Xavi Amatriain, Expedia Group’s inaugural chief AI and data officer, addressed the audience at the VB Transform 2026 conference in Menlo Park, highlighting that “the new PRD are the evals.” He elaborated, “You encode what you want the product to do through your evals, which might include red teaming evals and other components with existing security requirements. These are integrated into the PRD and product design document before any coding begins.” Amatriain emphasized the future role of AI-assisted or AI-generated code, suggesting that “all your thinking is gonna go into the evals.”
Prior to joining Expedia in December 2025, Amatriain was Google’s VP of AI and Compute Enablement, overseeing platforms for Gemini and Google Search. He has also mentored individuals who later founded Perplexity and Scale AI.
Research from VentureBeat’s VB Pulse on the evaluation gap highlights significant concerns. Sixty-six percent of 157 enterprises surveyed allow production deployment without human review or are planning to do so within a year, yet only 5% completely trust the automated evaluations driving these decisions. Notably, half of these companies have released an agent that passed internal evaluations but failed with real customers.
Don’t let guardrails get in the way of feedback
Amatriain discussed the drawbacks of excessive guardrails, stating, “The more guardrails and artificial business rules you put into the system, the worse off. They are brittle and disrupt the feedback loop, biasing user feedback and misdirecting learning.” While he considers guardrails a “necessary evil,” he aims to reduce their impact over time. However, not all attendees at Transform agreed, with some advocating for firm guardrails on high-risk actions.
Expedia’s approach to AI governance involves three layers. First are principles, communicated broadly to guide decision-making in a large organization. “Principles look really nice on a picture on some wall, but you need to then give them teeth,” Amatriain noted. Processes and tools to enforce these principles follow, with automation on top.
This structure includes agent release toll gates—risk-calibrated checkpoints. “Governance needs to correlate to the risk,” Amatriain explained. Low-risk scenarios require minimal governance, while high-risk situations demand more. The toll gates integrate evaluation rounds, red teaming, and security reviews, shifting from recommended to mandatory checks as the risk increases.
Specialized agents over monolithic intelligence
Amatriain expressed skepticism about AGI as a single unified model, advocating instead for specialized agents. “I think it’s much better to think of it as composition, having specialized agents that excel in specific tasks, then composing the system from these agents,” he explained.
Expedia’s architecture builds from the component level, where tools form skills, skills become sub-agents, and sub-agents integrate into the overall system. Unified principles guide tone, user interaction, and context management. Amatriain views this as a systemic design challenge, emphasizing the importance of designing the system rather than focusing on individual models or solutions. Narrowly scoped agents, he argued, are easier to secure since they can be evaluated and secured individually before integration.
When the user must keep the final click
Amatriain outlined a system adapting based on latency needs, blending retrieval-augmented generation with direct API tool calls. “If the user asks you a question like, how much does a four-star hotel usually cost in Chicago in July, you expect an immediate answer,” he said, noting that cached responses suffice when real-time data isn’t essential. A more complex query, like finding a pet-friendly hotel with specific amenities, might allow for a longer response time.
He illustrated the importance of cross-referencing supplier claims with traveler reviews. For instance, a supplier might advertise a great swimming pool, but traveler reviews could indicate otherwise. While a generic chatbot might only relay supplier claims, Expedia’s agent compares these with its own reviews.
Amatriain emphasized user agency, stating, “We don’t want the agent to book the hotel or to buy you a plane ticket for you. The agent can recommend, but you’re gonna have to hit that click. And that’s non-negotiable,” highlighting security considerations in this design principle.
The next attackers will be other AI systems
Addressing security, Amatriain pointed out, “Security needs to be a principle shifted as left as possible and as part of the design itself.” He explained that the need for guardrails often arises from insufficient early planning.
When asked about production lessons, Amatriain described a feedback loop where monitoring signals feed back into the evaluation suite. “You can almost automate the whole cycle,” he said, emphasizing the necessity of integrating real signals from the operating AI system back into the process for rapid reporting and resolution.
Amatriain’s toll gates aim to ensure governance keeps pace with this feedback loop. According to VentureBeat’s June Pulse survey on agent security, 54% of 107 enterprises have encountered an agent security incident or near-miss. Of these, 59% intend to update security tools within a year, and 29% plan to act this quarter. Larger enterprises report higher incident rates, and sandbox isolation drops significantly as company size increases.
Amatriain warned of future threats from other AI systems, stating, “You’re gonna get threats not only from humans but from other external agentic systems that are really powerful, and they’re gonna be poking at everything you’re doing. The time to fix becomes essential.”
