Workshops

Most teams made a person the API between their agents and everyone else: copy the output into chat, paste the reply back into the harness. This hands-on workshop shows the alternative: put the agents where the work is. We use Buzz, Block’s open source, channel-driven workspace where people and AI agents share conversations, repositories, and reviews.

We begin in the middle of a live project, with four people and a swarm of agents working across shared channels and code. Then we rewind and bring the room in. Attendees will join a shared Buzz community, work with an agent, form channels with other participants, and practice delegating, steering, reviewing, and coordinating work as it happens. Along the way, we examine how Buzz approaches portable identity, scoped capabilities, signed work, and collaboration across different agent runtimes and models.

By the end, the room itself becomes part of the workflow: everyone contributes code, assets, and reviews to one shared project in a Buzz-hosted Git repository. Bring a laptop. Leave with practical experience running many agents in one shared workspace, where the whole team can see, steer, and use them.

Speakers:

• Tyler Longwell — Machine Learning Engineer, Block
• Morgan Martin — Product Designer/Builder, Intelligence & Infrastructure, Block
• Wes Billman — Software Engineer, Applied AI, Block
• Taylor Ho — Design Engineer, Block
• Bradley Axen — Creator & Maintainer of Goose; Head of AI Capabilities, Block
• Will Pfleger — Software Engineer, Block

As AI agents move to production, engineering teams face a growing set of challenges. How do you secure and govern MCP servers without modifying them? Route and fail over across multiple LLM providers? Enforce rate limits, access controls, and governance policies? Observe agent traffic, manage context growth, and scale operations across environments?

Rather than embedding these capabilities into every agent, MCP server, and application, organizations can adopt a single architectural pattern: the agent gateway.
An agent gateway acts as a unified control plane for AI systems. It can function as an MCP gateway, LLM gateway, inference gateway, and traditional API gateway, centralizing security, observability, routing, resilience, and policy enforcement across agents, tools, models, and services.

In this hands-on workshop, you’ll learn how to secure and federate MCP servers without code changes, route and fail over LLM traffic across providers, enforce authentication and usage policies, and gain end-to-end visibility into agent interactions. Through live demos, you’ll see how a single gateway layer simplifies operations while enabling secure, scalable, and governable AI systems.

Speakers:

• Lin Sun — Head of Open Source, Solo.io & AAIF Working Group Contributor, agentgateway
• Christian Posta — Global Field CTO, Solo.io

An AI agent with access to private data, exposure to untrusted content, and a path to send data out is structurally exploitable: no amount of system prompt hardening can close this. The model following your access-control instruction is the same model following an attacker’s injected one. Simon Willison, in an essay identifying the threat, named it the “lethal trifecta.” Many teams still rely on system prompts, and injection studies show that’s illusion, not control.

This hands-on workshop builds the architectural alternative: making the capabilities an agent can reach as small as its role requires, so a compromised agent’s blast radius is bounded by design. You’ll take a multi-persona agent system and design its capability surfaces so no single caller’s namespace holds all three legs of the trifecta. We’ll walk an enforcement spectrum: hardcoded tool lists, gateway filtering, structural separation. We’ll look at how to evaluate your system against a clear litmus test: can your system prompt leak and your tool list be published without compromising access control?

You’ll leave with working diagnostic techniques, practice spotting anti-patterns and applying mitigation strategies.

Speakers:

• Zayne Turner — Staff Developer Advocate Engineer, Workato
• Chris Miller — Staff Software Engineer, Workato

When you start building AI agents, the infrastructure choices you make on day one shape how portable, observable, and production-ready your system will be on day 100. Most tutorials hand you a proprietary API key and wish you luck. But real agent systems need inference flexibility, structured observability, and a path from laptop to cluster that doesn’t require a rewrite.

In this workshop, participants will build a working AI agent using the open-source agent-framework on open infrastructure. We’ll wire up local LLM inference through OpenAI-compatible servers like Ollama and vLLM, instrument everything with OpenTelemetry, and stand up a full LGTM observability stack (Loki, Grafana, Tempo, Prometheus) to trace agent behavior and performance and Redis for durable chat history. Every component runs in Docker Compose locally and can port directly to Kubernetes with no code changes.

Participants will leave with a running agent stack they can extend, an understanding of how open inference servers decouple you from proprietary APIs, and hands-on experience wiring observability into agentic workloads.

Participants should bring a machine capable of running Docker and a local LLM server.

Speakers:

• Brian Benz — Principal AI Advocate, Microsoft
• Pamela Fox — Principal Cloud Advocate, Microsoft

Enterprise adoption of the Model Context Protocol is accelerating, and MCP has become the primary way agents connect to enterprise tools and data. But MCP is only part of how agents act. Agents also run CLIs, execute Skills, and generate code that calls APIs directly. Governing MCP well matters. Governing everything else agents can do matters just as much.

Building MCP servers and writing Skills isn’t particularly hard. The real challenges are deciding which actions agents are allowed to take, controlling who can take them, and proving it all later. These are architectural questions, and they need answers before agents scale across an organization.

In this workshop, we will:

1. Show how to control agent actions with policies that apply across MCP servers, CLIs, Skills, and agent-generated code — including allowlists, access control by users and groups, and human-in-the-loop approvals.
2. Explain why enterprises need managed registries for MCP servers and Skills, and how admin review and approval change the trust model.
3. Work through audit and compliance requirements: capturing complete logs of agent and tool activity, exporting to enterprise storage, and generating reports.
4. Demonstrate how to discover shadow AI — unmanaged agents, MCPs, and Skills already running in your organization — and how to block them or bring them under management.
5. Look at token usage and spend visibility by agent, user, and group.

You’ll leave with a clear picture of the architectural decisions ahead of you, and a better sense of what your security team will require before signing off on scaling AI agents across your organization.

Speakers:

• Shannon Williams — President, Obot AI
• Bill Maxwell — Staff Engineer, Obot

The Secure Agentic Framework (SAF) is an open-source, community-driven architecture for defending agentic AI. This hands-on workshop puts an AI skill in participants’ hands: it scans a vulnerable reference environment, surfaces what is exploitable and why, and maps each finding to a concrete mitigation that attendees apply and re-scan to confirm it clears.

We cover SAF’s two core implementations: SAF for MCP, securing the Model Context Protocol for AI tool integration, and SAF for k8s, hardening agentic runtimes in Kubernetes. Built on two years of adversarial research, the SAF for MCP matrix maps 65 attack techniques across 14 tactics, flagging threats like Tool Poisoning, Command Injection, and the MCP Rug Pull. Unlike high-level frameworks such as MITRE ATLAS, it offers the protocol-level specificity dynamic, tool-integrated agents require.

Attendees leave able to identify vulnerabilities in their own deployments, apply SAF controls, and contribute to this open-source framework.

Speakers:

• Sarah Evans — Distinguished Engineer, Dell Technologies
• Jautau “Jay” White — Open Source Software and Supply Chain Security Strategy, Microsoft
• Frederick Kautz — Director of Research and Development, TestifySec
• Laura Guazzelli — Security Architect – AI/ML/LLM/Agentic Systems, The Linux Foundation