# Who Is Making This Request? Agent Auth 101 - Kamil Potrec, Keycard

## Executive summary

The talk outlines the critical security requirements for agent authentication and authorization in AI systems. Current practices, such as relying on personal access tokens (PATs) or over-privileged service accounts, are insufficient because agents are non-deterministic actors. Proper agent authentication requires establishing per-agent identity, implementing delegation semantics, using short-lived scoped credentials, and integrating federated trust across diverse, often legacy, systems. The speaker details the architectural shift needed, moving credential management out of the agent's execution environment and into secure gateways or dedicated control planes to ensure auditability and control.

## Key takeaways

- The Problem with Current Agent Auth: Current methods (PATs, static keys, service accounts) fail because they lack clear attribution (who made the request: user or agent?), are over-privileged, and cannot account for the non-deterministic nature of agents. This risk was previously accepted because software was deterministic, but agents introduce a new, unpredictable actor.
- Required Components for Proper Agent Auth: A robust system must provide: 1) Per-agent (and potentially per-session) identities. 2) Delegation semantics (defining which agents can act on behalf of users). 3) Short-lived, scoped credentials, preventing the use of master keys. 4) Federated trust across existing, diverse systems (legacy APIs). 5) Policy enforcement (determining if human approval is needed). 6) Comprehensive audit logging.
- Architectural Solutions: Gateways vs. SDKs: While SDKs are easy to write, they fail to secure credentials from the agent's execution environment. Gateways (or proxies) solve this by intercepting all communication, forcing agents to request credentials from a secure vaulting service, thereby physically removing credentials from the agent's reach. This enables instantaneous revocation and request introspection.

## Technical details

- Credential Management Flaws: Relying on user PATs or static keys means the MCP server only sees the user's identity, not the agent. Service accounts often become 'over-privileged buckets of permissions,' which is dangerous when dealing with non-deterministic agents.
- OAuth and Federation: OAuth is key for allowing agents to advertise how to obtain credentials and receive dynamic, scoped credentials limited to the specific interaction. Workload Identity Federation, private key authentication, certificates, and URL-based authorization are suggested mechanisms for agent authentication.
- Gateway Functionality: Gateways act as a physical control layer, intercepting requests to validate policies, fetch specific credentials from a runtime authorization service, and inject them into the request path. This provides instantaneous revocation and allows for request introspection (e.g., blocking a 'send email' request even if 'read email' is permitted).

## Practical implications

- Security architecture must shift from trusting the software (deterministic) to controlling the communication path (non-deterministic agents).
- Implementing a centralized control plane or gateway is necessary to enforce policies, manage credentials, and ensure auditability across heterogeneous, legacy systems.
- The solution must be interoperable and use open standards to handle the complexity of multiple agent types and diverse backend APIs.

## Topics

Agent Authentication, Authorization, OAuth 2.0, Federated Identity, API Gateways, Security Architecture, Keycard, Agent Baseline

Source: https://www.youtube.com/watch?v=58ulJViGFgU