AI Engineering Enters Its Audit Era: Agents Move from Generation to Trustworthy Verification

AI engineering is undergoing a paradigm shift: for the past two years, the industry chased "can we build it," but now the most pressing question has become "how do we prove it's correct."

This judgment comes from an unusual dataset — the titles and abstracts of roughly 140 sessions at AI Engineer New York. A conference agenda is a form of triangulation on the current state of technical consensus: what gets submitted and what gets accepted reflects the migration trajectory of practitioners' collective anxieties. The conclusion is clear: this is an agent conference (two-fifths of the sessions have "agent" in the name), but what's more telling is the detail of what people want to do with agents.

The conference is positioned as "the intersection of AI engineering and Wall Street," which actually makes it more valuable as a reference. Finance is a stress-testing ground: in an industry where "mostly correct" equals liability, every decision needs an audit trail, and someone will always ask why. The concerns in this room will soon become everyone's concerns.

Evaluation and Verification Become the Largest Topic Cluster

After agents, the largest topic cluster is evaluation and verification: nearly 20 sessions, with 6 having "trust" in the name. Generation has become cheap; proving it correct is where the work lies. Addy Osmani and Manish Kapur's session asks "who verifies the software factory," while other sessions cover verification loops and the problem of agent fix actions silently breaking other things.

The financial context pushes the conversation from "correctness" toward "defensibility." One session asks directly: when an agent's decision passes all evaluations, can you still defend it after the fact? This may be the sharpest question of the entire conference. Vinoo Ganesh is involved in three sessions, one of which has a single core instruction: don't let the model fabricate numbers.

According to multi-source analysis from Bilibili creators and YouTube tech channels, this trend is also confirmed in the developer community: passing evaluation and winning trust are two different things, and the gap between them will determine the career ceiling for many AI engineers.

Agents Are Becoming the New "Subjects"

About a dozen sessions touch on security, identity, permissions, or payments. We spent twenty years building this tech stack for humans; now we need to rebuild it for software that can act autonomously. The panel discussion on intent-driven authentication brought in Dick Hardt — the lead designer of OAuth 2.0. Other sessions cover agent permissions in regulated industries, financial accounts for agents, and the proposition that "your next user is an agent."

The most intriguing pairing: one session asks "if agents can pay, why don't they," while another catalogs six attack methods against x402 agent payments. Together, the two talks sketch the full adoption curve — the payment rails already exist, trust hasn't caught up yet. If you're running an API, now is the time to ask: what changes when the caller is an agent with a budget?

OAuth 2.0 is the cornerstone of the modern internet authorization system. It solves the core problem of "how a user can authorize a third-party application to access their resources without handing over their password," and its lead designer, Dick Hardt, has become an iconic figure in the identity authentication field as a result. The implicit premise of OAuth 2.0 is that the authorizing subject is a human user, and each authorization corresponds to an explicit, conscious action. When agents begin to act autonomously, this premise breaks down — agents need to continuously access resources without real-time human confirmation, make decisions on behalf of users, and even pay other agents. This is precisely the question that "intent-based authentication" attempts to answer: not verifying "who you are," but verifying "what you're trying to do right now, whether this action is authorized, and whether the scope is controllable." Dick Hardt's personal involvement in such discussions indicates that the identity layer is undergoing a reconstruction of its underlying assumptions, not simply an upgrade of permission configurations.

x402 is an open protocol for agent payments. Its core idea is to let HTTP requests themselves carry payment capability — when an agent calls an API, per-call billing can be completed at the protocol layer without pre-registering an account or binding a human credit card. It compresses "calling" and "paying" into the same action, theoretically making machine-to-machine microtransactions frictionless. But this also introduces a completely new attack surface: malicious agents could forge payment credentials, replay completed payments, induce service providers to deliver resources without settlement, or exploit timing vulnerabilities in the protocol for arbitrage. The article's mention of "six attack methods" precisely demonstrates that although the payment rails are already functional, their security model has not yet been tested through large-scale adversarial scrutiny. For teams operating APIs, this means redesigning authentication, idempotency, and settlement logic rather than reusing payment architectures designed for human users.

Intelligence Has Been Priced

Cost is another strong signal. The agenda includes sessions on token economics, the cost of intelligence, and the hidden costs of faster models. Then Wall Street vocabulary enters directly: compute markets, dark pools for compute, and a talk from the CEO of Compute Exchange. One speaker lounge is simply called "Token Billionaires Lounge."

When people describe GPUs in the language of market structure, compute has become a commodity. AI engineers are forced to start thinking like CFOs: how much will this call cost, and is a stronger model worth it? According to analysis from multiple tech podcasts, this cost awareness is spreading from the financial industry to general AI engineering practice.

"Dark pool" was originally a financial market term referring to private trading venues with undisclosed quotes and opaque execution, used by institutional investors to execute large orders without alerting the market. Applying this term to compute means that GPU and inference resources are forming a wholesale market layer detached from public pricing: large buyers lock in compute through undisclosed channels, prices are not publicly disclosed, and smaller players can only see retail prices in the public market. The emergence of this structure is itself a sign of compute commodification — only when something can be standardized, traded in bulk, and arbitraged does it require dark pools to manage its market impact. For AI engineers, this means that part of the cost advantage will depend on procurement capability rather than technical capability, and model selection and deployment strategy will increasingly resemble supply chain management.

The Engineer's Role Is Being Redefined

Ryan Carson argues that your job is now that of an "agent manager," while Laurie Voss talks about the rise of the product engineer. The direction is broadly correct, but another talk provides a key qualification: stop turning your employees into APIs for agents.

This conference has a distinctly pragmatic orientation, one that can cut through the headlines about frontier models and help us see which topics are truly worth investing energy in. To use the conference's own summary, the daily work of AI engineers is converging into three things: prove the output, define the permissions, pay the bill.

This is the turning point where AI engineering moves from demo-driven to audit-driven. In the future, measuring the maturity of an AI team may no longer be about what it can generate, but about whether it can explain every generated result.

The statement "stop turning your employees into APIs for agents" targets a common organizational misuse: managers treating agents as interfaces that can be called infinitely, requiring employees to respond to requests with the same low latency, frictionlessness, and retryability. The problem is that people are not stateless function calls — every "call" consumes attention, context, and emotion, and cannot be horizontally scaled like an API. When agents take over a large number of routine tasks, the value of human employees shifts precisely to what agents cannot replace: judging ambiguous situations, bearing responsibility for irreversible decisions, and making the call when evaluation results contradict each other. If organizations still assess people by throughput rather than judgment, they will waste the most irreplaceable capabilities on simulating machine behavior.

One-line Summary

AI engineering is shifting from demo-driven to audit-driven, with proving correctness, defining permissions, and paying bills becoming core work.

Paragraph Summary

Based on an analysis of roughly 140 sessions at AI Engineer New York, AI engineering is undergoing a paradigm shift from "can we build it" to "how do we prove it's correct." The conference's largest topic cluster is evaluation and verification (nearly 20 sessions), and the financial context elevates the correctness problem into a defensibility problem — passing evaluation and winning trust are two different things. Agents are becoming new subjects with identity, permissions, and payment capabilities, with discussions around intent-based authentication and x402 payment security emerging as new infrastructure directions. Compute has been commodified by the market, and engineers need to think about costs like CFOs. The engineer's role is being redefined as "agent manager," but there's a need to guard against turning people into APIs for agents. Daily work is converging into three things: prove the output, define the permissions, pay the bill.