Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard

Today I will tell Today I will tell you why your you why your you why your agent is a deadly agent is a deadly agent is a deadly trinity of threats and what trinity of threats and what trinity of threats and what to do about it. Let's start to do about it. Let's start to do about it. Let's start right away with a right away with a right away with a demonstration. A little demonstration. A little demonstration. A little context for this context for this context for this demonstration. We demonstration. We demonstration. We will consider the next will consider the next incident handling agent who incident handling agent who analyzes requests, writes analyzes requests, writes analyzes requests, writes reports, and resolves or reports, and resolves or reports, and resolves or forwards tickets. forwards tickets. forwards tickets. This agent has full This agent has full This agent has full access to the cloud access to the cloud access to the cloud hosting API, hosting API, hosting API, customer data storage, and customer data storage, and billing database. So, here's our incident handling agent on duty and he has a queue of and he has a queue of tickets that he tickets that he tickets that he reads, and then, if he reads, and then, if he reads, and then, if he can resolve them, he can resolve them, he can resolve them, he contacts the contacts the contacts the available services and available services and available services and performs the task. What performs the task. What performs the task. What he can't he can't he can't resolve, he passes on resolve, he passes on resolve, he passes on to the morning to the morning to the morning shift. If we shift. If we shift. If we look at this look at this look at this first ticket, it's a first ticket, it's a first ticket, it's a billing anomaly. It billing anomaly. It billing anomaly. It says that a says that a says that a group of group of group of customers were overcharged last night customers were overcharged last night customers were overcharged last night . The first thing . The first thing . The first thing the agent does is the agent does is the agent does is access the Insidex API access the Insidex API to read the ticket. to read the ticket. to read the ticket. And if you look And if you look And if you look here, you'll see that here, you'll see that here, you'll see that he authorized he authorized he authorized access to this API access to this API access to this API using a key.

using a key. He then He then uses the uses the uses the Snowflake key to query the Snowflake key to query the customer data store and decides to customer data store and decides to submit the ticket for submit the ticket for submit the ticket for morning review, morning review, morning review, generating a report for the generating a report for the generating a report for the team. And as you can see, team. And as you can see, team. And as you can see, it shares it shares it shares customer data, right? customer data, right? These are rows These are rows directly directly directly pulled from the pulled from the pulled from the data warehouse, and he sends the data warehouse, and he sends the data warehouse, and he sends the personal data to personal data to personal data to the team that takes over the team that takes over the team that takes over in the morning. The next in the morning. The next in the morning. The next ticket is a ticket is a ticket is a backup power failure backup power failure backup power failure in the server room. The agent in the server room. The agent in the server room. The agent reads this ticket. reads this ticket. reads this ticket. Again, it Again, it Again, it uses an API key uses an API key uses an API key to access the to access the to access the ticket service. He ticket service. He ticket service. He determines that this is a determines that this is a determines that this is a physical problem, physical problem, physical problem, so he passes it on for so he passes it on for so he passes it on for consideration in the morning without consideration in the morning without consideration in the morning without contacting other contacting other contacting other services. Next services. Next services. Next ticket—The ticket—The TLS certificate TLS certificate for the website is about to expire. He for the website is about to expire. He for the website is about to expire. He reads the ticket. He reads the ticket. He reads the ticket. He determines that determines that determines that the warning is the warning is the warning is understandable. It has understandable. It has understandable. It has access to the cloud access to the cloud access to the cloud hosting API and hosting API and hosting API and contacts it contacts it contacts it for the for the certificate renewal endpoint, again certificate renewal endpoint, again using the using the using the API key. He resolves API key. He resolves API key. He resolves the issue by updating the issue by updating the issue by updating the certificate and leaves the certificate and leaves the certificate and leaves a report for the morning a report for the morning a report for the morning shift via the shift via the shift via the Incident API. Here is the Incident API. Here is the Incident API. Here is the next ticket: the billing database next ticket: the billing database is broken, payments are not is broken, payments are not going through.

going through. going through. The documentation says that The documentation says that The documentation says that to recover to recover to recover you need to drop and you need to drop and you need to drop and restore the database. restore the database. The agent does this The agent does this by using a by using a by using a database connection string database connection string database connection string containing the containing the administrator password. And administrator password. And then advises then advises then advises the morning team the morning team the morning team to make sure that to make sure that to make sure that the restore from the the restore from the the restore from the snapshot was snapshot was snapshot was successful. It's not something successful. It's not something successful. It's not something he has direct he has direct he has direct access to. So, essentially, the access to. So, essentially, the morning shift is supposed morning shift is supposed to check if it to check if it to check if it actually worked and actually worked and actually worked and if the data was if the data was if the data was restored. An agent with restored. An agent with restored. An agent with excessive excessive excessive access rights deleting a access rights deleting a access rights deleting a production database is a production database is a production database is a real nightmare real nightmare real nightmare that that that many companies have already experienced. So many companies have already experienced. So many companies have already experienced. So we should be very we should be very we should be very careful with this. The careful with this. The next case: next case: orders are stuck, the orders are stuck, the orders are stuck, the main server is " main server is " frozen". So, frozen". So, frozen". So, the agent reads the agent reads the agent reads the ticket again. After reading the ticket again. After reading the ticket again. After reading the ticket, the agent calls the the ticket, the agent calls the the ticket, the agent calls the cloud hosting API, cloud hosting API, cloud hosting API, again using again using again using its static API its static API key. It calls key. It calls key. It calls the endpoint to the endpoint to the endpoint to reboot reboot reboot the server, which brings down the the server, which brings down the the server, which brings down the operating system operating system . After all, the site doesn't . After all, the site doesn't . After all, the site doesn't work for every work for every work for every third visitor third visitor . The agent reads the ticket.

. The agent reads the ticket. . The agent reads the ticket. He decides that he He decides that he He decides that he needs to call the needs to call the needs to call the cloud hosting API and cloud hosting API and cloud hosting API and scale the service scale the service scale the service from four pods to from four pods to from four pods to 40. After that, he 40. After that, he 40. After that, he is charged is charged is charged $420 $420 $420 per hour for these actions. per hour for these actions. per hour for these actions. And then he kindly And then he kindly And then he kindly leaves a note for the leaves a note for the leaves a note for the morning shift, morning shift, morning shift, informing them of informing them of informing them of what happened. So what what happened. So what what happened. So what makes an agent makes an agent makes an agent useful? Typically, we useful? Typically, we useful? Typically, we want agents to want agents to want agents to have a minimum have a minimum have a minimum set of capabilities. And set of capabilities. And set of capabilities. And often this includes often this includes often this includes the ability to read the ability to read the ability to read data that you have or data that you have or data that you have or have access to. have access to. have access to. This could be your This could be your This could be your mail, documents, or mail, documents, or mail, documents, or perhaps a customer CRM system perhaps a customer CRM system perhaps a customer CRM system . We want the . We want the . We want the agent to be able to agent to be able to agent to be able to do their own do their own do their own research. This may research. This may research. This may include searching the include searching the include searching the internet, reading internet, reading internet, reading documentation, or documentation, or documentation, or getting tasks from getting tasks from getting tasks from GitHub. And we usually GitHub. And we usually GitHub. And we usually want it to be able to want it to be able to want it to be able to use use use external tools external tools . For example, SFTP . For example, SFTP servers, APIs or SaaS servers, APIs or SaaS platforms. Helpful platforms. Helpful platforms. Helpful agents can agents can agents can perform these perform these perform these tasks with tasks with tasks with human intervention or autonomously human intervention or autonomously human intervention or autonomously in the background.

in the background. in the background. But the things that make But the things that make But the things that make agents useful agents useful agents useful also make them also make them also make them dangerous. dangerous. In fact, these three In fact, these three possibilities together possibilities together possibilities together create what create what create what Simon Willison Simon Willison Simon Willison called a “lethal called a “lethal called a “lethal triumvirate.” This is a triumvirate.” This is a triumvirate.” This is a combination of access to combination of access to combination of access to private data, such private data, such as the ability of a as the ability of a as the ability of a call center agent call center agent call center agent to query the to query the customer data store and customer data store and interact with the interact with the interact with the billing database. billing database. billing database. Interacting with Interacting with Interacting with untrusted untrusted untrusted content, such as content, such as content, such as reading user-submitted reading user-submitted tickets, reports from other tickets, reports from other agents, or agents, or agents, or external external external documentation. And documentation. And documentation. And the possibility of the possibility of the possibility of external external external communication, such as communication, such as communication, such as reading and writing reading and writing reading and writing via third-party APIs or via third-party APIs or via third-party APIs or SaaS services. Together, these SaaS services. Together, these SaaS services. Together, these capabilities capabilities capabilities open wide open wide open wide doors for doors for doors for attackers. Agents attackers. Agents attackers. Agents are created to are created to are created to get get get the job done. And they the job done. And they the job done. And they will use all will use all the powers at their disposal, sometimes with the powers at their disposal, sometimes with very serious very serious very serious consequences. But here's the consequences. But here's the consequences. But here's the thing. These thing. These thing. These incidents happen incidents happen incidents happen because people give because people give because people give agents far agents far agents far more access than more access than more access than they need. Agents with they need. Agents with they need. Agents with excessive rights are excessive rights are excessive rights are free to act free to act free to act based on based on based on decisions made, even if decisions made, even if decisions made, even if they are under they are under they are under supervision. Forcing a supervision. Forcing a supervision. Forcing a human to participate in the human to participate in the human to participate in the approval process approval process approval process simply shifts simply shifts simply shifts access control to access control to a user who is tired of requests.

a user who is tired of requests. We've been We've been We've been solving solving solving access management issues access management issues access management issues for people for decades, so for people for decades, so for people for decades, so shifting the shifting the shifting the responsibility to responsibility to responsibility to the user simply the user simply the user simply moves the moves the moves the security problem up the security problem up the security problem up the chain. So what do we chain. So what do we chain. So what do we do with this do with this do with this deadly trinity? deadly trinity? deadly trinity? How do we solve this without How do we solve this without How do we solve this without compromising the compromising the compromising the agent's usefulness? Well agent's usefulness? Well , simply removing , simply removing , simply removing one or more of one or more of one or more of these capabilities these capabilities these capabilities would make the agent would make the agent would make the agent significantly less useful. significantly less useful. So how do you keep all So how do you keep all three while staying three while staying three while staying safe? safe? Instead of Instead of destroying the trinity destroying the trinity destroying the trinity by removing by removing by removing features, we need to features, we need to features, we need to control control control agent access to agent access to agent access to minimize attack minimize attack minimize attack and limit the radius of and limit the radius of and limit the radius of attack attack attack while maintaining capabilities while maintaining capabilities while maintaining capabilities and autonomy. So and autonomy. So and autonomy. So how do we do it? how do we do it? Access control options include Access control options include using OAuth, using OAuth, using OAuth, possibly a vendor-provided MCP gateway, possibly a vendor-provided MCP gateway, possibly a vendor-provided MCP gateway, or or or restricting execution restricting execution restricting execution in sandboxes. OAuth in sandboxes. OAuth in sandboxes. OAuth links access to links access to links access to permission. When permission. When permission. When granting permission, granting permission, granting permission, the user the user the user agrees to all agrees to all agrees to all rights that the agent can rights that the agent can rights that the agent can potentially potentially potentially use.

use. use. Consent is given before Consent is given before any task appears, so any task appears, so if you give broad if you give broad if you give broad permission, you get permission, you get permission, you get permanent access. Your permanent access. Your permanent access. Your agent has excessive agent has excessive agent has excessive rights for any rights for any rights for any particular task particular task . If you limit . If you limit . If you limit the permission and grant the permission and grant the permission and grant too few rights, the agent too few rights, the agent too few rights, the agent will simply become less will simply become less will simply become less functional. In functional. In functional. In any case, any case, any case, OAuth by itself does not OAuth by itself does not OAuth by itself does not provide task- provide task- provide task- limited access control limited access control limited access control . An . An . An enthusiastic agent enthusiastic agent enthusiastic agent can both read and can both read and can both read and write in a single run write in a single run , even if you , even if you , even if you want it to only want it to only want it to only read in this read in this read in this particular task particular task . The MCP gateway links . The MCP gateway links . The MCP gateway links execution to execution to execution to the route. You the route. You the route. You get get get observability, observability, observability, rate limits, rate limits, rate limits, and a single point of and a single point of policy decision making at the policy decision making at the MCP level. The policy MCP level. The policy MCP level. The policy is applied to is applied to is applied to each request and each request and each request and access is granted to access is granted to access is granted to each each each user, but user, but user, but agent access lasts agent access lasts agent access lasts longer than any longer than any longer than any individual task individual task individual task because the gateway still because the gateway still because the gateway still stores persistent stores persistent stores persistent credentials. The " credentials. The " sandbox" links sandbox" links sandbox" links execution to process. execution to process. execution to process. This controls the radius This controls the radius This controls the radius of the attack, but to be of the attack, but to be of the attack, but to be useful you useful you useful you need to go outside the need to go outside the need to go outside the sandbox. And sandbox. And sandbox. And when that happens, you when that happens, you when that happens, you get get get permanent access again. We have permanent access again. We have permanent access again. We have also seen many also seen many also seen many stories of stories of stories of agents breaking out of their agents breaking out of their agents breaking out of their sandboxes.

sandboxes. sandboxes. Sandboxes Sandboxes Sandboxes restrict the actions of restrict the actions of restrict the actions of processes, but do not processes, but do not processes, but do not control what is control what is control what is authorized to operate authorized to operate authorized to operate outside the outside the sandbox itself. Even sandbox itself. Even sandbox itself. Even if you combine if you combine if you combine all three solutions, all three solutions, all three solutions, the agent still won't the agent still won't the agent still won't get get get runtime credentials runtime credentials runtime credentials narrowed down to a single narrowed down to a single narrowed down to a single task. So let's task. So let's task. So let's summarize the problems, summarize the problems, summarize the problems, especially the ones we especially the ones we especially the ones we saw in the demo. If you saw in the demo. If you saw in the demo. If you recall from the recall from the recall from the audit log, we couldn't audit log, we couldn't audit log, we couldn't determine who determine who determine who was using the was using the was using the API keys. So, the first API keys. So, the first API keys. So, the first problem is problem is problem is that the that the that the credentials were not credentials were not credentials were not tied to the identity of tied to the identity of tied to the identity of the user or the user or the user or agent. The agent had agent. The agent had agent. The agent had unrestricted access unrestricted access unrestricted access to all permissions to all permissions to all permissions granted through granted through granted through API keys. And finally, we can't API keys. And finally, we can't API keys. And finally, we can't just just just involve people everywhere, because involve people everywhere, because involve people everywhere, because people make people make people make mistakes too. In addition, mistakes too. In addition, mistakes too. In addition, many agents many agents many agents operate autonomously, operate autonomously, operate autonomously, without any human intervention at all without any human intervention at all without any human intervention at all . So to . So to . So to solve these problems, solve these problems, solve these problems, we can start by we can start by we can start by using what is using what is using what is called called called token exchange. This is an existing token exchange. This is an existing token exchange. This is an existing standard standard standard published in published in published in 2020 that extends 2020 that extends 2020 that extends OAuth 2. First of all, we OAuth 2. First of all, we OAuth 2. First of all, we need to know who the need to know who the need to know who the user is. The authorization server user is. The authorization server verifies identities and verifies identities and issues tokens.

issues tokens. Identity providers Identity providers like Google, Okta, like Google, Okta, like Google, Okta, Auth0, etc. provide Auth0, etc. provide Auth0, etc. provide authorization servers. authorization servers. authorization servers. So, if we want to So, if we want to So, if we want to have an have an have an authentication chain in authentication chain in authentication chain in our our our agent execution path, the agent execution path, the agent execution path, the user must user must user must first log in first log in first log in . The . The . The authorization server will ask the authorization server will ask the authorization server will ask the user for consent user for consent user for consent to delegate to delegate to delegate access to resources access to resources access to resources with a certain with a certain with a certain subset of their subset of their subset of their rights. These permissions rights. These permissions rights. These permissions are called are called are called scopes. This is the scopes. This is the scopes. This is the first restriction of first restriction of first restriction of access. We delegate access. We delegate access. We delegate only a portion of the only a portion of the only a portion of the general general general user rights to the agent. The user rights to the agent. The user rights to the agent. The authorization server issues a authorization server issues a authorization server issues a token that identifies token that identifies token that identifies the user and the user and the user and their access level. their access level. their access level. And at this stage, we are And at this stage, we are And at this stage, we are already working better than the already working better than the already working better than the demo, because we know demo, because we know demo, because we know who the user is and who the user is and who the user is and what they have access to. what they have access to. This brings us to the This brings us to the path of executing path of executing path of executing agent processes. agent processes. Now we have an Now we have an authenticated authenticated authenticated user, i.e. a user, i.e. a user, i.e. a known person who known person who known person who wants to use wants to use wants to use LLM to interact with the LLM to interact with the LLM to interact with the resource. In the demo resource. In the demo version, the resources are an version, the resources are an incident notification system, a incident notification system, a database, Snowflake, and database, Snowflake, and database, Snowflake, and cloud hosting.

cloud hosting. An agent is a An agent is a control loop that control loop that control loop that invokes the LLM. Often we invokes the LLM. Often we invokes the LLM. Often we have an MCP server that have an MCP server that have an MCP server that stands between the agent and stands between the agent and stands between the agent and its resources, its resources, its resources, providing specific providing specific providing specific tools for tools for tools for communicating with services. The communicating with services. The MCP client sends the agent-suggested agent-suggested tool calls to the tool calls to the tool calls to the corresponding MCP server corresponding MCP server . In the demo, the . In the demo, the . In the demo, the on-call agent on-call agent on-call agent called resources called resources called resources directly directly directly using using using long-lasting long-lasting long-lasting static data, such as static data, such as static data, such as API keys or API keys or API keys or database connection strings. database connection strings. Therefore, we are going to Therefore, we are going to provide the next provide the next provide the next agent with an MCP server. It agent with an MCP server. It agent with an MCP server. It will provide will provide will provide tools and also tools and also tools and also serve as a broker serve as a broker serve as a broker for access to for access to for access to resources. The resources. The resources. The agent runtime is the agent runtime is the agent runtime is the process that runs the process that runs the process that runs the agent loop and agent loop and agent loop and executes calls. This executes calls. This executes calls. This environment can be a environment can be a command-line interface like command-line interface like Cloud Code, or an agent SDK Cloud Code, or an agent SDK Cloud Code, or an agent SDK implemented in a implemented in a implemented in a dedicated application dedicated application dedicated application like a standby agent. like a standby agent. So, let's So, let's trace the trace the trace the request along this request along this request along this execution path.

execution path. execution path. The user sends The user sends The user sends a request to the a request to the a request to the runtime, which runtime, which runtime, which invokes the model and invokes the model and invokes the model and passes the request to the LLM. passes the request to the LLM. passes the request to the LLM. The model proposes The model proposes The model proposes tool calls tool calls directed by the MCP directed by the MCP client to its MCP client to its MCP server, which executes server, which executes server, which executes the tools and then the tools and then the tools and then calls the resource API. calls the resource API. The API returns a response The API returns a response to the MCP server. The MCP client to the MCP server. The MCP client to the MCP server. The MCP client passes the response to the passes the response to the passes the response to the runtime runtime , which calls , which calls , which calls the model again, and this cycle the model again, and this cycle the model again, and this cycle repeats until repeats until repeats until the model is the model is the model is satisfied and satisfied and satisfied and returns a response to returns a response to returns a response to the user. Now the the user. Now the authenticated authenticated user token becomes what user token becomes what user token becomes what we call a we call a we call a subject token. This subject token. This subject token. This determines on whose determines on whose determines on whose behalf the agent acts, for behalf the agent acts, for behalf the agent acts, for whom he works. whom he works. Now, Now, token exchange requires an OAuth token exchange requires an OAuth client capable of client capable of client capable of executing code. So executing code. So executing code. So it could be a gateway it could be a gateway it could be a gateway located between the MCP located between the MCP client and a third-party client and a third-party client and a third-party MCP server. Or it MCP server. Or it MCP server. Or it could be your own could be your own could be your own app. The MCP app. The MCP server itself can also server itself can also server itself can also exchange tokens exchange tokens exchange tokens for further for further for further resources. The MCP server of the resources. The MCP server of the resources. The MCP server of the agent on duty must agent on duty must agent on duty must provide a defined provide a defined provide a defined set of set of set of production production production infrastructure tools. The infrastructure tools. The request and subject token are sent to the are sent to the runtime runtime . The agent cycle . The agent cycle . The agent cycle is started and is started and is started and the model suggests a the model suggests a the model suggests a tool call. The tool call. The runtime authenticates with a authenticates with a special authorization server special authorization server called a called a security token service. It security token service. It security token service. It does this does this does this using the application using the application using the application client credentials client credentials client credentials or or workload identifier. It

workload identifier. It also sends a also sends a also sends a subject token containing the subject token containing the user's identity and access rights. It user's identity and access rights. It creates a creates a creates a token exchange request, token exchange request, token exchange request, asking for permission to asking for permission to asking for permission to access the MCP server access the MCP server access the MCP server for this for this for this specific specific specific tool call. So tool call. So tool call. So now we have three now we have three now we have three pieces of information pieces of information that we were missing from the that we were missing from the that we were missing from the demonstration. We demonstration. We demonstration. We know the identity of the agent know the identity of the agent know the identity of the agent requesting access. requesting access. requesting access. We know the identity of We know the identity of We know the identity of the user on the user on the user on whose behalf he is acting. And whose behalf he is acting. And whose behalf he is acting. And we know the level of we know the level of we know the level of access that the access that the access that the user has granted to user has granted to user has granted to the agent. Now we the agent. Now we the agent. Now we need to decide whether to need to decide whether to need to decide whether to issue the issue the issue the requested token. We requested token. We requested token. We can do this with a can do this with a governance policy that is governance policy that is evaluated based evaluated based evaluated based on what access on what access on what access is requested to what is requested to what is requested to what resource, the identity of the agent, resource, the identity of the agent, resource, the identity of the agent, and the identity of the user. and the identity of the user. But politicians are only the But politicians are only the upper limits. Agents upper limits. Agents upper limits. Agents may do things may do things may do things you didn't plan for, you didn't plan for, you didn't plan for, even if the policy even if the policy even if the policy generally generally generally allows them to. This allows them to. This allows them to. This brings us to the brings us to the brings us to the concept of concept of concept of intent-based authorization, intent-based authorization, intent-based authorization, or IBA. So, IBA or IBA. So, IBA or IBA. So, IBA verifies your verifies your verifies your intentions before the intentions before the intentions before the agent takes action.

agent takes action. agent takes action. This is not yet a This is not yet a This is not yet a finalized finalized finalized standard. Proposals are still standard. Proposals are still standard. Proposals are still being accepted. being accepted. being accepted. So this is Keycard's approach to So this is Keycard's approach to So this is Keycard's approach to implementing implementing intent-based authorization. Therefore, intent-based authorization. Therefore, IBA can IBA can IBA can use the gateway use the gateway use the gateway as a as a policy enforcement point. When you policy enforcement point. When you send a request to send a request to send a request to an agent, he offers a an agent, he offers a an agent, he offers a specific mission. This mission specific mission. This mission specific mission. This mission includes a goal, possible includes a goal, possible actions, actions, actions, and restrictions on what the and restrictions on what the and restrictions on what the agent is allowed to agent is allowed to agent is allowed to do. So, the purpose of do. So, the purpose of do. So, the purpose of triage incident triage incident triage incident 2294 means to read 2294 means to read 2294 means to read this ticket, this ticket, this ticket, summarize or summarize or summarize or forward it, but not to forward it, but not to forward it, but not to read other tickets or read other tickets or read other tickets or use use use other services. other services. So, the security token service So, the security token service gets this gets this gets this task. In this task. In this task. In this case, a low- case, a low- case, a low- risk action, such as simply risk action, such as simply risk action, such as simply rating the ticket, may rating the ticket, may rating the ticket, may be automatically be automatically be automatically approved according to the approved according to the administrator's policy. On administrator's policy. On the other hand, if we the other hand, if we the other hand, if we have already read the ticket have already read the ticket have already read the ticket and then request a and then request a and then request a resolution to the resolution to the resolution to the usage spike, usage spike, usage spike, the task grants the task grants the task grants permission for a one-time permission for a one-time permission for a one-time scaling of scaling of scaling of the service, but not for the service, but not for the service, but not for using other using other using other tools or APIs.

tools or APIs. Now in this case Now in this case the task is given to the task is given to the task is given to the user for the user for the user for review and review and review and approval. Once approval. Once approval. Once approved, the approved, the approved, the security token service security token service security token service gives the task gives the task gives the task an ID that an ID that an ID that is sent to the agent. is sent to the agent. Tool calls Tool calls contain this contain this contain this task ID and task ID and task ID and are proxied through a are proxied through a are proxied through a gateway, which gateway, which gateway, which uses the ID to uses the ID to uses the ID to ask the ask the ask the security token service whether security token service whether security token service whether this this this call corresponds to a task. If call corresponds to a task. If call corresponds to a task. If so, the gateway requests a so, the gateway requests a so, the gateway requests a token exchange to token exchange to token exchange to access the MCP server access the MCP server access the MCP server for that for that for that particular particular particular tool call. STS tool call. STS tool call. STS evaluates the policy. It evaluates the policy. It evaluates the policy. It evaluates the evaluates the evaluates the delegation chain and delegation chain and delegation chain and verifies the requested verifies the requested verifies the requested access. If everything is access. If everything is access. If everything is OK, it issues an OK, it issues an OK, it issues an access token for the MCP access token for the MCP server. In doing so, server. In doing so, server. In doing so, it preserves the it preserves the it preserves the user's subject and also user's subject and also user's subject and also adds the program that adds the program that adds the program that performed the exchange—in performed the exchange—in performed the exchange—in our case, it's our our case, it's our our case, it's our next agent. This next agent. This next agent. This token should token should token should expire in expire in expire in a few minutes and we should not a few minutes and we should not store it. It is store it. It is ephemeral. The STS ephemeral. The STS ephemeral. The STS sends it to the gateway sends it to the gateway , which calls the MCP , which calls the MCP server. The server then server. The server then server. The server then validates the token and validates the token and validates the token and authorizes the authorizes the authorizes the tool call. Some tool call. Some tool call. Some tools tools tools require external require external require external resources. Therefore, the MCP resources. Therefore, the MCP server requests the server requests the security token service to exchange the security token service to exchange the received token for a received token for a received token for a token for a further token for a further token for a further resource. STS evaluates resource. STS evaluates resource. STS evaluates the request according to the request according to the request according to the policy. And if it the policy. And if it the policy. And if it passes the validation, passes the validation, passes the validation, it creates a it creates a it creates a resource token restricted to

resource token restricted to resource token restricted to that that that tool call. It tool call. It tool call. It stores the stores the stores the user's principal, which user's principal, which user's principal, which extends the extends the extends the delegation chain and delegation chain and delegation chain and allows allows allows all activity to be tracked all activity to be tracked all activity to be tracked . The STS . The STS . The STS sends a token to sends a token to sends a token to the gateway, which proxies the gateway, which proxies the gateway, which proxies the request to the MCP server, which then the request to the MCP server, which then the request to the MCP server, which then calls the resource. calls the resource. The resource verifies The resource verifies the token and authorizes the token and authorizes the token and authorizes access. The MCP server access. The MCP server access. The MCP server should never should never should never store the token. He store the token. He store the token. He should delete should delete should delete it immediately after it immediately after it immediately after the call ends. The the call ends. The resource response resource response is passed back, and the is passed back, and the is passed back, and the agent loop agent loop agent loop repeats until repeats until repeats until the model provides the model provides the model provides a response a response a response to the user. Now to the user. Now to the user. Now we will look at the same we will look at the same we will look at the same demonstration, but demonstration, but demonstration, but using the using the using the security token service to security token service to security token service to manage manage manage agent access control with agent access control with agent access control with delegated delegated delegated authorization. authorization. The demo The demo uses uses task-based policy management rather than intent-based authorization. But intent-based authorization. But if you're going to if you're going to if you're going to Agent Con later this Agent Con later this Agent Con later this month, we'll have month, we'll have month, we'll have IBA demos there.

IBA demos there. Now we also have an MCP server that server that server that installs installs installs tools and tools and tools and provides access to provides access to provides access to resources through a resources through a resources through a broker. So, we're broker. So, we're broker. So, we're back to back to back to our on- our on- our on- call sorting agent. call sorting agent. call sorting agent. Only this time Only this time Only this time we have authentication. we have authentication. we have authentication. I'm going to enter the I'm going to enter the I'm going to enter the triage program for triage program for triage program for agents on duty. For agents on duty. For agents on duty. For this, I will log in through this, I will log in through this, I will log in through Google. And then Google. And then Google. And then another another another login screen appears. Now here login screen appears. Now here login screen appears. Now here I will enter the I will enter the I will enter the Incident Exchange platform. Incident Exchange platform. So, I get a request So, I get a request to give an agent to give an agent to give an agent access to my Incident access to my Incident access to my Incident Exchange so they can Exchange so they can Exchange so they can escalate incidents escalate incidents escalate incidents on my behalf, on my behalf, on my behalf, post notes post notes post notes and summaries, and and summaries, and and summaries, and read the queue. Now read the queue. Now read the queue. Now I am being offered to I am being offered to I am being offered to log into a log into a log into a cloud hosting platform.

cloud hosting platform. So I'm going to So I'm going to do it. And now I do it. And now I do it. And now I see another see another see another consent screen. Which allows consent screen. Which allows consent screen. Which allows me to authorize an me to authorize an me to authorize an agent to access agent to access agent to access some some some Compuhost features on my behalf. Compuhost features on my behalf. Now I'm finally Now I'm finally back on the back on the duty officer's dashboard. Now duty officer's dashboard. Now we have the same we have the same we have the same ticket queue, only the ticket queue, only the ticket queue, only the automatic journal automatic journal automatic journal looks different. looks different. looks different. The agent The agent The agent will probably try to behave the same way as will probably try to behave the same way as will probably try to behave the same way as before. before. Only now, each Only now, each request will go request will go request will go through STS and through STS and through STS and policy evaluation before a policy evaluation before a policy evaluation before a token is granted and the token is granted and the token is granted and the agent is authorized agent is authorized agent is authorized to act. So, we have the same to act. So, we have the same to act. So, we have the same queue of tickets. queue of tickets. queue of tickets. Only now the Only now the Only now the automatic log automatic log automatic log looks different, and the looks different, and the looks different, and the agent agent agent will probably behave the same as will probably behave the same as will probably behave the same as before. before. before. Only now, each Only now, each Only now, each request will go request will go request will go through STS and through STS and through STS and policy evaluation before a policy evaluation before a policy evaluation before a token is granted and the token is granted and the token is granted and the agent is authorized agent is authorized agent is authorized to act. So, the first to act. So, the first to act. So, the first ticket is a ticket is a ticket is a billing anomaly. Again, billing anomaly. Again, billing anomaly. Again, the agent tries the agent tries the agent tries to read the ticket, and we to read the ticket, and we to read the ticket, and we see that he is see that he is see that he is trying to do the same thing as trying to do the same thing as trying to do the same thing as before.

before. He tries to He tries to query the query the query the customer repository, but customer repository, but customer repository, but the policy does not allow him the policy does not allow him the policy does not allow him to issue credentials for this to issue credentials for this to issue credentials for this , , , because personal because personal because personal customer data customer data customer data should not be in should not be in should not be in the context of the agent or the context of the agent or the context of the agent or in the incident ticket. in the incident ticket. Therefore, the agent continues to Therefore, the agent continues to work without work without work without the client's data and transfers the client's data and transfers the client's data and transfers the ticket to the morning shift. Our the ticket to the morning shift. Our website security certificate is now expiring. This is what the website security certificate is now expiring. This is what the agent has agent has agent has permission to do. So when he permission to do. So when he permission to do. So when he requests requests requests credentials for this in STS, credentials for this in STS, credentials for this in STS, access is granted and access is granted and access is granted and he can call the he can call the he can call the cloud hosting API and cloud hosting API and cloud hosting API and resolve this ticket. resolve this ticket. Now you can Now you can see all the calls see all the calls see all the calls he makes and who he makes and who he makes and who makes them. So, we makes them. So, we makes them. So, we have a triage agent on have a triage agent on have a triage agent on duty duty duty requesting a requesting a requesting a certificate renewal. It certificate renewal. It certificate renewal. It requests permission to requests permission to requests permission to call the appropriate call the appropriate call the appropriate tool from the MCP tool from the MCP server of the working server of the working server of the working infrastructure. So, infrastructure. So, infrastructure. So, he gets a token for that he gets a token for that he gets a token for that . After that, the MCP . After that, the MCP server will send a request server will send a request server will send a request to access the cloud to access the cloud to access the cloud hosting to renew hosting to renew hosting to renew the certificate via the API.

the certificate via the API. So if we So if we go to the go to the go to the billing database, it billing database, it billing database, it will read the ticket through the will read the ticket through the will read the ticket through the incident API. He incident API. He incident API. He will come to the same conclusion as will come to the same conclusion as before. The agent before. The agent before. The agent knows that this is a knows that this is a knows that this is a restore-by- restore-by- restore-by- deletion procedure, but this deletion procedure, but this deletion procedure, but this time the policy time the policy time the policy prohibits the agent from prohibits the agent from prohibits the agent from deleting the production deleting the production deleting the production database. A person has to database. A person has to database. A person has to do it manually. And do it manually. And do it manually. And we see this in the we see this in the we see this in the audit log, where STS audit log, where STS audit log, where STS refused to exchange refused to exchange refused to exchange the token for access to the token for access to the token for access to delete the database. delete the database. So, now our So, now our orders are stuck. The orders are stuck. The orders are stuck. The main server is main server is main server is frozen. The agent frozen. The agent frozen. The agent is about to read is about to read is about to read the ticket. He wants the ticket. He wants the ticket. He wants to restart the to restart the to restart the main server. This main server. This main server. This briefly briefly briefly takes the working takes the working takes the working environment offline.

environment offline. environment offline. He lets me know He lets me know He lets me know about it, and this time about it, and this time about it, and this time he actually asks for he actually asks for he actually asks for my approval. So, my approval. So, my approval. So, I click "approve I click "approve ". However, this was also ". However, this was also ". However, this was also blocked by blocked by blocked by policy because policy because policy because my user does not have the my user does not have the my user does not have the role required for role required for role required for this action. Yes? So, this action. Yes? So, this action. Yes? So, the agent can't the agent can't the agent can't do it, but neither do it, but neither do it, but neither can I, and the agent is acting on can I, and the agent is acting on can I, and the agent is acting on my behalf. If we my behalf. If we my behalf. If we go to a site go to a site go to a site that is down for that is down for that is down for one of the three one of the three one of the three users, again users, again users, again , the agent wants to , the agent wants to , the agent wants to add more add more add more servers and asks for servers and asks for servers and asks for permission. He will say what permission. He will say what permission. He will say what we agree to we agree to we agree to when we do this. I'm when we do this. I'm when we do this. I'm going to approve this. going to approve this. And that's what my role And that's what my role has the authority to has the authority to has the authority to do. So, do. So, do. So, scaling scaling scaling is happening, and this is happening, and this is happening, and this ticket is resolved. So, ticket is resolved. So, ticket is resolved. So, we see that the we see that the agent access issues have been resolved. We agent access issues have been resolved. We know the know the know the user ID and user ID and user ID and agent throughout the agent throughout the agent throughout the chain. The agent has chain. The agent has chain. The agent has ephemeral access to the ephemeral access to the ephemeral access to the MCP server and MCP server and MCP server and subsequent resources, subsequent resources, subsequent resources, limited to the task.

limited to the task. And we have a human in the And we have a human in the control loop where control loop where control loop where access is backed by access is backed by access is backed by policy. policy. policy. Access is now controlled Access is now controlled Access is now controlled at the task level by the at the task level by the token security service and token security service and policies, and we policies, and we policies, and we retain all retain all retain all key capabilities. key capabilities. So, token exchange is an open is an open is an open standard. It is well standard. It is well standard. It is well researched and researched and researched and public. So public. So anyone can anyone can anyone can implement it, and it implement it, and it implement it, and it interoperates with existing interoperates with existing interoperates with existing policy engines and policy engines and policy engines and standard standard identity providers, as identity providers, as well as things like well as things like gateways, sandboxes, gateways, sandboxes, gateways, sandboxes, OAuth, out-of-the-box and custom OAuth, out-of-the-box and custom OAuth, out-of-the-box and custom agents, CLIs, agents, CLIs, agents, CLIs, MCP server software factories, cross- MCP server software factories, cross- agent add-on access, plus agent add-on access, plus everything else coming everything else coming everything else coming next week. next week. next week. So, I hope you'll So, I hope you'll So, I hope you'll consider this to consider this to consider this to make your make your make your agents useful, agents useful, agents useful, safe, and safe, and future-ready. So, future-ready. So, my name is Kim Maider my name is Kim Maider . I am a founding engineer in . I am a founding engineer in . I am a founding engineer in GTM and the GTM and the GTM and the head of DevRel head of DevRel head of DevRel at Keycard. And I sincerely appreciate at Keycard. And I sincerely appreciate at Keycard. And I sincerely appreciate your time your time your time today. So, today. So, today. So, thank you very much.