# Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard

## Executive summary

The video addresses the security risks posed by overprivileged AI agents, which combine access to private data, exposure to untrusted content, and external communication capabilities—the 'lethal trifecta.' The solution presented moves beyond traditional access control methods (like OAuth or sandboxes) by implementing delegated authorization using OAuth token exchange. This process ensures that agents receive short-lived, task-scoped credentials, making identity, policy, and access decisions visible throughout the entire request chain.

## Key takeaways

- The Lethal Trifecta: AI agents are dangerous because they combine access to private data (e.g., customer data warehouse, billing database), exposure to untrusted content (e.g., user-submitted tickets), and external communication capabilities (e.g., third-party APIs). Overprivileged agents can execute catastrophic actions (e.g., dropping a production database, scaling services) even with human supervision. (4:16, 2:32)
- Delegated Authorization via Token Exchange: To mitigate risk, the system must use OAuth token exchange, which extends OAuth 2.0. This process ensures that the user's identity is carried through the agent execution path, allowing the Security Token Service (STS) to evaluate policy and issue credentials scoped only to the specific, requested task. (8:43, 12:18)
- Intent-Based Authorization (IBA): IBA is a proposed standard (not finalized) that checks the user's intent or 'mission' before the agent acts. The STS evaluates the proposed mission (goal, allowed actions, limits) against policy, ensuring the agent cannot perform actions outside the defined scope, even if the underlying API key has broad permissions. (14:11)

## Technical details

- Overprivileged Agent Risks: An agent with standing API keys and admin credentials can perform unauthorized actions, such as dropping a production database or scaling services from four to 40 pods, incurring significant costs ($420/hour). (2:32)
- OAuth Token Exchange Flow: The secure flow requires the user to log in, granting consent (scopes) to the agent. The STS then issues a subject token, which is passed to the agent's MCP server. The STS validates the request against governance policy, issuing ephemeral, task-scoped access tokens for both the MCP server and the downstream resource. (12:18, 16:05)
- Policy Enforcement Points: Access control must be enforced at multiple points: the Authorization Server (initial scope narrowing), the STS (policy evaluation), and the MCP gateway (token validation). The STS must issue tokens that are ephemeral and cannot be stored by the MCP server. (12:18, 16:05)

## Practical implications

- Implement OAuth token exchange to ensure user identity is carried through the entire agent execution path.
- Adopt a Security Token Service (STS) to centralize policy evaluation and issue ephemeral, task-scoped credentials.
- Prioritize Intent-Based Authorization (IBA) models to enforce limits on agent actions based on the user's stated goal, rather than just general permissions.
- Ensure that the MCP server and downstream resources discard access tokens immediately after use to prevent standing access.

## Topics

AI Agents, OAuth 2.0, Security Token Services (STS), Delegated Authorization, Policy Enforcement, Microservices Architecture, Incidex API, Customer Data Warehouse, Cloud Hosting API, Snowflake Key

Source: https://www.youtube.com/watch?v=ws9XcGGPBDk