Intent Based Auth

2:43:00Hi.

2:43:02Hi.

2:43:04Hey, Dick.

2:43:05Hey, Davis.

2:43:05Hey, Ian.

2:43:07Hi, everyone.

2:43:08Welcome to AI Engineer New York.

2:43:11I'm super excited to be here today.

2:43:13My name is Allie Howe.

2:43:14I'm a member of technical staff at Keycard.

2:43:18I'm here with some amazing panelists today.

2:43:21We have Ian, CEO of Keycard.

2:43:23We have Michael Davis, global chief security architect at JPMorgan Chase.

2:43:28And we have Dick Hardt, the founder of AAuth and co-creator of OAuth with us on stage today.

2:43:36I'm super excited to talk to all of them about intent-based authorization.

2:43:41And to set the stage, I want to bring to light that as more companies are looking to give their agents increased levels of autonomy,

2:43:48they're looking to runtime authorization to help.

2:43:51Runtime auth is the practice of authorizing an agent per tool call rather than having

2:43:57the agent hold broad standing access that it will eventually misuse.

2:44:01However, is this tool call or not is never a simple question.

2:44:06is because many MCP tools and APIs are coarse-grained, humans struggle to write the

2:44:13perfect policy, and the environment around the agent will change as it runs.

2:44:17And intent can help by providing extra context so that at runtime we can make better authorization

2:44:24decisions about what an agent is allowed or is not allowed to do.

2:44:30So to continue, I would like to talk about, really dive into why do we need intent based

2:44:36off in the first place.

2:44:39have dramatically improved.

2:44:40They have bigger context windows.

2:44:42They're able to verify work because model vision capabilities have improved.

2:44:47and many contexts people are proclaiming that AGI is here.

2:44:51If the models are so good, if AGI is really here today,

2:44:55then why are teams struggling to give their agents more autonomy?

2:44:58Ian, let's start with you.

2:45:00You're helping many financial enterprises at Keycard.

2:45:03What are you seeing that's getting in the way?

2:45:05I think, broadly speaking, enterprises,

2:45:07especially financial services firms,

2:45:08regulated industries are almost always security first.

2:45:11It's how they build trust in their business

2:45:13and maintaining the business continuity

2:45:14is by our first priority.

2:45:17Then innovation is second, third, or fourth.

2:45:19I think, like, broadly speaking, in any enterprise,

2:45:23what you see is this, like, hodgepodge of different little islands,

2:45:26of different little identities, of different little systems

2:45:28from across all different worlds.

2:45:30And how do you actually tie that together

2:45:32in a way that an agent can navigate through that,

2:45:34ask for access, and then also ensure that the agent can outperform, like,

2:45:38something that was unintended by the user of the business.

2:45:41And the unfortunate situation is most of our systems today are coarse-grained, right?

2:45:46I don't know, Salesforce is a good example, where for a long time they had a single scope

2:45:49which was API on their OAuth, which is, in the context of an agent, not very helpful.

2:45:55So that's the broadly the first and foremost part, is that most of the systems they have

2:45:59for security today were designed for a world where humans were making all the decisions

2:46:03and software is very deterministic, not this new fangled magic box we've invented that basically

2:46:08reasons and tries over and over again to find a solution to a problem.

2:46:13How is OAuth part of the problem?

2:46:15How is OAuth getting in the way?

2:46:16Why is it not the right fit for agents?

2:46:19When people started looking at how do we authorize agents to access something, the

2:46:23tool that was sitting there on the shelf was OAuth.

2:46:26People grabbed that tool and said, here's the tool.

2:46:29This is authorization.

2:46:31It should be able to solve the problem.

2:46:32OAuth was not designed for this kind of world.

2:46:35It was designed originally for how do I let this website talk to this website.

2:46:40In OAuth 2, we added scopes. Before that, it was just do anything.

2:46:45But it required you to be pre-registered.

2:46:48It's expecting that there's a browser involved in a redirect.

2:46:51OAuth has evolved over the years to support some other things.

2:46:54But the agentic world is completely different.

2:46:57We don't know ahead of time what the agent needs to do.

2:46:59We need to go and make that decision over time.

2:47:02Different instances of an agent are going to need different kinds of things.

2:47:04and as Ian talked about, the granularity of the scopes

2:47:09that people says, well, we already have scopes for OAuth,

2:47:11let's just map those over to agents,

2:47:13is far too coarse-grained for what agents are doing.

2:47:18Davis, how are you seeing enterprises move towards higher levels of autonomy?

2:47:23Yeah, I think the key piece is how do you deal with that coarse-grained problem?

2:47:27And what I've seen the kind of more successful enterprises

2:47:30is they kind of board agents like they onboard developers, right?

2:47:33start with you don't get full commit access day one. You have to go through and add the

2:47:39levels of capability as they mature. So the definitions that enterprises are coming up

2:47:44with are what is the context that makes this agent safe. And it isn't just usually what

2:47:48the agent says. It can attest to something but it's other things like the environment

2:47:53around it and other information that can help you understand levels of autonomy. A very

2:47:57simple example would be where is the sandbox running? Is it in the sandbox? Those type

2:48:02but things can change the level of autonomy that's allowed.

2:48:05Absolutely.

2:48:06Yes, we mentioned that core screen access problem,

2:48:08and to put that into perspective, to give an example,

2:48:11with Notion’s MCP server, you can say fetch this page,

2:48:15which is like the view page tool or get page,

2:48:18but you can't say just get this database on this page.

2:48:22How is runtime authorization based on intent a better model?

2:48:25That's for anyone.

2:48:29I'll take a shot at it.

2:48:30So to me, this is something that the financial services industry,

2:48:33hopefully maybe we can learn from the background that banks have gone through.

2:48:38Banks moved long ago from authorizing and authenticating humans

2:48:41to authorizing the transaction, right?

2:48:44And when is that transaction occurring?

2:48:46At runtime, right?

2:48:47And so I think that runtime authorization is we're going to be able to learn

2:48:52from the scars of the past that we've had and apply it to this new problem.

2:48:57I also think that one thing is

2:48:59it's a lot easier to debug something at runtime

2:49:01when you understand the intent

2:49:03I think we've all remembered back in the day

2:49:05writing checks

2:49:06or seen those things on TV now I guess is the right thing

2:49:09but writing checks

2:49:11there was a memo field there

2:49:12that memo field was used to actually tell the intent

2:49:15of what this payment was

2:49:16but the check itself did have limits

2:49:18the price, the payee, the date

2:49:21etc.

2:49:22I think a lot of those concepts are now being applied

2:49:24and can be applied to help with this runtime

2:49:26time. Intense sort of one of those, you know, like many words, words are hard. And so, you know,

2:49:32building on the example here of making a payment of a transaction, right? You know, that's not a

2:49:37scope. That's, can I do this one thing in this particular context? Well, this one payment. But

2:49:44I think we need an agent to make any decision should it be able to do it. You need all the

2:49:49rest of the context of, well, why are we making this payment? What are all the things that happened

2:49:53before. Did we just make

2:49:55the same payment just like five

2:49:57seconds ago and now this is a double payment?

2:50:00Just because this is right in context by itself doesn't mean it's the right thing within the broader mission.

2:50:08In Auth, we're working on the concept of a mission that is what do we want the agent to accomplish big picture?

2:50:14And then each of the decisions are made within the context, the intent around what's happening big picture around doing that.

2:50:21and you need granularity at the transaction layer

2:50:25for many of the things to know what exactly is happening,

2:50:28not just I'm allowed to go and make payments.

2:50:32Yeah, I think one of the most interesting things,

2:50:34I think about a practical example,

2:50:36to understand why intents are required,

2:50:38is if you have two ChatGPT sessions or two Claude sessions,

2:50:41in one session I say, hey, help me go do some shopping,

2:50:44in the other session I say, hey, help me understand

2:50:47why there's a bug in production.

2:50:48Those have very different profiles in terms of what permissions they should have and also

2:50:54when they should bring you back into the loop.

2:50:55When should the human be involved again?

2:50:57At the end of the day, if we don't have intent or some capacity to relay what is the user

2:51:02or the business's intent with this thing, we actually can't get to autonomy.

2:51:06A lot of the talks this morning were, hey, we're going to run our business on agents.

2:51:09We're going to do all this stuff.

2:51:10Great.

2:51:11What happens the first minute, like a pocket OS style instance happens where it actually

2:51:15accidentally delete the production database instead of staging because it has coarse grained

2:51:18access instead of long scoped access.

2:51:22What we want as an industry is to leverage this magic box we've created to automate our

2:51:27lives.

2:51:28The current state of the world is that you can do that and take all of the risk and then

2:51:32you can see all of the instances that come from it.

2:51:33Until we solve that underlying problem, realizing true autonomy, being able to operationalize

2:51:38our business and be able to step away as humans and scale that, we have to solve intent first.

2:51:46Absolutely.

2:51:47And now that we understand why we need intent based off, let's talk about what it is practically.

2:51:51What are the primitives?

2:51:52What does it actually look like in practice?

2:51:55Dick hinted at it with the concept of the AAuth mission.

2:51:58So, Dick, elaborate on the mission.

2:52:00What is the mission based off of?

2:52:02Is it based off of the user's intent?

2:52:04Is it the agent's intent?

2:52:06Or is it a combination of the two?

2:52:08Well, the agent should be working on behalf of the person.

2:52:12And in AAuth, we define a person as either the organization or a human

2:52:16because it could be operating on either one of those.

2:52:19And so it needs to be acting in the best interest of the person that it's acting on

2:52:23because that is who's ultimately responsible for what the agent does.

2:52:29The agent can't be responsible.

2:52:32And so the mission is something that the person is giving the agent to do.

2:52:37the agent, a good agent, is going to go and negotiate with a person to go and talk more about

2:52:42what are the parameters around that. A good example is when you think of back in the day,

2:52:50which seems like three months ago, when you would want to code something up and you'd create a plan

2:52:55and then the agent would do the plan. Now you just tell it and it figures everything out.

2:52:59But that whole concept of what's a plan, what are you trying to do, and you give that to the agent,

2:53:04And so then that then is a context around where you're making authorization decisions later on.

2:53:10And then that mission identifier tracks through everything.

2:53:14So you can go and, you know, audit and be able to see what were all the things that happened

2:53:20and what were the decisions that happened in the context of this one mission, right?

2:53:24Where today, you know, there isn't really a good concept of agent identity or the mission, right?

2:53:30It's just making something and things are making decisions without really knowing which instance of the agent is doing it or what's the context of what mission is this involved in.

2:53:42Tell me more about that negotiation phase.

2:53:44Because what happens if a user is talking to an instant agent and it talks to the agent and says, I want you to go read the CEO's email.

2:53:52That's outside of the scope of that agent.

2:53:54So is that intent rejected from the user?

2:53:58Should be.

2:54:00So with a good separation, I don't know whether, I forget whether we're talking about this

2:54:05later, but the separation of concerns of the worker, right, there's an agent that's doing

2:54:10the work, and we believe there should be a separate agent that's supervising what this

2:54:15one does.

2:54:16And so that you have a separation of concerns where this one can't do any of the work, but

2:54:21it gets decided what this agent gets to do.

2:54:23And so if the user says, oh, I want you to go read the CEO's email, that's probably going

2:54:28to get caught in deterministic policies right away.

2:54:33not a vague thing.

2:54:35Reading somebody else's email, we've got good controls for that.

2:54:40telling the agent to send the CEO's, forward a CEO's email to the outside world, that's

2:54:50a little more vague, and that's the kind of thing that ideally comes back to a supervising

2:54:54agent says, that's probably a bad idea.

2:54:56And no, you can't do that.

2:54:58Absolutely. So I feel like that's another

2:55:00primitive, too, of intent-based office, is

2:55:02policy.

2:55:04Ian at Keycard, how are you seeing that? When a mission

2:55:06needs to change or a policy needs to update,

2:55:08how can Keycard help keep track of those

2:55:10changes as maybe the mission or policy

2:55:12updates need to be made? Yeah, I think, like,

2:55:14taking a step back, there's, like, actually, it was

2:55:15Davis and I were sitting in a room some time ago,

2:55:18and before,

2:55:20like, AAuth and some of these things

2:55:22It emerged in the ecosystem.

2:55:23One of the things we talked about was consent fatigue.

2:55:25I think at the minimum you always have this like how secure do you make a system versus

2:55:31the trade-off of the impact of the human.

2:55:34So a key card, our broad view on this is you want to have broad basic deterministic policy

2:55:38that basically says this is what must never happen effectively.

2:55:41Or these are the things that always require a human to be involved.

2:55:45And then from there what you really want to think about is okay, cool.

2:55:48well, now that I have that in place,

2:55:51there's a big gap between all of the policy

2:55:52I can write as a human or write as an organization

2:55:55and then what I actually want the policy to be

2:55:57in the specifics of a specific task.

2:55:59And so the real challenge is

2:56:02how do I layer over those two things?

2:56:04Because humans can't write at all.

2:56:06And so there's a version of that

2:56:07that is like a user or agent-to-agent interaction

2:56:09and they have an intent between those two

2:56:11of transactional intent.

2:56:13And there's also the business's intent

2:56:15for why they build or adopt an agent.

2:56:17So why did we buy Claude Code?

2:56:19Well, because we wanted to make our developers more successful

2:56:21or because we wanted to do these different things.

2:56:23And in the context of using Claude Code or whatever,

2:56:27why am I working in this moment with Claude Code

2:56:29while it's actually to fix a bug in staging, right?

2:56:31And those are two different types of intent.

2:56:33And if we can understand those two different things

2:56:35and then convert that some way into like a bounding box

2:56:39of what those agents can do,

2:56:40you can then basically calculate the intersection of that

2:56:43and say, okay, here's what you can actually do.

2:56:44And the trick for anyone building these systems is how do I ensure that I don't bring the

2:56:49user into the loop except when absolutely required because that's what's going to be

2:56:53the adoption curve problem.

2:56:54But that's also the adoption curve problem when it comes to, like, enabling agents to

2:56:57be autonomous in the first place.

2:56:59That makes sense.

2:57:00I like what you were saying with the intersection.

2:57:02I think that's a unique thing we don't talk about enough within identity and access management,

2:57:05right?

2:57:06Normally you get access to one thing, right?

2:57:08And so what I've seen successful kind of in this intent-based approach and where I get

2:57:13more excited is you can actually have

2:57:14those different intents be from different areas of the

2:57:17organization. And so you have

2:57:19the decoupling of these things that they can

2:57:21kind of live on their own, but then come together

2:57:22to form that decision.

2:57:24And that decision doesn't have to be static.

2:57:26So if we use the example of the CEO's email,

2:57:29well, if that context

2:57:30involves that's the administrative assistant,

2:57:33then yeah, maybe she is supposed to read the email.

2:57:35Or maybe just the calendar.

2:57:37And so I think when we see and we start

2:57:39thinking about these intersection components,

2:57:41we have a totally different way we can start

2:57:43expressing policy, but also starting to bring in not just the one side of the equation we

2:57:48always talked about before, which was the app doing something.

2:57:51Now we actually have the ecosystem you can bring in.

2:57:53And so the more I see organizations starting to realize that maintaining that state or

2:57:58that context of these other elements to be able to help with that intention can completely

2:58:02change the way you're effective at runtime authorization.

2:58:05And are you seeing this across enterprises today?

2:58:08Most people have mission tracking and policy tracking in place, or is that largely missing

2:58:11today. It's brand new still. Part of the reason why I'm excited to talk about it is

2:58:17it is changing the way to reason through this. Even in the most simplistic case, if you're

2:58:22a developer and you are thinking in terms of things like transaction and you have these

2:58:26concepts of intent, it makes it easier for you to potentially build the components that

2:58:31will be composed and used through that intention. I think it will give us more ways to reason

2:58:36through these and communicate and ultimately be more interoperable. To me, the last thing

2:58:41that I think is interesting is the

2:58:43diagnostics that you can run on this.

2:58:45Intention is something that flows

2:58:47through many events, potentially.

2:58:49And I think one of the examples

2:58:51I've seen before is talking about

2:58:53that mission flows through.

2:58:55It could be long-lived. It could be weeks.

2:58:57That intention can still be there.

2:58:59So it's still very, very early for most

2:59:01enterprises. Absolutely.

2:59:03And yes, that interoperability is key, and I think that's pretty

2:59:05hard for enterprises because they're

2:59:06between different clouds, different environments,

2:59:09different legacy systems, and that

2:59:11policy that mission has to hold through all of those

2:59:13different hops. A lot of enterprises

2:59:15still have to deal with the fact that the permission

2:59:17says read only and it's still read right.

2:59:19Right? It's like, you have the other problems

2:59:21you have to start dealing with. And so

2:59:22I think that it will help get

2:59:24the kind of taxonomy or language

2:59:26amongst people to be easier to interoperate.

2:59:30Absolutely.

2:59:31One of the reasons why I'm excited

2:59:33about intent-based authorization is

2:59:35because I think it has the ability

2:59:37to be a huge unlock for things

2:59:39like agentic commerce.

2:59:41So let's apply intent-based auth to something real.

2:59:43I think intent-based auth adds a lot of value here.

2:59:46And for users, it can help them ensure their agents

2:59:48buy the right item with their own personal budget.

2:59:51And for merchants, that means capturing the intent that

2:59:53gives them extra data to understand why a purchase

2:59:56is being made and if this agent should even

2:59:58be trusted to visit their site.

3:00:00Davis, when we think about agents in the context of financial services and agentic commerce, why is intent-based auth so important?

3:00:07I think simply it extends the concept, maybe not everybody is aware, but some are around, you know, know your customer, right? So I want to know my customer, know who they are, what they're doing. But I think also we're starting to see I want to know my agent, right? So I think that you have a coupling here around the agent itself, the intent of the actual user, the intent of the operator.

3:00:25operator, the intent of the processor, right, et cetera.

3:00:29Before now we couldn't really bring those together.

3:00:32It matters of course when it comes to things like commerce because you have additional

3:00:35layers on top of this around what was the intention for things like regulatory requirements,

3:00:40et cetera.

3:00:41And this is going to help, I think, simplify those operations, which means we'll get more

3:00:45access to these agents doing good work for us.

3:00:48That makes sense.

3:00:49And another blocker for agentic commerce is the fact that the web wasn't made for agents.

3:00:54Ian, can you tell us how agent identity can help?

3:00:57Yeah, I think stepping back,

3:00:59we've kind of always had this problem

3:01:00where like, what do you do with the unregistered client?

3:01:03So like, I show up on eBay, I haven't logged in,

3:01:06I'm using Chrome, eBay doesn't know who I am,

3:01:09how do I do guest checkout?

3:01:10How do I approve of a person?

3:01:11How do I, you know, so they can say,

3:01:13yeah, you can bid on this pair of socks for $50.

3:01:16And I think if we're all paying attention

3:01:18to what's going on in personal agents,

3:01:20Muse and Instinct and GrokBot,

3:01:22And recently this announcement around this personal agent protocol is the fundamental

3:01:28problem we have is how do you have an agent show up to a website, be able to interact

3:01:32with the website, know that you actually can trust that agent, so for a long time it captures

3:01:37on the web.

3:01:37Why?

3:01:38Because we want to prevent spam, we want to prevent abuse.

3:01:41So we added captures and that's something only a human could solve.

3:01:44So if we have a capture that stops spam so they can't spam the thing.

3:01:47Now we have agents and they've broken captures.

3:01:50But this has been a traditional problem on the web.

3:01:52In fact, if you think back two to three years, Vercel, which I think we're all aware of,

3:01:57was blocked in Spain.

3:01:59Why was Vercel blocked in Spain?

3:02:00Because Vercel shared the same IP addresses for every single host on Vercel, and there

3:02:05was one host on Vercel, one website on Vercel that they were hosting that was hosting, like,

3:02:10premier league content.

3:02:11And Spain decided, hey, in order for us to stop that premier league content being displayed

3:02:15illegally inside Spain, we're going to block all of Vercel.

3:02:17In the same way that Vercel has the problem, agents have the same problem, but so much

3:02:23worse.

3:02:23How do you have unregistered traffic you've never met before, show up to your front door

3:02:28and decide whether or not you let it in or not?

3:02:30That's the first and foremost fundamental problem we have to solve.

3:02:33It's the same issue with Muse and Instinct and what they're trying to do is how do we

3:02:36actually create agreeable rails so we can all operate on so as a downstream resource

3:02:41I can decide what agents will allow, who I trust, based on who users they are.

3:02:46And then on the other side, I can also know how to talk to those people.

3:02:50Makes sense.

3:02:52Dick, how is AAuth helping unlock the future of agentic commerce?

3:02:58Well, a key thing is a number of people have been building

3:03:01sort of proprietary closed-box systems, right?

3:03:04So I'm a fan of the concept of the personal agent protocol poppy,

3:03:11but it doesn't really go far enough, right?

3:03:13It's like, okay, well, now we've got a bit of an agent identity.

3:03:16We just use some of the building blocks,

3:03:18and it's an attractive approach because you're just doing it,

3:03:21but it doesn't solve many of the new things you need for an agentic world.

3:03:26And so a key motivator for people for having standards

3:03:31is that you can plug components from different places.

3:03:34So I'm a strong believer that we should have control over what our agents do.

3:03:40At some point, agents are going to be doing so much work,

3:03:43there's no way we can have human in loop approving everything, right?

3:03:46That's just not, we've already seen that that isn't going to scale.

3:03:48So that means we need to have a supervising agent

3:03:51that is our supervising agent that runs our policy

3:03:54and decides how we do things

3:03:55that should be independent of the agents doing all the work.

3:04:00And if we want to be able to plug and play those things,

3:04:02we need to be able to have a protocol to separate those.

3:04:05Otherwise, you know, the decision about what the agent can and can't do,

3:04:09what the guardrails, is decided by the agent,

3:04:12by the vendors of the agent around what you can and can't do.

3:04:15And I don't really want to go and give control to them

3:04:18to decide what I can do,

3:04:20and that all my decisions are based in there.

3:04:22I want to be able to pull that supervision into another component.

3:04:25And in order to be able to plug and play pieces,

3:04:28we need to have a protocol that things interoperate.

3:04:31I would just add to that.

3:04:32I think right now what we're seeing is we all want the web to be federated.

3:04:37That means websites or resources on the web

3:04:39can decide what they're allowed to do,

3:04:41but the standards upon which things operate should be federated and enable us all to interoperate.

3:04:45I think we're at a moment where things like, you know, we're at a moment where there's a couple

3:04:49large players, and the question for the industry is, are we going to settle on things that actually

3:04:53bias to the large players and give them, like, concrete blocked doors, or are we going to move

3:04:57to do the thing we've always done, which is build federated protocols? Things like OIDC,

3:05:01things like, you know, TLS, those things operated and enabled, like, a broad web, enabled a lot of

3:05:05commerce to occur, enabled a lot of information to flow, enabled all of us to have jobs in a way

3:05:09that because we could be inventive.

3:05:11And so the question I actually ask the broad industry is,

3:05:14okay, this stuff's coming,

3:05:15which version of the world do we want one way or the other?

3:05:19I think it's interesting that, let's say this all goes perfect,

3:05:22and we've got agents buying stuff and everybody's kind of happy.

3:05:26What I think will end up happening is we'll start realizing

3:05:28that we have another piece that we have to start working on,

3:05:30which is the human itself.

3:05:31And so one of the things I think when you start having intents being involved

3:05:34is you get what's called psychological ownership,

3:05:36meaning I actually now have a linkage between the human

3:05:38and the outcome of that agent.

3:05:40When you're just kind of disconnecting it

3:05:42or you connect it up on an OAuth scope

3:05:45or something like that in a claim,

3:05:46it's kind of magic.

3:05:47And you don't really know what's going on.

3:05:49And so I think with intention,

3:05:51it'll be easier for humans to take accountability

3:05:53when things do go wrong.

3:05:54And I think when you're talking about

3:05:56real money being transferred or things like that,

3:05:58you want to have that human ultimately accountable.

3:06:00I think many people have probably seen

3:06:01the 1979 IBM manual.

3:06:04It says, you know,

3:06:05and so that photo I think is very true

3:06:07that we can't have the machines be accountable, right?

3:06:10We're going to have to have the humans linked to it,

3:06:12and intention, I think, is that link.

3:06:14Yes, and then, yeah, another word for intent is motive,

3:06:18like we were talking about last night.

3:06:22And that ability to hold someone accountable,

3:06:24whether it's a person or an agent, I think is really important.

3:06:26I think intent can also help with that,

3:06:28be able to understand why did this go wrong?

3:06:30Was it the user was mal-aligned?

3:06:34The agent was mal-aligned?

3:06:35and then using that intent to be able to respond.

3:06:39For each of you, how are you seeing intent provide that benefit

3:06:41and the ability to respond to potentially a maligned user or agent?

3:06:45I think it's going back to what I mentioned before about diagnosing.

3:06:48So if you change the word intent to motive,

3:06:51then you change diagnostics to forensics.

3:06:54And I think anybody who's done debugging

3:06:56or had to do forensics of an AI agent gone rogue

3:06:59will know that trying to figure out what it was trying to do

3:07:02versus what the intention of the user was is very hard.

3:07:05right? So having some of that information being propagated and immutable through the system,

3:07:09et cetera, gives you some properties that allow you to more short circuit your investigation,

3:07:14right? And as those things become more interoperable, I think we're going to start

3:07:17seeing companies be able to more quickly kind of scope and identify, well, was this a human error?

3:07:22Was this an agent software error? What was that error? And handle that blast radius appropriately.

3:07:27We see in the financial system, right? You have different things when you're doing a transaction

3:07:31around, okay, I made this payment,

3:07:33but it was incorrect dollar amount

3:07:35or whatnot. You have clear guidelines on how

3:07:37to work with that. We don't have a lot of those

3:07:39when things go wrong right now. So I think

3:07:41intention will help us build those as we go

3:07:42forward.

3:07:46And I think one area where a recent

3:07:49incident kind of highlights where

3:07:51intent,

3:07:52you can have good intent, but still take

3:07:55potentially the wrong action is the

3:07:57resi incident that happened recently

3:07:59where an instinct agent

3:08:00went out on behalf of a user and tried to book a restaurant reservation on resi.com.

3:08:06That agent was very eager at 200 API calls an hour, and it ended up getting the user's

3:08:12resi account banned.

3:08:15Dick, how can AAuth budgets help in the case where an agent like that is using way too

3:08:20much of a downstream resource, but it still has good intent?

3:08:24Yeah.

3:08:24Well, this is another example about how just software is completely different now in the

3:08:28agentic world, right? When it was predetermined software, you know, that was a bug if you called

3:08:33200 times and you would fix it. Where now, well, the agent's like, well, I'll just keep trying until

3:08:39they win. And so we saw that as we were, you know, experimenting, working with people with A-Auth,

3:08:45and we realized, yeah, there's a big problem that agents will learn something and they'll just

3:08:51abuse the system from, they don't think it's of abuse, they don't know any different, there's been

3:08:56no signal to tell them that, oh, I should only use this amount of stuff.

3:09:00And so we added the concept of budgets, where not only do you give a token to the agent

3:09:05that's time-limited as to how long can they do a particular action, but also a budget

3:09:11of how much resource they can do.

3:09:13And so they have access until the token's either expired or they've exhausted the budget.

3:09:18And so that way, when they come back and they've exhausted all the budget, the supervision,

3:09:24you can go and decide, should I give more budget to this agent or not?

3:09:28As opposed to traditional rate limiting, which just cuts it off,

3:09:32and then what do you do?

3:09:33And it doesn't know, well, why did I get cut off or anything like that?

3:09:36Where in budget, there's continual feedback to the agent

3:09:40about how much budget was consumed,

3:09:42has an idea about how much budget it has,

3:09:44and so now it can operate within a budget, right?

3:09:47Like a person would do, about, oh, this resource is scarce,

3:09:51I'm going to be careful about how much I use this.

3:09:54And how does the brains versus the hands architecture concept come into play here to

3:10:00allow us to, okay, when a budget is close to being fully reached or is reached, how can the brain and hands separation of access and the credentials being separate from the agent and the model itself help us to be able to stop an agent from using too much of a downstream resource? Because if it's getting close, then maybe we don't exercise the ability to give it another credential, for example.

3:10:22Sorry, I didn't quite follow

3:10:24The echo in here is horrible

3:10:27No worries, that's for anyone

3:10:28But basically, so with the brains

3:10:30And the hands architecture that we're

3:10:32Converging on in an industry, we're basically

3:10:34Keeping the credentials and the access

3:10:36From an agent separate from the agent itself

3:10:38So there's no broad standing access

3:10:40That an agent has today, no API keys

3:10:42Which I know is a benefit of AAuth

3:10:44That AAuth allows agents to run without API keys

3:10:46How is that helpful

3:10:48In the context of the Resi incident?

3:10:52you've got the access to it

3:10:55sorry I still don't understand

3:10:56I can jump in

3:10:58I got you Dick

3:11:00broadly speaking I think if we look back

3:11:02at an incident that I just keep on top of my mind

3:11:04it's like Pocket OS where I found a random key

3:11:06on a disk

3:11:07obviously agents are deeply goal seeking

3:11:10so the core of the question

3:11:13is like okay well if we give these

3:11:14agents, the brain which is the model

3:11:16and the LLM and you have these hands

3:11:19which is you kind of put them in a sandbox

3:11:20and inside the sandbox are the tools.

3:11:23The final idea

3:11:24of the sandbox here

3:11:25is that you can control what's inside

3:11:29of it. So it can't actually get

3:11:30API access. And then if you have an

3:11:32egress proxy outside the sandbox

3:11:34that's where you get to have your authorization boundary.

3:11:37And so not only does it help

3:11:38do translation between systems

3:11:40which is like that's where AAuth can exist

3:11:42and talk to the outside world or determination

3:11:44but also means that the agent

3:11:46you have an ability to apply authorization

3:11:49at the egress proxy boundary.

3:11:51And so I think at the core of it,

3:11:53that model, which is the predominant model

3:11:55of Anthropic and OpenAI

3:11:57and many other labs are pursuing today,

3:11:58is the model that allows us to both have the things we want,

3:12:03which is how do we have these things experiment

3:12:05and try stuff out and do silly things,

3:12:07which is the core value,

3:12:08while also having a deterministic layer outside of it

3:12:11that can implement things like AAuth

3:12:13and all the other components we want in our protocols.

3:12:16I think the decoupling is valuable.

3:12:17going back to what I mentioned with forensics

3:12:19and be able to separate things, but I do think that we

3:12:21still have a lot to learn on it isn't just

3:12:23one brain. It's very easy

3:12:25actually to build your agent loop

3:12:27where you put the brain in the loop rather than outside

3:12:29the loop. An example of this would

3:12:31be people that are leveraging memory

3:12:33systems. They put in some

3:12:35memory and some context that is now used

3:12:37going forward for every agent that is

3:12:39biasing that agent to make a decision

3:12:41to tell the hands, in this case, to go do

3:12:43something it shouldn't do. One of the things

3:12:45that I think we don't talk about enough here is

3:12:47toxic combinations.

3:12:49And so when you do separate the hands

3:12:51and the brain and whatnot, you can actually

3:12:53change up what hands are available.

3:12:55So the example that I've seen

3:12:57be very successful is the removal of tools

3:12:59dynamically based on that actual brain

3:13:01and what it's doing. So the earlier

3:13:03example we gave of reading an email,

3:13:05there's nothing that says that, oh, if they're going to go

3:13:07write an email, I'm going to disable all

3:13:09web search tool calls or any

3:13:11other external egress capability

3:13:13tool call wise until the right email

3:13:15tool has been complete and that

3:13:17mission has been done, then I can re-enable them.

3:13:20And so I think that we're going to start becoming more and more

3:13:24engineering at these different kind of concepts. They are still complicated,

3:13:28they're still growing and still nascent, but I think it's a better separation than we have today.

3:13:32Yeah, and this is how these things we're talking about, which seemed like geeky

3:13:35problems actually then merge back up to real agent engineering problems, which is

3:13:39if you actually understand what you're doing, one of the biggest complaints, less now, but one of

3:13:43the The biggest complaint is context bloat, but intent systems can ensure the right capabilities

3:13:50should be given to the agent at the right time so they don't spend a bunch of time doing

3:13:54things they shouldn't be doing.

3:13:55It helps them navigate towards the goal state and put them on more of a paved path.

3:14:00So intent not only unlocks a bunch of security stuff, intent also will result in us spending

3:14:06less tokens because the agent will spend time doing less things that aren't the right pathway

3:14:10or it'll come up to the point and say, hey, I just can't do it.

3:14:13And so what we know about this era is so much of it is about nudging the agent in the right direction

3:14:17and ensuring you can't do the wrong thing, and that's how you get the outcome you want.

3:14:23Davis, how are you seeing intent-based auth as part of a larger strategy for production agents?

3:14:29I know when it comes to building, deploying, and operating agents in production,

3:14:33there's many different outcomes teams should be thinking about,

3:14:36such as discovering what's running, what the agent's capabilities are,

3:14:39the ability to validate inputs and outputs,

3:14:42constraining an agent like we talked about

3:14:43and using the egress proxy and different networking rules.

3:14:46How does all of this fit into play

3:14:48and what's working inside enterprises today

3:14:50to really be able to ship agents to production?

3:14:52I think we're following.

3:14:54It's helping move the kind of conversation

3:14:56from authentication to authorization

3:14:58and really like how do we do dynamic authorization?

3:15:01How do I validate that authorization?

3:15:03How do I have the human in the loop at the right time?

3:15:05Because I agree with what Dick was saying earlier

3:15:07that the human in the loop is somewhat of an anti-pattern

3:15:09in many ways, right?

3:15:10Because they can get fatigue, et cetera.

3:15:12But you need to have a way to bring them in

3:15:13when it's important.

3:15:15Those were not engineering discussions before, right?

3:15:17Now they're actually part of the engineering conversation

3:15:19where engineers are being involved

3:15:21in the authorization process.

3:15:23They're not just saying,

3:15:24oh, I've got my access, I'm good to go.

3:15:26So that actually changes the way we're seeing

3:15:28front models done.

3:15:28It changes the way we're seeing

3:15:29the full attack surface of applications in general.

3:15:33And so I think you're now looking at this authorization model

3:15:35as another kind of set of tools that you can use to reduce not just security issues,

3:15:42but flat-out error rates of your agent, right?

3:15:44Like, I mean, when you have less things the agent can do, it makes better decisions, right?

3:15:49And so fundamentally, we've seen, you know, real-world cases where the agent loop is just better, faster, stronger

3:15:55because you've actually spent the time on knowing what is the intent they're trying to get,

3:15:59what's the mission that they're trying to accomplish.

3:16:01And then last thing is it brings the people together in terms of,

3:16:04we now have other different people, the security team,

3:16:07the application team, they're now able to have a conversation

3:16:09that they're using the same language.

3:16:12And a lot of times when it came to identity,

3:16:13it was a completely different language, right?

3:16:16It was just like, get out of my way, what do I have to go do

3:16:18to go ahead and get my token and I can go forward.

3:16:21Now they're seeing that you can actually pair these things

3:16:23and leverage that capability to drive efficiency

3:16:26of your actual agent's outcome.

3:16:28That makes sense.

3:16:29Ian, how are you applying these concepts to software factories?

3:16:32I know today you released a reference architecture

3:16:35on the secure software factory.

3:16:37How are you applying the concepts of runtime authorization,

3:16:41constraining agents, and all of that to that?

3:16:43Yeah, I think, like, so there is a reference architecture

3:16:45we just published on agentbaseline.org.

3:16:48We talked about three different levels of factory,

3:16:51one being, like, a human-driven one,

3:16:52one being a workflow-driven one,

3:16:53one being, like, this agentic-driven one,

3:16:55which is, like, the thing we all basically want to get to,

3:16:58which is, like, it's driven by agents.

3:17:00And at all points in time, the runtime authorization is a core component of a larger ecosystem.

3:17:06It actually enables the factory to be able to be pointed in that direction and do the

3:17:10right thing and also get access to the right piece.

3:17:12And it looks different than previous things that you would have used, like a secret manager,

3:17:17because it's making very different decisions than previous generations' head for managing

3:17:21deterministic software.

3:17:22But it is a core component of enabling the entire thing to work, like when to bring someone

3:17:25into the loop, when what agents can pass what work off to what other agents.

3:17:29how can we have an agent that can have access to production systems and do an auto patch.

3:17:33These are fundamental questions of how do we actually solve at-scale software.

3:17:37Right now we're in a position where we've never been able to generate more software,

3:17:41but we have a complete bottleneck in getting into production and ensuring it works.

3:17:45And that's the next phase is how do you actually graduate from just using L1 to generate text

3:17:49and software to actually making it capable of deploying it into production, iterating on it,

3:17:55and getting it to a stable state quickly and then responding to instances that arise.

3:18:01Davis, on a podcast you did with me, we talked about how cybersecurity has something to learn

3:18:06from robotics.

3:18:07In robotics, there's this concept when maybe a robot raises its arm, it thinks, is it safe

3:18:12for me to raise my arm?

3:18:13Should I?

3:18:13Am I allowed to do that?

3:18:14But it also looks at its external environment and says, what has changed?

3:18:18Is it still safe for me to raise my arm?

3:18:20When we think about runtime authorizations, what do those decisions need to take into

3:18:25context beyond just intent?

3:18:27Yeah, I think having a model like this allows us to add in more sensors into our decisions.

3:18:33So the robotics example of an arm moving up or down, any of the external factors, it could be are there other objects near it, right?

3:18:41It could be temperature.

3:18:42It could be, well, am I moving and I don't want to move my arm while the rest of the robot is moving, et cetera.

3:18:48So it's usually looking at all different types of things.

3:18:51None of those are deterministic.

3:18:52They're all probabilistic.

3:18:53So there's a range of options, and it picks the best option based on all of those sensor data at one time.

3:19:00Most authorization decisions in organizations today are still single binary decision, right?

3:19:05And that just doesn't work in the future, right?

3:19:07So being able to pair the intent of what a user is trying to do with the ecosystem that the user is doing it in.

3:19:13That could be where they're doing it from, time of day, but it could be even more advanced things.

3:19:17Like, for example, should I let this administrator use Firefox to access this server right now

3:19:23when this server has high-risk vulnerabilities and their system hasn't been patched to?

3:19:28Now, all of a sudden, you're bringing in a lot more context into the environment around it.

3:19:33And again, that can be through different teams, but more importantly, through sensors.

3:19:37And I think we've all kind of seen the value of observability in general.

3:19:41Imagine being able to have this type of context at the span level from an OTEL perspective or something.

3:19:45You're looking at a trace, you've got a span, and you actually know what the environment was outside your application at that time, as well as what the user's intention was.

3:19:54That allows you to diagnose things in a completely different way.

3:19:57And so I think if we can bring in some of those

3:20:00concepts,

3:20:00we'll get shorter time, shorter to live authorization decisions

3:20:05have much more context than even just a user's intent.

3:20:08It'll be the state of the environment around it.

3:20:11That makes sense.

3:20:13And forward-looking, as we evaluate whether intent-based authorization

3:20:16is working in our environments, one natural place

3:20:18to look will be a log of the agent's actions, what was denied,

3:20:23what was allowed. Ian, why is it important to have your autolog separate from the agent

3:20:29itself, meaning outside of its control?

3:20:32I think this comes back to also just like why the unfortunate point has to be outside

3:20:35the primary hands and brains of an agent, right? You can't trust this thing. And so

3:20:39in the hugging phase incident, it had a couple of different components of it. I mean, one

3:20:42obviously abused a vulnerability we didn't know about in Squid proxy, but more importantly,

3:20:46he didn't have any observability or monitoring about what was going on. And so this thing

3:20:50was able to go to the open Internet through this vulnerability and there was no place

3:20:53at which recorded the different actions that this agent was taking and for them to monitor.

3:20:57So independent of whether we're applying an enforcement point to network traffic that's

3:21:03pushing it on the Internet that it's a reach of the agent to tamper with or solving vulnerabilities

3:21:07as their pop-up, this Hugging Face one is a little unique, we still need to actually

3:21:12have a record of who told this agent to do what thing for what purpose and is that still

3:21:17true?

3:21:17Because ultimately at the end of the day what we're dealing with agents is a liability question.

3:21:22I don't think we need more regulation around agents.

3:21:24What we need is our pre-existing laws around liability to be dealt with.

3:21:28Which is if I employ an agent to do some action, who is liable if that action causes damage?

3:21:34It is the person who employs it.

3:21:35Which could be an organization or a person or someone that delegated some action to something.

3:21:40That is the final question we have to deal with.

3:21:42And then of course you have to have the ability to answer that question.

3:21:45and which is, well, who did it,

3:21:46and which is where the tamper-resistant autolog comes from.

3:21:51Perfect.

3:21:51And then to wrap up, I wanted to ask you all a fun question.

3:21:54So there's the concept of the probability of doom or PDoom,

3:21:58where the AI doomers are saying that AI agents

3:22:01are going to release all sorts of havoc

3:22:04or be like the ruin to humanity,

3:22:06whereas the AI optimists are like,

3:22:07no, this is really poised to help us.

3:22:09It's not a genuine threat.

3:22:11For each of you on the panel,

3:22:13what is your take on this?

3:22:15is runtime authorization based on intent.

3:22:18The other things we talk about, like constraining agents,

3:22:20validating inputs, outputs,

3:22:21a holistic strategy for production agents,

3:22:24is that enough to save us?

3:22:26Is PDoom real, or is it not worth the hype?

3:22:31You get to start, Dave.

3:22:32Oh, I get to start, Dave?

3:22:33You've got that spicy look on your face.

3:22:38Well, part of your question is,

3:22:39are agents going to take over?

3:22:40And I think agents being fully autonomous

3:22:44and not really tied to a particular organization

3:22:46is still science fiction.

3:22:47So who knows, right?

3:22:50That's one direction.

3:22:52Another one is, in a responsible organization

3:22:54that's put in the right controls,

3:22:56agents aren't, we're getting and evolving enough

3:22:58of the tools to make sure that bad things don't happen

3:23:01in a responsible organization

3:23:02that's put in the right controls.

3:23:04And so that leaves two scenarios

3:23:06for where there's going to be a potential problem.

3:23:08One of those is, in an organization

3:23:10that hasn't got its act together,

3:23:12an insider threat could go and unleash an agent to cause havoc.

3:23:17So they've got some special access that other people have.

3:23:20The other one, the one that I'm more concerned about is,

3:23:23it's been shown the hugging faces,

3:23:26and if you watch the talk that they gave at Black Hat,

3:23:30that was really a call to arms around,

3:23:33here's a situation where we didn't want a bad thing to happen

3:23:37and a bad thing did happen.

3:23:38what about people that want bad things to happen and have these tools?

3:23:45And that, I think, is a threat that's the one that's potentially going to have...

3:23:49I mean, it's going to happen, and there's going to be some catastrophes.

3:23:52Hopefully, we're prepared enough that those aren't horribly disastrous.

3:23:56But it's going to be, you know, there's going to be some things that are, like,

3:24:00massive natural disaster-like scale issues caused by malicious

3:24:06actors, either intentionally or unintentionally, but it's where people aren't being responsible

3:24:12in their use of these super powerful tools.

3:24:17I can't give a specific probability, but what I can say is I think I've always been

3:24:25surprised and excited when the ingenuity of engineers gets involved in problem solving.

3:24:30and I think where we're at the stage now

3:24:32some of the new capabilities within agents, etc

3:24:34we have real engineers, folks that are here

3:24:37actually just iterating on the problem

3:24:38and we're starting to see just tremendous improvement

3:24:41in my mind

3:24:42some of the capabilities that will be available to

3:24:44change what our future can be

3:24:46and so to me, I have no problem

3:24:48believing the engineers are going to figure out a solution here

3:24:52Maybe I have the hottest take

3:24:54I can't say it's equal to zero

3:24:56but I would say it's approaching your asymptotically zero

3:24:58is the probability the world is going to end

3:25:00I think the incentive structure for most people is to continue.

3:25:03And also, at the end of the day, we still have liability frameworks.

3:25:07And I think generally humans are good people,

3:25:09so we don't set out to destroy the world specifically.

3:25:12I also think, broadly speaking, these agents,

3:25:15I have this sort of hot take, I say,

3:25:16which is they can just be unplugged, but I think it's just true.

3:25:19It's like, at the end of the day, they're computers,

3:25:21you can unplug them.

3:25:24So, broadly speaking, I don't believe in the debate.

3:25:26I don't think it's real.

3:25:27I think at the upside of it, I kind of believe more to what Dave's disposition is, we're

3:25:33iterating very quickly.

3:25:34We're figuring out where these things can work and where they don't.

3:25:36And when they don't work, they create damage.

3:25:37And that's what ultimately sort of the antibody of society is that says, hey, maybe we shouldn't

3:25:44do this.

3:25:44It's probably a bad idea.

3:25:46I'm the doomer on the panel.

3:25:48It's unfortunate for people like the founder of Pocket OS who lost a bunch of data.

3:25:53But it's great for the rest of us because we all learn together.

3:25:55and at the end of the day, that results in people not doing things

3:25:59that don't make a lot of sense and I think that will continue to be true.

3:26:03Makes sense. Thank you each for your expertise and your time here on this panel today

3:26:06and thank you to the audience for listening and we'll catch you next time.

3:26:10Thank you.

3:26:11Thank you so much.