By admin 
In a pivotal address at VentureBeat’s VB Transform 2026 conference in Menlo Park, Xavi Amatriain, Expedia Group’s inaugural Chief AI and Data Officer, articulated a paradigm shift in how product development and security are conceived in the era of advanced artificial intelligence. "The new PRD are the evals," Amatriain declared, fundamentally reframing the Product Requirements Document (PRD) not as a static set of specifications, but as a dynamic, evaluation-driven process. This means that desired product functionalities, including robust security measures and resilience against adversarial attacks, are now directly encoded within the evaluation frameworks themselves. These evaluations, which encompass rigorous red teaming and a spectrum of other testing methodologies, inherently embed critical security requirements from the outset of product design, long before any code is written. Amatriain further emphasized that as AI-assisted and AI-generated code become the norm, the locus of intellectual effort will irrevocably shift towards the design and refinement of these evaluations, making them the ultimate embodiment of the product’s intended behavior and limitations.
Amatriain’s insights stem from a distinguished career at the forefront of AI innovation. Prior to his December 2025 appointment at Expedia Group, he served as VP of AI and Compute Enablement at Google, where he was instrumental in developing the platforms that power sophisticated AI models like Gemini and Google Search. His leadership has also extended to nurturing talent who have gone on to establish groundbreaking companies such as Perplexity and Scale AI, underscoring his profound impact on the AI ecosystem.
This strategic reorientation towards comprehensive evaluations is underscored by concerning trends highlighted in VentureBeat’s VB Pulse research on the "evaluation gap." This research revealed that a significant 66% of 157 surveyed enterprises are already deploying AI agents into production without human oversight, or are actively moving towards this model within the next 12 months. However, a stark contrast emerges when considering trust in automated evaluation systems: only a meager 5% of these enterprises express full confidence in the automated evaluations that would underpin such unsupervised deployments. The consequences of this disconnect are palpable, with half of the surveyed companies admitting to having released agents that, despite passing internal evaluations, subsequently failed when interacting with real customers. This highlights a critical vulnerability where internal validation may not adequately reflect real-world complexities and user interactions.
The discussion on "Don’t let guardrails get in the way of feedback" delved into the nuanced challenges of integrating AI into complex systems. Amatriain posited that an overabundance of "guardrails and artificial business rules" can paradoxically hinder progress. He explained that these rigid constraints are not only prone to brittleness – breaking under unforeseen circumstances – but also actively disrupt the crucial feedback loop necessary for continuous improvement. By imposing strict rules, systems can inadvertently bias the user experience and the feedback received, leading to the AI learning and adapting in flawed ways. While acknowledging guardrails as a "necessary evil," Amatriain’s ultimate objective is to systematically minimize their impact over time, fostering an environment where AI can learn more organically from authentic user interactions.
This perspective, however, was not universally shared among all speakers at the Transform conference. A counterargument emerged from other participants who maintained that for actions involving the highest levels of risk, the implementation of exceptionally robust and unyielding guardrails remains paramount. This divergence of opinion underscores the ongoing debate within the industry regarding the optimal balance between AI autonomy and human oversight, particularly in safety-critical applications.
Expedia Group’s approach to AI governance is structured around a multi-layered framework, designed to provide both broad principles and granular control. At the foundational level are clearly articulated Principles, disseminated widely throughout the organization. Amatriain emphasized the importance of encoding these principles at a high level to guide decision-making, especially in large organizations characterized by distributed autonomy. "I like to encode at a very high level how I expect decisions to be made, because in a large organization you’re gonna have a lot of distributed decision making," he stated. While acknowledging that ideally these principles might be embedded in the organizational culture, his experience suggests this is often not the case, necessitating more formalized mechanisms. Following these principles are Processes and Tools designed to enforce them, providing practical implementation. "Principles look really nice on a picture on some wall, but you need to then give them teeth," Amatriain remarked, highlighting the need for actionable enforcement. Automation is then layered atop both principles and processes, providing a final layer of execution and oversight.
In practice, this layered governance translates into Expedia’s "agent release toll gates." These are dynamic checkpoints meticulously calibrated to the inherent risk associated with each AI agent. "Governance needs to correlate to the risk," Amatriain asserted. "And if you have something that is low risk, you don’t need too much governance to get in the way. But if there’s a lot of risk, then you need more governance. That can be encoded." These toll gates systematically integrate evaluation rounds, red teaming exercises, and security reviews, with the stringency of these measures directly correlating to the agent’s risk profile. As the stakes escalate, the checks transition from being recommended to becoming mandatory requirements, ensuring that high-risk applications are subjected to the most rigorous scrutiny.
The conversation then shifted to a vision of "Specialized agents over monolithic intelligence." Amatriain expressed a long-held belief, dating back to his tenure at Google, that the future of AI lies not in a single, all-encompassing Artificial General Intelligence (AGI), but rather in the sophisticated composition of numerous specialized agents. "Even when I was at Google, I was like, I don’t believe in AGI as sort of like a singleton and a unified sort of like single model," he explained. "I think it’s much better to think of it as composition, sort of like having specialized agents that are very good at some task and then composing the system out of those specialized agents."
Expedia’s architectural philosophy mirrors this approach, beginning at the component level. Tools are integrated to form skills, skills are assembled into sub-agents, and these sub-agents are then orchestrated to create comprehensive agentic systems. "You need to have those principles that are unified that talk about things like what is the tone that we’re using, how are we addressing the user, how are we passing context, memory," Amatriain elaborated. "All of that needs to be thoroughly designed." He framed this as a fundamental systemic design challenge, asserting, "It’s not about the model, it’s not about a specific solution, it’s about how you’re designing the system." A significant advantage of this granular, specialized agent architecture is enhanced security. By scoping each agent narrowly, teams can independently evaluate and secure individual components before integrating them, making the overall system more robust and easier to audit. This modularity allows for targeted security enhancements and reduces the attack surface compared to a monolithic AI.
The practical application of this architecture is evident in Expedia’s approach to real-time travel data, where "When the user must keep the final click" is a non-negotiable principle. The travel industry is characterized by volatile pricing, constantly shifting flight availability, and hotel reviews that often diverge from supplier claims. Amatriain described a sophisticated system that intelligently blends retrieval-augmented generation (RAG) with direct API tool calls, dynamically selecting the most appropriate method based on latency requirements. For instance, when a user inquires about the typical cost of a four-star hotel in Chicago in July, the expectation is an immediate response, as this information can be cached and does not require real-time data. "If the user asks you a question like, how much does a four star hotel usually cost in Chicago in July, you don’t expect the agent to take two minutes to answer that question," he stated. "You expect an immediate answer because that answer can be cached and it doesn’t need real-time information." However, for more complex queries, such as finding a pet-friendly four-star hotel near Lake Michigan with a pool, a slightly longer reasoning window of around 30 seconds might be permissible to gather and synthesize more nuanced information.
The system’s ability to cross-reference information is a key differentiator. Amatriain illustrated this by explaining how Expedia handles conflicting information, such as a supplier’s claim of a great swimming pool versus customer reviews that might indicate otherwise. "The supplier might be saying, yeah, we have a great swimming pool, but then we also have the reviews from the travelers and we actually see there’s two reviews that say the swimming pool was not great or was not open after 6 p.m.," he noted. Unlike a generic chatbot that might simply relay the supplier’s self-reported information, Expedia’s agents are designed to cross-reference these claims against its extensive review corpus, providing users with a more balanced and accurate picture.
Crucially, Expedia’s AI agents are designed to empower user decision-making rather than replace it. "We don’t want the agent to book the hotel or to buy you a plane ticket for you," Amatriain emphasized. "That’s something that the user has to have the agency. And the agent can recommend, can suggest, can discuss with you, but you’re gonna have to hit that click. And that’s non-negotiable." This deliberate constraint is not merely a user-centric design choice but also a foundational security decision. By establishing this principle of user agency upfront, the need for extensive post-hoc guardrails to prevent unauthorized transactions is significantly diminished. "Once you establish those design principles, you also don’t need the guardrail because otherwise you’re gonna have to put all those guardrails in after the fact," he explained.
Addressing the evolving threat landscape, Amatriain stated that "Security needs to be a principle that is shifted as left as possible and as part of the design itself." He elaborated that the necessity for guardrails often arises from a failure to adequately consider security during the initial design phases. "And usually when you need a guardrail is because you’ve not thought about it early on." This proactive approach to security is integral to Expedia’s AI development lifecycle.
Reflecting on lessons learned from production, Amatriain detailed a continuous feedback loop where monitoring signals from live AI systems are fed back into the evaluation suite. This allows for rapid iteration and improvement. "You can almost automate the whole cycle," he observed. "But having that whole feedback loop from real signals, from your operating AI system, all the way into being reported and fixed as quickly as possible is going to become essential." This automated feedback mechanism is critical for maintaining the integrity and performance of AI agents in dynamic environments.
Amatriain’s toll gate system represents a strategic bet that governance, meticulously calibrated to risk, can effectively stay ahead of the rapid feedback loop. However, VentureBeat’s separate June Pulse survey on agent security, which surveyed 107 enterprises, reveals the precariousness of this margin. A substantial 54% of these organizations have already experienced an agent security incident or a near-miss. Looking ahead, 59% plan to adopt, add, or replace agent security tooling within the next 12 months, with 29% intending to do so this quarter, indicating a widespread recognition of the escalating security challenges. Incident rates exhibit a clear correlation with organization size, reaching 63% among enterprises with over 1,000 employees, compared to 49% for companies with 101 to 1,000 employees. Furthermore, the adoption of sandbox isolation, a crucial post-breach control that limits damage, decreases significantly with company size, dropping from 35% in smaller companies to just 20% in the largest enterprises.
In a concluding warning, Amatriain highlighted the emerging threat landscape where "The next attackers will be other AI systems." He predicted that future threats will not solely originate from human actors but will increasingly involve sophisticated external agentic systems capable of probing systems with unprecedented efficiency and scale. "You’re gonna get threats coming not only from humans but also from other external agentic systems that are really powerful, and they’re gonna be poking at everything you’re doing," he cautioned. "And as soon as you detect something, it’s not only about the detection, but the time to fix becomes essential here." This necessitates a paradigm shift in cybersecurity, moving from reactive defense to proactive, AI-driven threat detection and rapid remediation, a challenge that Expedia Group, under Amatriain’s leadership, appears to be proactively addressing through its innovative approach to product development and security.
