Phani Pendurthi
Mastercard, Principal Software Engineer
Union, Missouri, United States
Actions
I’m a Principal Software Engineer at Mastercard with 18 years of experience across software engineering, data analytics, distributed and large-scale systems. I’ve built and optimized software architectures globally in payments, banking, telecom and manufacturing, worked across multiple countries, and mentored engineers and organizations. I explore AI, Payments, HPC, and emerging technologies to create systems that are scalable, high-performance, efficient, reliable and importantly secure systems.
Links
Area of Expertise
Topics
Beyond the Transaction: Securing Intent, Identity and Trust in the Agentic Commerce Stack
AI agents are no longer just answering questions but acting on them. Autonomous agents are initiating real payments on real card rails, on behalf of real users. The commerce layer above those rails is fragmenting into at least four competing protocols (AP2, ACP, UCP, and the card networks' agent-aware tokenization). The hard question is not which protocol wins, but how you build a system that is safe regardless of which one, or combination, you speak.
This is my working architect's tour of the Agentic Commerce Stack: payment rails, AP2/ACP/UCP mandates, agent identity, merchant integration, and the seams between them. Where identity lives, where intent lives, where trust must be cryptographically proven, how liability flows.
From an independent security analysis of AP2, eight attack classes are understood. Three are universal across every protocol and framework: intent drift, mandate replay, and over-broad delegation. I frame all eight; I go deep on three.
The industry's response has converged on three frontiers, each mapping to one failure:
Cryptographic proof of intent (signed, scoped mandates) answers intent drift.
Decentralized agent identity (Know-Your-Agent registries, FIDO attestation) answers impersonation and over-broad delegation.
Accountable audit trails across buyer,agent,developer,merchant answer mandate replay and dispute.
I walk an end-to-end transaction for each: discovery, intent capture, delegation, authorization, settlement, dispute. Marking every place a control belongs. Halfway through, I leave the slides. The reference at github.com/phanipendurthi/ap2-jwt-security (Apache 2.0) demonstrates JWT mandate signing, replay defenses, intent-binding tests, and a runnable buyer-agent-merchant-network loop. I run it live, then break each defense.
AP2 and Verifiable Intent landed at FIDO in April 2026. ChatGPT Instant Checkout went live with Stripe in September 2025. Walmart × Google launched UCP at NRF 2026. Builders need a shared threat model fast.
Designing APIs That Survive AI Agents at Scale
AI agents are now your APIs' biggest, weirdest consumers. They call 100x more often than humans, hallucinate parameters, retry on every ambiguity, fish your schema for tools you did not advertise, and read your error messages as prompts. Most APIs were not designed for this caller. The result in production today: retry storms, tool-spec drift, runaway costs, and audit trails that cannot tell a real user from an agent acting on their behalf.
This is a practical, pattern-driven talk for engineers, architects, and platform leads whose APIs are about to be hit, or already are.
I walk through eight patterns that decide whether your API survives agentic traffic:
1. Idempotency that survives non-deterministic callers, not just network retries.
2.Tool-spec design: naming, descriptions, and parameter shapes LLMs do not get wrong.
3.Capability-scoped tokens for agents, instead of broad API keys.
4.Backpressure and adaptive rate limits keyed to agent identity, not just IP.
5.Schema evolution when consumers cannot read changelogs.
6.Error messages as prompts: structured, actionable, safe to feed back to a model.
7.Observability that traces the agent to tool to downstream chain, with agent identity as a first-class span attribute.
8.Cost protection: semantic dedup, response caching, query budgets, and circuit breakers on token spend.
For each pattern I show the failure in code, the fix, and the operational signal that tells you it is working. Halfway through, I leave the slides for a live walkthrough of a reference API hardened against agent traffic, with a runnable harness that simulates a misbehaving agent so I can break and fix defenses on stage.
This is not about MCP, AP2, or any specific framework. The patterns hold whether your callers are LangChain or custom orchestrators. If your API will be called by something that is not a human in 2027, this is for you.
You leave with eight named patterns, working code, and a checklist your team can run on Monday.
CPU, GPU, and TPU Co-Scheduling: Architectural Tradeoffs for HPC Performance, Energy, and Cost
AI workloads are exploding, and running CPUs, GPUs, and TPUs together efficiently is now critical for performance, energy, and cost in HPC systems.
In this talk, I’ll share my experience with co-scheduling MIMD CPUs, SIMT GPUs, and systolic-array TPUs, showing how differences in execution models, memory hierarchies (NUMA, HBM, on-chip SRAM), and programming abstractions shape workload partitioning, data movement, and scheduling granularity. I’ll cover static, semi-static, and dynamic strategies and highlight their impact on performance portability, energy efficiency, and cost.
Instead of isolated benchmarks, I focus on end-to-end system behavior, emphasizing performance portability, energy-aware scheduling, and cost-efficient use of open HPC software stacks effectively. You will leave with actionable insights to co-schedule heterogeneous workloads smarter, CPUs, GPUs, and TPUs effectively, unlocking higher performance, lower energy use, and cost savings for both AI and HPC workloads.
WeAreDevelopers World Congress 2026 - North America Sessionize Event Upcoming
AgentCon - Saint Louis Sessionize Event
Phani Pendurthi
Mastercard, Principal Software Engineer
Union, Missouri, United States
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top