2A in action through a production multi-agent system, including what happens when one of its agents is compromised.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Kaz Sato

Kaz Sato

Staff Developer Advocate, Cloud AI, Google
Kaz Sato, a Staff Developer Advocate from the Cloud AI team, has authored over 25 ML/AI blogs and demos for Google Cloud's official blog. His work has garnered attention from Jeff Dean and Eric Schmidt, and been featured in Newsweek and The New Yorker. He's a regular speaker at Google... Read More →
Thursday September 10, 2026 09:35 - 09:45 JST
Hall C
  Keynote Sessions
  • Audience Level Any
  • Presentation Language English
  • Presentation Slides Attached Yes

10:15 JST

Towards Trustworthy Autonomous Research - Wataru Kumagai, NexaScience/RIKEN
Thursday September 10, 2026 10:15 - 10:40 JST
Automating scientific research is one of the most important uses of AI agents, and as agents grow more autonomous, it is quickly becoming realistic. We can already let an agent run research that takes hours or even days.
The main challenge is not whether the agent finishes, but how much we can trust the results it reports. A result that looks successful may come from a misunderstood setup or a manipulated metric. Checking it by hand is hard, and asking another agent to check it only moves the problem one step further.
Being too strict is also risky. A good idea does not always give results quickly, and it is easy to find reasons to call a result a failure. A system that rejects too easily throws away promising research, while ideas that lead nowhere should be stopped early. Balancing proper rejection and reliable acceptance is the hardest part of automated research.
Based on my experience running agentic research-automation systems, I will explain how these problems appear in long-running tasks and the approaches we are developing to keep research reliable.
You will leave with a practical framework for trusting and using long-running autonomous agents in research and beyond.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Wataru Kumagai

Wataru Kumagai

Chief Research Officer / Senior Research Scientist, NexaScience / RIKEN
Wataru Kumagai is Chief Research Officer at NexaScience, a Japanese AI startup building agent execution infrastructure, and a Senior Research Scientist at RIKEN. He works on automating the machine learning research pipeline with multi-agent systems. His interests center on the reliability... Read More →
Thursday September 10, 2026 10:15 - 10:40 JST
Hall C
  Building Reliable Agent Systems

10:50 JST

Workshop: Building MCP Authorization with Keycloak and agentgateway - Yoshiyuki Tabata & Michito Okai, Hitachi
Thursday September 10, 2026 10:50 - 12:25 JST
As AI agents move from experimentation to production, authorization is becoming a core architectural concern. The MCP Authorization specification provides a standardized approach for protecting MCP resources and obtaining access tokens, but many developers have not yet seen these mechanisms in action.

In this hands-on workshop, participants will build a secure MCP environment using Keycloak, agentgateway, and MCP Inspector. Starting from an MCP server where all tools are publicly accessible, attendees will progressively introduce authorization controls using Keycloak and agentgateway, and observe how access to MCP tools changes.

Participants will use MCP Inspector to follow authorization flows step by step, including resource discovery, authorization server discovery, user authentication, token acquisition, authorization failures, and authorized tool invocation.

The workshop also explores Step-Up Authorization scenarios introduced in the latest MCP Authorization specification.

By the end of the session, participants will have a working MCP Authorization environment and practical experience securing MCP-based AI agent systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Yoshiyuki Tabata

Yoshiyuki Tabata

Chief OSS Consultant, Hitachi
Yoshiyuki Tabata is a Chief OSS Consultant at Hitachi OSPO with more than a decade of experience in identity and access management (IAM), authentication, authorization, and API security. He is a contributor to Keycloak, a co-author of the CNCF IAM Whitepaper, and serves as Tech Lead... Read More →
avatar for Michito Okai

Michito Okai

Software Engineer, Hitachi, Ltd.

Thursday September 10, 2026 10:50 - 12:25 JST
Hall B
  Workshop
  • Presentation Language English
  • Presentation Slides Attached Yes

11:25 JST

Carbon-Aware Agentic Engineering: Reducing Unnecessary Computation in AI Agent Workflows - Kouki Hama, NTT, Inc
Thursday September 10, 2026 11:25 - 11:50 JST
From a green software perspective, waste in agentic AI comes not only from model choice, but also from workflow design. Agent workflows combine planning, retrieval, retries, memory, tools, and model calls. Poor controls can lead to large models for simple tasks, long histories, repeated retrieval, or needless tool calls, increasing compute, cost, and latency.

This talk presents a design-review approach for reducing unnecessary computation in agent workflows. As a case study, it uses Lean Agentic AI (https://github.com/navveenb/lean-agentic-ai) as an open-source workflow example. For each workflow step, it asks: Is an LLM needed? Is the model appropriate? Is context bounded? Could code, rules, or a smaller model replace a large-model call?

The goal is not precise carbon accounting. Instead, it identifies avoidable inference, oversized context, and needless tool calls before estimating CO2 emissions.

Takeaways:
* See how agent workflow design affects compute, cost, and latency.
* Understand how reducing unnecessary computation supports green software goals.
* Ask simple review questions to reduce unnecessary LLM calls, retrieval, memory, and tool use.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Kouki Hama

Kouki Hama

Senior Research Engineer, NTT, Inc
Kouki Hama is a Senior Research Engineer at NTT, Inc., Computer & Data Science Laboratories. His research focuses on green software engineering and software supply chain assurance, including CI/CD, GreenOps, FinOps, Software Carbon Intensity, and SBOM-based governance. As personal... Read More →
Thursday September 10, 2026 11:25 - 11:50 JST
Hall C
  Agentic Engineering

12:00 JST

Letting an Agent Upgrade Production Kubernetes — Without Getting Paged at 3 AM - Sanskar Agrawalla & Abhijeet Chaudhuri, Quartic.ai
Thursday September 10, 2026 12:00 - 12:25 JST
Kubernetes upgrades are high-stakes, deprecation-laden, and still mostly manual — most "AI for K8s upgrades" projects stop at a feasibility check. We went further: we built an agentic system that planned and executed a real cluster upgrade end to end, and in this talk we walk through exactly how it went, with the steps, evidence, and screenshots from our actual runs.


We'll break down the architecture we shipped — a planner → executor → verifier loop, deprecated-API and CRD/Helm compatibility analysis run before anything touched the cluster, a human-in-the-loop approval gate for irreversible steps, and health-gated automatic rollback. Using captured logs and screenshots, we'll show a real multi-node upgrade as it happened, the failure cases that nearly broke it (version skew, stuck drains, webhook deadlocks), and the decisions we deliberately refused to let the model make.

You leave with an open-source blueprint for autonomous infra agents with production-grade guardrails — plus real numbers on success rate, time saved, preflight catches, and rollbacks triggered.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Sanskar Agrawalla

Sanskar Agrawalla

Site Reliability Engineer, Quartic.ai
👋 Site Reliability Engineer at Quartic.ai | Tech Enthusiast

Hey there! I'm a Site Reliability Engineer with a passion for building impactful solutions. Currently, I'm working on cutting-edge projects that drive innovation. From enhancing monitoring processes to optimizing infrastructure, I'm all about crafting efficient and secure systems... Read More →
avatar for Abhijeet Chaudhuri

Abhijeet Chaudhuri

Site Reliability Engineer, Quartic.ai
Site Reliability Engineer who runs a production distributed system on Kubernetes — Kafka, Spark, Airflow, and a fleet of edge devices — where long-running operations are a daily reality, having experience in implementing scalable cloud-native solutions across Kubernetes, AWS... Read More →
Thursday September 10, 2026 12:00 - 12:25 JST
Hall C
  Building Reliable Agent Systems
  • Audience Level Any
  • Presentation Language English
  • Presentation Slides Attached Yes

12:00 JST

Sponsored Session: Same Prompt, Different Agent: Building an Assembly Line for Agents - Kan Wang, Raytone
Thursday September 10, 2026 12:00 - 12:25 JST
Run the same prompt twice and you get two different agents. Both work. Neither is the same. If you ship agents to customers rather than demos, this is a failure mode you already know, and it is why agent work has not industrialized.

Today's AI coding is 3D printing: brilliant for one-offs, unreliable at scale. Assembly is the alternative, and agents have finally converged enough to make it possible. They have a bill of materials: model, harness, interface layer, state, tool integrations. Open source ships every part. Nobody ships the guarantee that two of them work together.

You will leave with the six-station line we run, why moving the model from author to assembler cuts variance and token spend at the same time, the compatibility matrix we maintain, and the list of component pairs that deadlock, which is the part almost nobody publishes.

We will also name what assembly does not fix, and where reproducibility stops being enough.


In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Kan Wang

Kan Wang

Co-Founder, Raytone
Kan leads international Token business development at Raytone, with over 11 years of experience in global cloud services, AI data, and enterprise technology partnerships. He previously worked in Business Strategy and Innovation at ByteDance, developing international business models... Read More →
Thursday September 10, 2026 12:00 - 12:25 JST
Hall 1F
  Building Reliable Agent Systems
  • Audience Level Any
  • Presentation Language English
  • Presentation Slides Attached Yes

13:30 JST

Designing Trust Boundaries for Agent-to-Agent Systems: Lessons Learned from a Technical PoC - Ryuji Iijima, Softbank Corp.
Thursday September 10, 2026 13:30 - 13:55 JST
As AI agents increasingly invoke tools, access enterprise data, and collaborate, a new architectural challenge emerges: Where should trust boundaries be defined, and where should governance and security controls be enforced?

To explore this, we conducted a technical PoC introducing a shared control layer across agent-to-agent communications and tool execution pathways. Rather than presenting an ideal architecture, this session focuses on practical challenges and lessons learned during implementation.

Key topics include:
- Defining the "Agent": How to define what constitutes an agent in an ecosystem and where to establish trust boundaries for validation, monitoring, and control
- Architectural Insights: Redesign considerations and insights that emerged through prototype development and PoC activities.
- Performance Trade-offs: Balancing stronger security and governance with the low-latency requirements needed for real-world deployment.

We will share practical takeaways on designing trust boundaries and navigating trade-offs among security, governance, and operational performance.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Ryuji Iijima

Ryuji Iijima

Engineer, AgentSecOps Platform Initiative, SoftBank Corp.
An engineer with experience in mobile authentication, enterprise communications, data integration platforms, and AI security. He is interested in how trust can be established, maintained, and governed across complex distributed systems. His current work focuses on AI agent ecosystems... Read More →
Thursday September 10, 2026 13:30 - 13:55 JST
Hall C
  Building Reliable Agent Systems
  • Presentation Language Japanese
  • Presentation Slides Attached Yes

13:30 JST

Do Tools Still Matter? MCP Tool Design in the Age of Code Mode - Ruben Casas, Postman
Thursday September 10, 2026 13:30 - 13:55 JST
The first wave of MCP adoption was defined by abundance. Every API endpoint became a tool, every workflow became a collection of tool calls, and many servers exposed hundreds of operations directly to agents. It worked, but at a cost: bloated context windows, slower tool selection, and increasingly unreliable agent behaviour.

But then Code Mode appeared!

With approaches Code Mode agents can search an API surface, generate code, and interact with services directly. If models can consume entire APIs and write code to acomplish a task, does tool design still matter?

In this talk, we'll compare three approaches to agent tooling: curated workflow-oriented tools, tool discovery and search, and Code Mode's search-and-execute model. Using real-world examples, benchmarks, and evals, we'll explore the trade-offs in reliability, latency, token usage, and task success.

Attendees will leave with a practical framework for deciding when to consolidate tools, when to expose APIs, and whether the future of MCP is better tools or fewer tools altogether.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Ruben Casas

Ruben Casas

Staff Engineer, Postman
Ruben Casas is a Google Developer Expert and Staff Engineer at Postman. He builds developer tooling, AI agents, and MCP apps, and writes about frontend architecture at scale and AI. Ruben is a podcast guest and has spoken at major conferences, sharing insights from large-scale migrations... Read More →
Thursday September 10, 2026 13:30 - 13:55 JST
Hall 1F
  MCPCon

14:05 JST

The Agent Builder Loop from Daily Work to OSS - Minoru Onda, KDDI Agile Development Center Corporation
Thursday September 10, 2026 14:05 - 14:30 JST
AI agent discussions often focus on coding or MCP. My starting point is different. I use coding agents such as Claude Code and Codex as assistants for work beyond development. Instead of automating isolated tasks, I keep them beside me as a secretary and knowledge platform for routine operations, speaking requests, internal coordination, slide preparation, and customer-facing project delivery.

That daily use reveals agent-worthy problems. With Markdown, Git, Google Workspace, and MCP in the loop, work becomes context an agent can read, improve, and hand back. I then turn those problems into agents I build, deploy, review, and operate myself.

I will cover Vibe Presales, my term for turning a customer's concerns, constraints, and reactions in a presales conversation into a working demo while the context is fresh. I will also share lessons from a PowerPoint-building agent, including design, deployment, review, and output quality for real slide and proposal work.

These lessons become OSS code, articles, books, and hands-on material. Attendees leave with a loop for living with agents at work, building reliable systems, and sharing reusable lessons.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Minoru Onda

Minoru Onda

KDDI Agile Development Center Corporation
Technology Evangelist, KDDI Agile Development Center Corporation
Thursday September 10, 2026 14:05 - 14:30 JST
Hall C
  Building Reliable Agent Systems

15:35 JST

Stop Giving Agents Tokens: Securing With Side-Car Proxies - Ritwik Ranjan, Independent Contributor
Thursday September 10, 2026 15:35 - 16:00 JST
As autonomous agents move from experimental scripts to production systems, we’re exposing a massive flaw in how they’re built. We are giving LLMs the power to execute code, access files, and make network requests—essentially turning them into untrusted programs with direct authority over our infrastructure.

Prompt injection isn’t just a model quirk; it’s an open door to a massive attack surface. The moment an agent processes untrusted data, that input can hijack generated code, trigger outbound requests, and lead to data leaks or Server-Side Request Forgery (SSRF). Without proper guardrails, a highly capable agent is just a friendly interface over a Remote Code Execution (RCE) vulnerability.

This session reframes the entire security challenge. Instead of wasting time trying to make the model perfectly "safe," we’ll look at how to design infrastructure that stays secure even after the agent is compromised. By enforcing strict policy gates, we ensure that even if an agent is hijacked, it cannot access secrets, traverse your network, or execute privileged actions.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Ritwik Ranjan

Ritwik Ranjan

Software Engineer, Independent Contributor
Ritwik Ranjan is a systems-focused software engineer with a track record of building resilient, high-scale cloud platforms. With prior engineering experience across Microsoft Azure Core and Amazon Web Services (AWS), he brings a strong foundation in distributed infrastructure, runtime... Read More →
Thursday September 10, 2026 15:35 - 16:00 JST
Hall C
  Building Reliable Agent Systems

16:10 JST

Building an AI for Security Exception Tickets: What Actually Worked - Juan Corena, Woven by Toyota
Thursday September 10, 2026 16:10 - 16:35 JST
This session presents a lightweight AI assistant built to help a Security Assurance team review policy exception tickets more efficiently. The assistant summarizes tickets, generates follow-up questions, and maps requests to internal standards to support faster reviews.

The solution uses GitHub Workflows, a custom MCP server and client written in Go, ServiceNow integration, and Python-based evaluation. We used RAGAS to assess relevance and hallucination risk, and verified that the assistant retrieved internal standards through MCP calls.

We will share early results, including meaningful time savings in ticket review, as well as practical challenges such as stakeholder alignment, service account access, and the difficulty of evaluating correctness in security workflows. Attendees will leave with a practical blueprint for building a standards-grounded AI workflow for security review. In our implementation, the initial review step dropped from about 60 minutes of manual effort to about 50 seconds of automated generation plus validation, a time savings of roughly 98.6% per ticket.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Juan Corena

Juan Corena

Senior Software Engineer, Woven by Toyota
Juan Corena is currently an Application Security Engineer at Woven by Toyota working on security automation, dynamic analysis and internal cryptographic standards. Previously, he worked in privacy compliance for ad networks, digital assistants, information security research and as... Read More →
Thursday September 10, 2026 16:10 - 16:35 JST
Hall C
  Building Reliable Agent Systems

16:45 JST

Intent as Code: Why Existing Permissions Aren’t Enough for AI - Masaya Nakamura, Studist
Thursday September 10, 2026 16:45 - 17:10 JST
MCP grants AI agents access to file systems, Git, cloud, and SaaS. Yet permission models — IAM, OAuth scopes, PATs — were built for humans and fall short for AI.

The issue isn’t granularity. Existing permissions assume “human rationality” as a boundary: write access doesn’t mean a human wipes a repo; CI write access doesn’t mean a human exfiltrates secrets. Permissions stay broad because human judgment fills the gap. AI lacks this buffer — through prompt injection or edge cases, it acts destructively where a human would stop. Per-call approval collapses under fatigue.

As an SRE on strong production credentials, my question wasn’t “how to restrict AI” but “how to maximize safe delegation.”

I propose Intent as Code: coding what was left to human rationality. Three OSS tools:
safe-push rejects pushes touching .github/ or others’ commits, preventing CI hijacking
safe-gh wraps gh CLI with conditions like “only own issues” or “only approved PRs to develop” — expressing intent PATs can’t
safe-webfetch uses Claude Code Hooks to auto-allow learned-safe URLs, cutting fatigue decisions

Attendees leave understanding why permissions fall short for AI, with patterns to apply.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Masaya Nakamura

Masaya Nakamura

Super Engineer, studist
Super Gokigen Engineer
Thursday September 10, 2026 16:45 - 17:10 JST
Hall C
  Human-Agent Collaboration

17:20 JST

Legacy Meets LLM: Giving Frontier Models a Telephone (PSTN) Over MCP - Shinya Saito, Gen-AX Corp
Thursday September 10, 2026 17:20 - 17:45 JST
A web service exposes /health; a phone line exposes nothing. The telephone is the oldest telecommunication tool still in production — and our LLM voice agents answer customer calls over it, with no way to know whether they are answering, hearing, and behaving correctly right now.

So we gave a frontier model a telephone.

Our MCP server gives any LLM a phone: dial PSTN numbers, speak via TTS, and read the other side via silence-detected transcripts. A frontier model becomes the caller, phoning our production voice agents in an agent-calls-agent loop — one mechanism covering the whole testing spectrum: ping-style health checks, deep evaluation via scripted and adversarial conversations, and load testing with concurrent caller fleets.

We cover the MCP tool design for a domain the spec wasn't written for — tools that block for tens of seconds, turn-taking over live audio, per-call session state — where the spec fought us and what we would feed back, plus what broke: timeout cascades and evaluations that flap.

We are open-sourcing the server. You'll leave knowing how to connect your own agent to the PSTN — and how to ping, probe, and load-test anything that answers a phone.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Speakers
avatar for Shinya Saito

Shinya Saito

Backend Engineer, Gen-AX Corp
Shinya Saito is a Product Engineer at Gen-AX developing X-Ghost, an enterprise voice AI platform. He builds production voice agents and telephony infrastructure, spanning observability, evaluation, and large-scale testing. Recently he has used the Model Context Protocol (MCP) to connect... Read More →
Thursday September 10, 2026 17:20 - 17:45 JST
Hall 1F
  MCPCon
 
Friday, September 11
 

11:30 JST

MCP-Powered Crash Investigation: How 11 MCP Servers Help an AI Agent Debug Production Issues at Uber - Kriti Dangi, Uber
Friday September 11, 2026 11:30 - 11:55 JST
Debugging eats 42% of developer time — $300B lost globally every year. On an average, fixing an issue takes 15 days. Debug Assist does it in 30 minutes — issue alert to validated, reviewable PR.

Most AI debugging tools stop at root cause analysis. Debug Assist goes much further: it writes a fix, validates it in a loop till correct, and creates the PR. Example, It caught a crash at 5% rollout, landed the fix the same day — preventing it from reaching thousands of users. Built on LangGraph with 11 MCP servers, 5 plugins, and parallel subagents: Sourcegraph for code search, crash analytics, Jira, feature flags, Jaeger, and logging — all one protocol.

Debug Assist even works on user-reported bugs which have minimal information attached. A user complained of battery drain, and Debug Assist traced it to a hot-looping code path, producing an RCA from behavioral evidence alone.
Domain knowledge lives in markdown skill files in a plugin marketplace — any developer can contribute fix patterns with no code, no redeployment.

We'll share how we built this from ground up, scaled to 5,000 RCAs/month across 6 languages, the challenges we hit, and how we improved the acceptance rate from 5% to 30%.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Kriti Dangi

Kriti Dangi

Senior Software Engineer, Uber, Uber
Senior software engineer on the App Quality and Production Observability at Uber. Spent 3 years working on crash analytics platform, before designing and deploying Debug Assist. I love to dance, swim and travel in my free time. You can often find me chatting away with friends!

Friday September 11, 2026 11:30 - 11:55 JST
Hall 1F
  MCPCon
  • Audience Level Any
  • Presentation Language English
  • Presentation Slides Attached Yes

12:05 JST

The Model and the Mask: An Actor's Method for Engineering Agent Character - Nick Howden-Steenstra, Independent
Friday September 11, 2026 12:05 - 12:30 JST
Every agent system is two things: the model, which you rent, and the mask - the character - which is yours. The industry keeps upgrading the model and expecting the mask to improve. It doesn't work that way.

I'm a LAMDA-trained actor turned agent engineer. This talk is the actor's toolkit applied to shipped systems. Case one: a comms pipeline in production at a major crypto protocol - the generating model does Stanislavski table-work (super-objective, through-action, lining) before writing a word; a separate director model audits it blind; and voice is scored by a Laban Movement Analysis classifier that grades the human-written corpus and the machine's output on the same instrument. Brand voice becomes a falsifiable measurement. Case two: the home lab - eleven agents built with a Stanislavski character method, orchestrated over MCP, running my actual work.

You'll leave with the model/mask distinction, a character pipeline you can copy, and the failure modes: drift, voice collapse, paint-by-numbers slop.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Nick Howden-Steenstra

Nick Howden-Steenstra

Agent-Systems Engineer, Independent
Nick Howden-Steenstra trained at LAMDA and spent years building characters on stage; now he builds them as infrastructure. At a major crypto protocol he made brand voice falsifiable - generation gated by Stanislavski table-work, output graded by a Laban Movement Analysis classifier... Read More →
Friday September 11, 2026 12:05 - 12:30 JST
Hall 1F
  Human-Agent Collaboration

13:40 JST

Stateful Sandboxes for Stateless Agents: Designing Durable Volumes for MCP Tool Workspaces - Rui Su, Juicedata
Friday September 11, 2026 13:40 - 14:05 JST
Agent sandboxes are often described as ephemeral, but real MCP tool workflows are not. Agents edit files, install dependencies, run tests, download inputs, generate reports, and resume after failures. When workspace state is treated as disposable, reproducibility, isolation, and debugging become unnecessarily painful.

This talk presents a practical framework for designing durable volumes in agent sandboxes. Through a structured checklist — covering lifecycle management, tenant isolation, quotas, snapshots, read-only sharing, dependency caches, artifact retention, remount recovery, and audit trails — attendees will learn how to reason about workspace state systematically.

We then map these requirements to Kubernetes PersistentVolumes and explore the tradeoffs using JuiceFS CSI as a concrete open-source example. JuiceFS is used for its strong Kubernetes integration and snapshot capabilities, though the framework applies equally to local containers, serverless environments, and remote tool sandboxes.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Rui Su

Rui Su

Co-founder, Juicedata, Inc.
Rui Su is the co-founder of JuiceFS, an open-source distributed file system built on object storage.
Friday September 11, 2026 13:40 - 14:05 JST
Hall C
  Building Reliable Agent Systems
  • Audience Level Any
  • Presentation Language English
  • Presentation Slides Attached Yes

13:40 JST

From Clicks To Context: Building an Open-Source Evaluation Pipeline for AI Agents - Inês Bolaños, PagerDuty
Friday September 11, 2026 13:40 - 14:05 JST
The AI industry has moved so fast that we are still evaluating probabilistic software using the same deterministic metrics we applied to traditional code. As a Product Analyst working on AI agents at PagerDuty, I saw a critical need for a new observability standard, one that moves beyond clicks to measure true reasoning and reliability. To address this, I’ve developed and open-sourced a specialized framework designed to help teams decide, with data, when to hire, train, or fire an AI agent. In this session, I will walk through the H.I.R.E. Framework methodology and share the technical architecture of an evaluation pipeline that turns qualitative conversational data into structured, actionable product insights. I will share the open-source repository containing these metric definitions and templates, providing resources for the community to move past agent-washing and toward building verifiable, trustworthy agentic systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Inês Bolaños

Inês Bolaños

Senior Product Analyst, PagerDuty
Inês Bolaños focuses on the intersection of AI, product strategy and data reliability. With almost a decade of experience, she specializes in turning complex data into actionable product decisions. Combining a background in Communication with a Master’s in Big Data, Inês is helping... Read More →
Friday September 11, 2026 13:40 - 14:05 JST
Hall 1F
  Evals & Testing

14:15 JST

What's Actually Running in Your Coding Agent: The Shadow AI Stack - Alexander Frazer, Runlayer
Friday September 11, 2026 14:15 - 14:40 JST
"Every MCP server, skill, and plugin in your coding agent is code or instructions you never really reviewed, running with your access to your database, your repos, and your keys. Three different ways in, and almost nobody is watching any of them."

Most of the agent security conversation is about prompt injection. Meanwhile there are three underserved vectors sitting right inside the tools you use every day:

- **MCP servers** run with the same access you have. One can look clean when you approve it and change its behavior later, or pull in a compromised dependency on the next run.
- **Skills and instruction files** (`SKILL.md`, `AGENTS.md`, `CLAUDE.md`, rules files) are just text. Nothing to install, nothing to flag. They quietly reshape what your agent does, and hidden instructions, zero-width characters, and pipe-to-shell tricks ride in the same way.
- **Plugins** bundle the first two together and ship through marketplaces with uneven vetting, so a single install can bring in both an MCP server and a skill you never opened.

I'll show where each one lives on disk, why the usual tooling misses it.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Alexander Frazer

Alexander Frazer

Founding Security Engineer, Runlayer
Alexander Frazer is a Founding Security Engineer at Runlayer, where he works on securing AI agents and the MCP ecosystem. He chairs the AAIF Security & Privacy Working Group, leading the effort to build community consensus around agentic security and privacy standards and best practices... Read More →
Friday September 11, 2026 14:15 - 14:40 JST
Hall C
  Building Reliable Agent Systems

14:50 JST

Building an Agentic Software Factory - Valentin De Matos, Delphi
Friday September 11, 2026 14:50 - 15:15 JST
AI coding agents are useful in isolated demos; the hard problem is making them controlled enough to ship production code. At Delphi, we built an agentic software factory that turns product specs and engineering tickets into scoped pull requests, then routes those PRs through reviewer agents, CI, browser verification, and merge gates.

This session breaks down the operating system around the agents: how we package repo context, encode architectural rules, isolate attempts in worktrees, make agents cite source-of-truth patterns, prevent drift from legacy code, and decide what should stay human-controlled. I will also cover failure modes we hit in production: stale context, over-broad diffs, flaky tests, review spam, false confidence, and agents copying the wrong pattern.

Attendees will leave with a practical blueprint for moving from “agent writes code” to a controlled delivery pipeline for agent-generated software.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Valentin De Matos

Valentin De Matos

AI Engineer, Delphi
AI Engineer at Delphi AI in San Francisco, Valentin builds production AI systems for digital twins, agent behavior, and AI-assisted engineering workflows.
Friday September 11, 2026 14:50 - 15:15 JST
Hall C
  Agentic Engineering

15:35 JST

Trace-Based Evaluation of Open-Weight Coding Agents: Measuring Real Agent Behavior - Kota Tsuyuzaki, NTT DOCOMO BUSINESS, Inc.
Friday September 11, 2026 15:35 - 16:00 JST
Teams are moving coding agents onto self-hosted open-weight models to control inference cost, and real sessions routinely span tens of turns and hundreds of thousands of tokens. But the only common signal for judging those models is the static accuracy benchmark, which says little about how a model behaves across a real, multi-turn session.

This session closes that gap with a trace-based evaluation method built on open technology: OpenTelemetry for capture and MLflow for analysis. Through a case study tracing real Claude Code sessions on a 120B-class open-weight model and a frontier model, it surfaces behaviors no leaderboard reports. For example, in the sessions we traced, the model's logged reasoning recorded a user's constraint, and the same turn violated it. An accuracy score sees only the wrong action; the trace shows the model had the rule in hand and did not follow it.

Attendees leave with a reusable observability architecture for their own agents, metrics that go beyond accuracy, and a clear view of what running a coding agent on open weights actually costs, in reliability and not only in dollars.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Kota Tsuyuzaki

Kota Tsuyuzaki

Engineering Manager, NTT DOCOMO BUSINESS, Inc.
Kota joined Nippon Telegraph and Telephone Corporation in 2010 and has been a core developer of OpenStack Swift, the open-source on-premise cloud storage. He later moved into the AI/HPC area, working with the Lustre file system and Slurm Workload Manager. In 2023 he joined NTT DOCOMO... Read More →
Friday September 11, 2026 15:35 - 16:00 JST
Hall B
  Evals & Testing

15:35 JST

Built for Two: What Design Systems Are Missing When AI Agents Become the Third User - Karen Ng, Endor Labs
Friday September 11, 2026 15:35 - 16:00 JST
AI coding agents now generate UI from component libraries. Most teams write component markdown files and expect agents to take it from there. The docs were complete. Agents still got it wrong.

Sitting with engineers in code review, the same things kept surfacing: the agent picked a visually similar but wrong component; it invented props; it read "Tag" as a UI primitive when the codebase meant a security concept. One author. No review process. A library too large for any agent to navigate without a map.

Not a component library talk. A talk about what the workflow was missing when the docs were already done.

I'll walk through the workflow that came out of those sessions: why a component file needs more than one author before agents can trust it; how an index changes what agents can find; and the naming decision that was invisible to humans and catastrophic for agents. Including the moment the team realized the problem wasn't the docs.

You'll leave with one reframe: a component library has always had two users. It now has a third. Here is what the workflow looks like when you build for all three.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Karen Ng

Karen Ng

Principal Product Designer, Endor Labs
Karen Ng designs AI-driven products for security engineers and oncologists. She leads UX at Endor Labs, where she has built AI agent governance, code scanning, and security workflow products from scratch. A three-time internal hackathon winner, she prototypes in code as readily as... Read More →
Friday September 11, 2026 15:35 - 16:00 JST
Hall 1F
  Human-Agent Collaboration

16:10 JST

Workshop: Building Secure & Discoverable Agent Infrastructure with agentgateway & agentregistry - Mehmet Hilmi Emel, ACEDEMAND IT Consulting Services
Friday September 11, 2026 16:10 - 17:45 JST
As AI agents move from local tests to real-world use, developers face a big problem: How do we easily find, direct, secure, and track AI traffic going to MCP servers? Standard API gateways do not understand LLM tool calls, and writing static lists of agents is too hard to manage.

In this hands-on workshop, we will connect AI agents and external tools easily using the standalone versions of Solo.io’s agentgateway and AgentRegistry. We will show you how to build a strong control layer for the Model Context Protocol (MCP) using simple local tools like Docker.

Participants will learn how to:

  • Discover: Run AgentRegistry locally to list, version, and find MCP servers dynamically.
  • Control: Set up agentgateway as a smart proxy to catch and manage agent requests.
  • Secure: Add AI-specific rules, like rate limits and basic access control, to agent tool calls.
  • Observe: See exactly which tools the agents are using and how fast they respond.

Join us to learn how to build a safe, easy-to-run foundation for your multi-agent systems right on your laptop!

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Mehmet Hilmi Emel

Mehmet Hilmi Emel

AI Engineer, Acedemand IT Consulting
As a AI System Engineer, I specialize in securing AI agent interactions at the infrastructure level. I have extensive experience designing AI-driven MCP architectures and tackling the complex security challenges of GenAI on Kubernetes. I build open-source blueprints for zero-trust... Read More →
Friday September 11, 2026 16:10 - 17:45 JST
Hall B
  Workshop

16:45 JST

MCP × A2A Platform for the Enterprise: Security by Spec - Masaki Tsukada, Mitsubishi Electric Corporation
Friday September 11, 2026 16:45 - 17:10 JST
Open protocols like MCP and A2A let you combine agents and tools from different teams into one system.

But at company-wide scale, new challenges arise: who can access the system, who can call which agent, whether it fails safely, and whether it follows internal governance. Coding agents now write most of the code, so the spec we give them shapes the whole system's quality.

We'll share how we tackled this from two sides on a company-wide MCP × A2A platform.

Architecture side: where to declare per-agent access, how to handle attribute-based authorization, how to split the write and read sides of authorization data, and how to stay fail-closed, mapped to standard authorization-control models.

Development-process side: a multi-stage review of the requirements given to coding agents, covering format, clarity, cross-walk with external standards, and adversarial testing. This catches auth and governance issues, plus input validation flaws and data leakage, before code is written.

You'll come away with ideas for an interoperable MCP/A2A authorization layer, a reusable way to gather enterprise-grade requirements, and a view of specs themselves as security assets.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Masaki Tsukada

Masaki Tsukada

Lead, Multi-Agent Platform, AX Innovation Center, Mitsubishi Electric Corporation
Masaki Tsukada is a member of the AX Innovation Center, where he leads the development of a company-wide multi-agent platform. As part of the AI Center of Excellence, he shares the latest generative AI technologies and know-how across the group to drive business transformation. He... Read More →
Friday September 11, 2026 16:45 - 17:10 JST
Hall C
  Interoperability & Standards

16:45 JST

Externalizing Agent State: Memory and Filesystem Management for Sandboxed Coding Agents - Tadatoshi Sekiguchi, PingCAP
Friday September 11, 2026 16:45 - 17:10 JST
Coding-agent harnesses such as Claude Code, Codex, and OpenCode are widely used as general-purpose agent platforms, customized with Skills and Tools and run inside sandboxes. But these agents are stateless by design: when a session ends or a sandbox is torn down, context and artifacts disappear. Running them in production for many users over months turns memory and artifact management into hard problems.

This session shares how we run multiple harness-based agents in sandboxes, and introduces two open-source tools we built to externalize agent state. mem9 (github.com/mem9-ai/mem9) records sessions through harness hooks and, at the next session, runs hybrid retrieval over past sessions from the user's instruction, injecting only relevant history—persisting sessions while compressing context and cutting token usage. drive9 (github.com/mem9-ai/drive9) is a cloud filesystem FUSE-mounted into each sandbox, persisting artifacts beyond sandbox lifetimes, auto-attaching metadata, and enabling semantic search over outputs.

Attendees will leave with a vendor-neutral, open-source architecture for agent memory and storage that works across any harness, plus lessons from real operation.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Tadatoshi

Tadatoshi

Technology Evangelist, PingCAP
Tadatoshi "Seki" Sekiguchi is a Technology Evangelist at PingCAP Japan, promoting PingCAP's AI technologies through public talks and hands-on workshops, and driving TiDB/NewSQL adoption since 2022. He has 20+ years in financial-services systems as an architect, DBA, and PM, with senior... Read More →
Friday September 11, 2026 16:45 - 17:10 JST
Hall 1F
  Open Source Tools

17:20 JST

From Logs to Proofs: Cryptographic Compliance for Agentic Payments - Aggre Hiroyuki, Lemma Oracle
Friday September 11, 2026 17:20 - 17:45 JST
Most agentic payment systems enforce compliance through post-hoc log monitoring: detection after the fact, not prevention. This talk argues that cryptographic proof can replace compliance theater: an agent generates a zero-knowledge attestation that its intended payment satisfies policy constraints before execution.

We present Trust402, an open-source protocol demonstrating this model in production. Agents produce zero-knowledge proofs that verify spend limits, role permissions, and regulatory constraints. Circuits are proof-system-agnostic, enabling post-quantum upgrades without policy-layer changes.

Concrete takeaways:
  • The wrapFetchWithProof pipeline: ZK proof generation composes into x402. No valid proof, no payment
  • The role-spend-limit circuit: LessEqThan constraints mapping role membership and spend limits to provable gates
  • Verification: ephemeral proofs, on-chain attestation per transaction
  • Trade-offs: proving time vs. trust model, circuit expressiveness vs. policy complexity

Attendees leave understanding where ZK proofs fit in agentic payments, what's production-ready, and where the hard problems remain.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.
Speakers
avatar for Aggre Hiroyuki

Aggre Hiroyuki

CTO, FRAME00, Inc.
CTO at FRAME00, Inc., building "Lemma", a verifiable trust infrastructure for AI agents and payments. Works at the intersection of zero-knowledge proofs (Groth16, Circom), blockchain protocols, and autonomous agent systems. Creator of Trust402, an open-source ZK payment attestation... Read More →
Friday September 11, 2026 17:20 - 17:45 JST
Hall 1F
  Agentic Commerce
 
Share Modal

Share this link via

Or copy link

Filter sessions
Apply filters to sessions.