{ "video": { "id": "58ulJViGFgU", "title": "Who Is Making This Request? Agent Auth 101 - Kamil Potrec, Keycard", "duration": 1115, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer", "event_format": "" }, "analysis": { "video_id": "58ulJViGFgU", "title": "Who Is Making This Request? Agent Auth 101 - Kamil Potrec, Keycard", "one_liner": "Agents act on the user's behalf with credentials nobody can attribute or revoke. Give each agent its own identity, issue scoped short-lived credentials just in time, and keep tokens out of the agent's reach behind a gateway that injects them, attenuates requests and revokes access instantly.", "summary": "Potrec argues that the industry has lived with personal access tokens, static keys and over-privileged service accounts because it trusted deterministic software, but non-deterministic agents break that trust. When an agent sends an invoice, nobody can tell whether Alice or the agent made the request. The fix uses existing technology: OAuth discovery, workload identity, per-agent or per-session identities, delegation semantics, federation, a legacy-credential broker, policy and audit. SDKs alone can't keep credentials away from agents, so he proposes a vault plus a gateway, covers that pattern's trade-offs, and closes by pitching Keycard's control plane.", "key_points": [ "Today's pattern: users hold opaque PATs, agents hold their own model API keys plus pass-through or static keys for MCP servers, and MCP servers use service accounts that collect many users' permissions. The MCP server sees only the user, so it can't tell an agent from Alice's CLI.", "Invoicing example: an agent fetches a pending invoice and, 'either maliciously or is just too helpful', sends it. 'Who is making this request? Was this Alice or was this the agent? We don't know.'", "Problems with credentials lying around: PATs aren't attributed and can be moved to a personal machine, there's no easy revocation, agents collect more and more keys, and service accounts are 'over-privileged bucket[s] of permissions'.", "The unlocked-laptop 'I'm buying donuts for everybody' prank as an analogy: 'agents are basically doing this all the time' with our credentials.", "The proposed pattern: servers advertise how to get authorised, clients discover that and request authorisation (OAuth), and credentials are scoped to one interaction and one tool. Agents must authenticate first, via workload identity federation, private keys, certificates or URL-based auth ('the mechanism doesn't really matter'). The same pattern repeats for each downstream hop instead of standing service accounts.", "Requirements at scale: agent identities (per agent, maybe per session) separate from whoever launched them; delegation semantics; scoped, short-lived credentials with no master key; federated trust across hundreds of existing systems; a broker that swaps legacy credentials just in time; policies for which actions need human approval; and an audit trail of who authorised what.", "SDKs fall short. They need full adoption and a version for every language, they can't be added to bought agents like Claude Code or Codex, fixing a bug means tracking every consumer, and they leave credentials inside the agent's execution environment, where persistent agents can find them.", "Vault plus gateway: the gateway authenticates the caller, checks policy with a runtime authorization service, fetches the credential and injects it into the request. That gives a physical control layer, instant revocation (every request is checked), attenuation (e.g. read email but not send) and observability without changing downstream services. The costs: an extra hop's latency, agents must be forced through it by network controls, local tool execution isn't covered, it doesn't solve identity, it's a big target, TLS interception is hard, and routes, policies and connectors still need configuring and running." ], "takeaways": [ "Give every agent, or even every session, its own authenticated identity separate from the launching user, and make it authenticate before any credential is issued.", "Replace PATs, static keys and standing service-account permissions with scoped, short-lived credentials obtained per interaction through OAuth discovery and token exchange, with no master key.", "Keep credentials out of the agent's execution environment: put them in a vault and use a gateway to inject them, attenuate requests and revoke instantly, while enforcing network controls so agents can't go around it.", "Express policy (which actions need human approval) and audit every hop. Use open standards for interoperability, and don't vibe-code ('yolo') auth with LLMs: review the code for security." ], "topics": [ "agent-auth", "authorization", "oauth", "mcp", "identity", "credential-management", "gateways", "security" ], "tools": [ "Keycard", "MCP", "OAuth", "workload identity federation", "GitHub", "Claude Code", "Codex", "Slack", "agentbaseline.org" ], "quotes": [ { "text": "Now the question becomes who is making this request? Was this Alice or was this the agent? We don't know.", "at": "03:36", "url": "https://www.youtube.com/watch?v=58ulJViGFgU&t=216s" }, { "text": "But agents are basically doing this all the time. We just let them run rampant with our credentials and do this all the time.", "at": "05:08", "url": "https://www.youtube.com/watch?v=58ulJViGFgU&t=308s" }, { "text": "LM are fast, but not that fast.", "at": "09:04", "url": "https://www.youtube.com/watch?v=58ulJViGFgU&t=544s" }, { "text": "agent off isn't an option optional anymore.", "at": "17:30", "url": "https://www.youtube.com/watch?v=58ulJViGFgU&t=1050s" } ], "words": 4300 }, "summary_url": "/#58ulJViGFgU", "transcript": { "html": "/transcripts/58ulJViGFgU.html", "txt": "/transcripts/58ulJViGFgU.txt", "vtt": "/transcripts/58ulJViGFgU.vtt" } }