Full Workshop: Agent Auth Protocol — Paola Estefanía de Campos, Better Auth

Talk transcript

1. 0:00

   [upbeat music] Well, hello, everyone. Can you hear me all okay?

2. 0:15

   Yes?

3. 0:16

   Yes.

4. 0:16

   Perfect. Well, welcome to our talk, our workshop actually. Um, I know maybe you were expecting, uh, Bereket also. He couldn't come. But we make this workshop together for you.

5. 0:29

   Okay? So as you see, you have the QR code. You can go ahead and go there. It's, um, our page for Agent Auth Protocol. So that you have it and I don't have to spell it for you.

6. 0:42

   Um, okay, so my whole idea today is instead of, like, me telling you stuff, and you do this, and show you how to do stuff, I want us to take one hour at least to think about agent security, agent auth.

7. 0:59

   Because sometimes we are excited about, like, this new AI era, right? But we never think about, or maybe yes, but not as much as I wished. [laughs]

8. 1:09

   What happens when you, for example, say, "Hey, agents, where are my, maybe my schedule for tomorrow? Where are, send an email"? Have you ever thought of this? How many of you, like, raise your hand, like, how many of you use AI agents every day?

9. 1:27

   Okay, higher. Don't be shy. [laughs] Okay, right. How many of you give them access to your Gmail, to your calendar, to your personal accounts? How many of you? Oh, so much less.

10. 1:38

    Okay. The ones that do, like, what do you do? Like, do you connect an MCP server? Okay, yes. And we have another one, good. Maybe you connect, like, your personal token to, like, .env endpoint.

11. 1:52

    Okay. So what happen when we do this?

12. 1:56

    We're actually doing, like, the agents is acting on behalf of us but pretending to be us.

13. 2:03

    So do you think that's a good idea?

14. 2:07

    Yes or no? Who thinks a good idea? [laughs]

15. 2:11

    It's not a great idea.

16. 2:12

    Not a great idea. Why?

17. 2:14

    Uh, well, it could go awry. It could use your identity to do things you would not want.

18. 2:20

    Exactly, and why we didn't thought about this, like, before?

19. 2:25

    It's okay. So it doesn't matter. Here we are. We are thinking about it. I always remember, uh, the time, like, when internet came. Like, I'm old, almost [REDACTED:age], so I remember. [laughs]

20. 2:34

    And everybody was so happy about it. But then started to question, like, okay, everything, the whole data is public. It's like we are in the same moment today, right?

21. 2:45

    Like, we are really excited about AI, and then after, we start to think about security. [laughs] But it's good. So why I put there, "Hire your agent"?

22. 2:55

    The analogy I want you to think about, let's say you have a company or a part of a company, and you hire someone. Do you give them-- You need them to have access to things of the company, right?

23. 3:08

    So what do you do with these people when you join? Or when you join, what did they give to you? You have, uh, your own email, right? Your own access, your own credentials.

24. 3:18

    So if you think about it in agent world, what are we doing with our agents?

25. 3:25

    We are, it's like we are doing, like, the CEO credentials, right? You never say, "Okay, this is the credentials of CEO. Go and read the email." No. Because everything, anything will happen.

26. 3:34

    This is the same. The idea will be hire your agent in a sense of give them your agent's authority instead of your credentials. Do you think it's a good idea?

27. 3:45

    How-- Yes or no? [laughs] Okay, my idea is, like, I know sometimes, um, we could be shy, but I want-- I think it would be nice, like, if we can interact a bit because it's a moment that, thanks to AI engineer and all of us being here all of your time, we can get together and think about something.

28. 4:04

    I think it's not common, right? So make one hundred percent out of it. Um, okay, great. So did you all got the page there, the QR code? Yeah? Great.

29. 4:16

    So remember, like, my idea of saying, "Okay,

30. 4:21

    agent, read my emails," right? Have you ever thought, like, how the agent gets to there, how it gets to your email?

31. 4:30

    First of all, how do agents know what they can do?

32. 4:38

    Description.

33. 4:38

    Huh?

34. 4:40

    The description, uh, at the top of the file defines what it's supposed to do. That's where you-

35. 4:46

    Okay, great. So you, you do it by hand, right? It's not that something automatic.

36. 4:50

    No, you can-- So the agent can learn the description-

37. 4:53

    Yes

38. 4:54

    ... from that.

39. 4:54

    Exactly.

40. 4:55

    And the agent can learn that.

41. 4:58

    But-- Exactly. But some-

42. 4:59

    Context window.

43. 5:00

    Huh?

44. 5:00

    The context window.

45. 5:01

    Exactly. Context window also too. But you always somehow connected something to the agent, like, okay, this is what you can do, right?

46. 5:08

    So what if we have, like, a, an ideal world or an agent can go to maybe a directory and say, "Oh, this is the whole thing I can do, and this is all the things I can execute"?

47. 5:19

    That would be a smartest idea, right? Have you ever used a phone book?

48. 5:25

    Yeah, right. It's the same. Like, who I can call? So I go and look in the phone book, and there I have how to call, I have the number.

49. 5:31

    They will be the same. What, what I wanna do, and how do I call it? So that was our first problem, discovery, how agents discover what they can do.

50. 5:41

    And the idea will be it will be an automatic way, not just us all the time telling how and connecting and stuff, right?

51. 5:50

    Then also, there's another part. It would be nice [laughs] to tell the agents or, like, grant agents what they can do and what not, but really specific.

52. 6:04

    The ones that connected the Gmail accounts, maybe they all gave them read access, right? Just read so we can, I don't know, don't send or, like, not remove anything so it's more safe.

53. 6:15

    Okay, but what if you have so many important, uh, information there that then if the agent something gets, um, wrong and somebody else can read your data? It's not good either.

54. 6:25

    It's not safe in any way. So what if we can get all this, what the agent can do, all these tools, as he mentioned, and you can grant access to every tool?

55. 6:38

    Like this yes, this no, this reading is okay. That would be a better idea, right? So we think about authorization to that agent. Not like to act behalf of me and have everything I can do, then the agent can do.

56. 6:53

    It's like going back to the hire example, that a person, like I just hire, has all the same access that the CEO. Or maybe you hire, have an assistant, uh, or a friend that do something for you, like in your real life.

57. 7:08

    You will never give your access to all your things, right? And if you do, you change them after. [laughs] So this is the same thing.

58. 7:15

    And also, okay, we have an ideal world when agents can discover what they can do, then we can tell them what they can do or not, but how do we trace them down?

59. 7:29

    How do we trace today what the apps do on our behalf when we authorize them? [laughs]

60. 7:37

    Huh?

61. 7:38

    Log files.

62. 7:39

    Exactly. All the logs. So perfect, all the logs. So how... In the other logs, like I see what? I need to see some

63. 7:48

    identification, right? Which agent did what on behalf of which user. In order to do that, it comes to our main thing, give the agents identity.

64. 8:01

    If we have, if every agent has identity, we can trace them down. We can know what agent did what, when, in behalf of which user. It seems like so much, [laughs] so much better, right?

65. 8:13

    And also, what else you can do when you can trace someone?

66. 8:18

    Regarding to the whole hiring thing, you can fire them if they do something wrong. You can revoke s- access. In the same way, the agents will be revoked if you know who they are.

67. 8:29

    If something were wrong with today's things, you have to disconnect the whole thing, right? Yes or no?

68. 8:35

    So imagine you have, oh, this agent fucked up. Sorry for the word. You can remove it. That's it. So we have traceability. We have the whole thing.

69. 8:47

    Okay. So as a come out, as a sum up,

70. 8:50

    we have the discovery issue, where the agent can go find the service and read the capabilities. Authorization, what this agent can do, can do, scope down, and who is this agent?

71. 9:04

    Are you on board with this? Do you think it's a good idea?

72. 9:07

    You have any questions, like, jump in. Okay, great.

73. 9:12

    Have you ever heard of a ca- capabilities? Raise your hand.

74. 9:17

    Yes? Okay. Do you all know what a capability is?

75. 9:21

    Who doesn't know? Okay, almost the whole room. Okay. So the idea of using capabilities is instead of using scopes. You know, like scope is like a big thing. For example, you have the read scope.

76. 9:37

    So it c- what, what that mean? It's like nothing so specific. The idea of capability is what agent can do, but it's more cut down. So I can actually determine what an action agent can do.

77. 9:51

    So the idea is going back to the example I put in the beginning. Let's say you talk to the AI in the chat and you say, "Okay, give me my emails from the last week."

78. 10:06

    So the agent has an intent to do something, right?

79. 10:10

    It has to be a way that that intent has to be mapped to a tool or maybe several tools.

80. 10:18

    So that's kind of the idea. The tools will be like capabilities and an intent will be matched to that.

81. 10:23

    So that's what we were solving with discoverability.

82. 10:27

    If you ever read the, the protocol that we are proposing, or maybe read it later, you will see, um, our idea of a well-known agent configuration endpoint. If you know about, a little bit about identity, you remember OIDC, right?

83. 10:43

    OIDC Connect. These are the same, well-known. And the idea is like to an agent have like a public place to know how they can interact with the service. Like everything, the kind of encryption, uh, et cetera.

84. 10:57

    So it will be something like this. And also a place to list capabilities and stuff.

85. 11:06

    But what happen, for example, in a world like today that we are still... I hope, I hope in the future we adopt this. But in the meantime, all the services, they are still working just with OAuth.

86. 11:16

    So how do we do it in the meantime?

87. 11:21

    What do we need to agents to be able to know which, what they can use from each, each service? Let's say Gmail.

88. 11:32

    We can build something like a directory. [laughs] So the idea is, um, to have something...

89. 11:40

    Wait, I'm gonna see it here. So let's say most of the... Mo- You're, you're familiar for OpenAPI? OpenAPI spec? Yes? Okay. So

90. 11:53

    most of the common services we use, they all implement OpenAPI. So we have like a kind of a place to, we as a developers or engineers, we can say, "Okay, what this service can do?"

91. 12:05

    So the idea is to use that. And convert it to capabilities. So, at the beginning un-until we... Every service is specification auth. So let's say, for example, do you guys use...

92. 12:18

    I don't know. Tell me a, a service you use.

93. 12:24

    OpenAI.

94. 12:26

    Huh?

95. 12:28

    OpenAI.

96. 12:29

    OpenAI?

97. 12:29

    No.

98. 12:29

    Huh?

99. 12:29

    Gmail.

100. 12:29

     Okay. Gmail, we have it there, but let's say for example, let's see if it works. OpenAI, openapi.json. And sometime they have public, they have the publics, but we need like a JSON.

101. 12:44

     Uh, I don't see it. OpenAI open. Okay. I do know... I think it's this one.

102. 12:53

     No. Well, you know what? [laughs] That was wrong.

103. 12:58

     Why?

104. 12:58

     No, Notion has a really good one. I wanted to use another one from you guys, but the Notion is more reachable.

105. 13:04

     So, here. So see. So if you have, for example, not every service has, but the OpenAPI JSON.

106. 13:12

     What we doing with the Agent Auth Protocol is translating this.

107. 13:19

     Not provided. Oh, I already registered it. So I'm gonna show you guys.

108. 13:26

     Yeah. Versus this one. Sorry. Mm, mm, mm, mm.

109. 13:34

     Don't see it here. Oh. Okay. It will form something like this. This is like an example, but it's like the same. So you will get all the capabilities from the endpoints.

110. 13:49

     You see sometimes you see like a delete, a get.

111. 13:52

     So it would kind of be like the actual ap- approach, like a middleware to this point.

112. 13:58

     Excuse me.

113. 13:58

     Yes.

114. 13:59

     Can you turn the, turn the mic off maybe?

115. 14:01

     Oh, sorry guys. Thank you for telling me. And,

116. 14:05

     uh, okay. Here. That is better? Oh, thank you. [laughs] Sorry guys. [laughs] Okay. So the idea is to see here, is like you can translate the endpoints to capabilities. So because we are still...

117. 14:21

     This is just because we still, we don't, uh, have so much services or let's say none, like implementation auth. But the idea is like in the meantime we have something that translates this.

118. 14:32

     So what this mean? It means like... Let me check. Uh. Mm, mm. It means like

119. 14:41

     you will have something... For example, do you have there in the Agent Auth Protocol, do you see, do you have a directory? This directory will have, for example, the Gmail one that we did the same.

120. 14:57

     So you see you have, for example, 20 list of capabilities.

121. 15:02

     So the idea is like you grab what the service can do, what is exposing, maybe through OpenAPI or maybe you do it yourself because, um, for example, maybe you want to automate a workflow.

122. 15:14

     So the idea is like everything get list here. So the directory will be like a phone directory for the agent. Are you following me?

123. 15:22

     Yeah.

124. 15:22

     Yeah?

125. 15:24

     Is this similar to like fine-grained auth?

126. 15:27

     The what, sorry?

127. 15:28

     Like fine-grained-

128. 15:29

     Yes. I mean, it's a good point. Did you heard, uh... Did you hear him? Like fine-grained auth? Okay. So the idea is yes, in a sense of having the most scoped thing as possible, but still fine-grained auth still goes like

129. 15:44

     minting a token to the user. We want to mint a token for the agent. So what we are switching is the principle. We now want that the agents are a principal actor.

130. 15:55

     That is a really good thing. That's why we inspire on that. I think it's one of the best things we can do.

131. 16:01

     Okay, great. Um, so going back to the capabilities,

132. 16:08

     the idea is what I just said, like having this scope ones that you have like the readings or like maybe, uh, just the gets or the deletes or the posts.

133. 16:17

     Like everything is wide discerned so you can decide whether an agent can or not.

134. 16:25

     Okay. Until here, you have any questions? Yes.

135. 16:29

     What if the API is small for the fine grain, uh, payload?

136. 16:34

     Yeah. Yeah. That's, No, that really sucks. Uh, [laughs] the idea is, m- you can do it manually. You can actually declare everything, so in the directory so in the future the agent know how to do.

137. 16:45

     It's like less common, but yeah, it could happen.

138. 16:50

     But the idea is like in, in the meantime we do this until services implement these Agent Auth. But yeah, it's a good question.

139. 17:00

     Um, okay. So remember like our problems, right? So now we, we are trying to get a solution for how like the agent is, the agents know what they do with the directory.

140. 17:12

     Then we have a way to authorize them through capabilities. And now if you remember, we said it was a good idea to get them identity right.

141. 17:23

     So where we come is giving agents like a private key,

142. 17:30

     like famous private key. So each agent will have its own, and that will be attached to the identity.

143. 17:38

     Um, so in that sense, because every agent has its own identity, now if you... I see. You want me to put this on the light mode too?

144. 17:49

     Yeah.

145. 17:49

     Ah, why didn't you say that before? [laughs] Okay, let's go back to this. There. That's better? Great. [laughs]

146. 17:59

     Zoom in. Okay. [laughs] There? Great. So now that the agent will have like a access to his own private key, they can sign tokens. They have like their own minted tokens, and everything is encrypted with the private key.

147. 18:17

     So what this means, like from now on, instead of like a service, let's say Gmail, seeing like a user interacting with the service, we can have a log that we actually say, "Okay, this agent is doing something on my behalf that is connected to the user."

148. 18:35

     But it's actually, for example, agent from Cursor or an agent from Cloud or an agent from whatever. So we are changing the paradigm. We have stopped seeing as, uh, an agent it's like hiding behi-behind the user, and now the agent is there as a principal acting.

149. 18:51

     So it's, it's, uh, for me, it was really exciting. [laughs]

150. 18:56

     So do you have any concerns about this private key, private key policy? Yeah.

151. 19:08

     So like, for example, if the agent was like to delete your entire database or whatever, like you can revoke access to the agent?

152. 19:11

     Exactly. That's beautiful, right? You can say, "Oh, this is not doing what it's supposed to be doing," and I go, and I revoke it.

153. 19:17

     So it's good. And maybe you can think of like, okay, the, the I revoke it, but the access token is still there. So what you can do is like delete it with the GDI, so bye.

154. 19:29

     Yes.

155. 19:31

     How will I know what human being operating the agent that could be in production database?

156. 19:38

     Mm-hmm. Always the token, always the agents, they always have a, a user they are reporting to. They are never detached. So always the, the agent is like with a user.

157. 19:49

     Um, from an audit, audit perspective-

158. 19:51

     Yeah

159. 19:52

     ... you know, on that point, if an agent was to delete, like would the principle of the agent show up like on logs such that like it was the agent-

160. 20:01

     Yes

161. 20:01

     ... that took action?

162. 20:02

     Yes. Exactly. You have like all the information. Like the agent, also the host. We are intro-introducing a new thing that is called host. That is like the place when you are like creating these agents from.

163. 20:13

     So you actually can also delete the host. You can say, "Okay, this host is not authorized." So you can see the host, you can see the agent ID, you can see the user, you can see everything.

164. 20:24

     Okay. Great. [laughs] More questions? Okay. Don't be shy. Like, we are here for this.

165. 20:32

     Yes.

166. 20:33

     Uh, so this is a nice answer, but [inaudible]

167. 20:39

     Can you speak a little bit higher?

168. 20:41

     Oh yeah. So just like on identity-based agent authentication, right? From that kind of like approach that, for example, like AWS set up, you can use identities in IAM.

169. 20:52

     Mm-hmm. [inaudible] Yeah, that's a great question. Um, actually, it's more like an enterprise focus, right? So because we did this in February,

170. 21:04

     the things changed so much until now. Like, for example, agents are not so ephemeral. Maybe you have a forever long agents, right? Or maybe you have two agents. Or maybe you have agent inside of a company, and they have policies.

171. 21:16

     So we are working on that in a new draft, and we are addressing that too, um, because it's something quite, um, important to address. So yes. I was about to say that in the end, but yeah, we're about to release a new draft with, uh...

172. 21:29

     If you have-- This is an open source. It's a project that we want to all of us own. So if you have some ideas, like you reach out, like, like that one, for example, it's really good so we can improve.

173. 21:39

     It's good for ourselves and good for everyone. And I don't want this to be just like for enterprise, just to all of us that use AI that we're safe.

174. 21:47

     So thank you. Okay. So that was, that was just discussing about the V1 to V2.

175. 21:56

     Um, great. So three layers, then one protocol. Why we say this? Because if you go and in the search in the website, you will see we publish like a first version, just like a draft or a Agent Auth plugin inside of Better Auth.

176. 22:15

     The idea is you can use this and play around and see what you come up with. So in the Agent Auth plugin,

177. 22:23

     you can, uh, use it like on the server side, so a server can verify an agent or issue grants or enforce whatever constraint that you have been doing with that.

178. 22:34

     Also, on the SDK side, uh, we ship it with an MCP, so you can connect it to your cloud to try it out. You connect it to your, whatever you're using, Cursor, whatever you're using with S-MCPs.

179. 22:44

     And also, the other layer is the directory. It's just a place like a phone book, like where the intent match what the action. So intent will be matching the capabilities.

180. 22:59

     Um, so the idea is that we can see it in action.

181. 23:07

     So what we will do, if you want,

182. 23:10

     you can go to what I shared in the QR code. Let's go to the page.

183. 23:19

     Okay. You will see a directory there. Did you all find the directory button? You will, you will come into this, and you will see a Connect button.

184. 23:29

     So you have to log in first for sure, and you will see a Connect, and then you will see the MCP.

185. 23:36

     So you can connect that, for example, to the cloud. I have it here. I wanted to, to show you guys a bit what we were talking about.

186. 23:45

     So let's say we say... I'm gonna ask for emails, okay? I just need a bunch of demo emails, but I'm gonna show it to you guys, so I don't share like personal information.

187. 23:56

     But for example, I have my MCP connected, so you will see something like this. Uh, connectors, customize. Here, you see Agent Auth.

188. 24:08

     You will see something like this. Then you can approve, disapprove, or with deny, which is the Agent Auth, um, MCP. And if it's that, my idea is like you try it out just with MCP of Agent Auth, so the agent doesn't have access to other tools.

189. 24:23

     So it's like the principal one to see how it interacts and how it gets the identity. Our whole idea is like when you use this MCP, the agent will have an identity, will request you for capabilities, it will try to execute it, and you-- we will see the logs and everything, uh, uh, running.

190. 24:39

     Okay? So let's see, for example, um, okay, bring me my last email. [microphone feedback]

191. 24:49

     Oh, sorry. So it's gonna use the agent auth connectors. Can you see? It's too small.

192. 24:59

     It's okay? Okay. Okay, you see? It's using the-- Because it has the MCP, it's using the directory to see from my intent of like, bring me my last email, which capabilities are out there, and he's asking for approval.

193. 25:18

     We are using here device, uh, device flow. Do you know the device flow? Are you familiar? It's just like-- It's like connecting a device. So we are acting like it's a, it's a-- agent is another device.

194. 25:29

     So you can see, uh, the agent called-- it's called Email Reader. It's that for default. You can change later if you want to. It's requesting me to read and list my emails.

195. 25:40

     We're gonna approve. And I'm gonna show you that, guys, later.

196. 25:51

     So the idea here, um, is that the agent will connect, will get the identity. He, uh, will have the last email.

197. 26:01

     Okay. Okay, great. We have a last email. So we know agents can read emails. That's not the demo. [laughs] The demo is what, what happens. So remember we-- at the beginning, we said if we gave identity, we can have logs?

198. 26:17

     So let's see what the agent did. So I know I have an active agent. There's some email reader. It has this agent ID. It's in a local device.

199. 26:27

     It has these things. And also I can see here, this agent with this user ID,

200. 26:34

     okay, I see the agent here, just is the email reader, and it got these results. So

201. 26:41

     I'm actually tracking down what the agent did, right?

202. 26:46

     So now let's say I want the agent to, I don't know, send an email. By default, what we are proposing is like all the hosts, like for example, Claude, has reading capabilities by default.

203. 27:01

     So then it wouldn't mess up your agent with your inbox, right? So let's see. Uh, let's send an email. Who has like a really short email that I can put in there?

204. 27:14

     Hello, world. Hell-- Really? [laughs] No, but a, a actual one. Oh. [laughs]

205. 27:23

     My gosh. Who has like a good email? If not, I can put like my own, but if you guys wanna show...

206. 27:28

     Okay, so I'm gonna put mine. Uh, you see, I made to myself

207. 27:36

     saying... I'm gonna use hello world. I thought that your email was hello world was so cool. [laughs]

208. 27:44

     Okay. So the idea here is if you-- as you just saw, like, the agent just have, like, the reading capabilities. Ideally, it will never could send the email without me granting it.

209. 28:03

     So, for example, uh-uh, we can see it here, right? The only capabilities it has is two-- these two. So it will try to

210. 28:15

     see it here. We can also-- We also did like this extension for us to actually watch it better what the agent was doing.

211. 28:24

     Okay. Okay. Auth array is dispatched with security verification.

212. 28:31

     Okay. So you see? This, um... the agent now is using CIBA, like async calls, like it's client vaccination authorization. Instead of like s-just showing me like, uh, redirect and see a device that I approve in, I could approve from here.

213. 28:49

     So for the demo, I'm just gonna approve.

214. 28:53

     And now that the agent has approved, I approve it.

215. 29:00

     It will be actually sending the email. So you will see

216. 29:07

     in the capabilities here that now it can send the capabilities of, uh, send emails. And actually,

217. 29:16

     we can see here, he just s- it just send the email. Right? So

218. 29:22

     what do we wanna try this? We're gonna see if it's, uh, no, no. Okay, here is the email. Okay? So

219. 29:30

     what we wanna try now, let's say there's something went wrong with the agent, somebody is trying to access my Gmail, trying to grab the sector, whatever. So the idea of this whole thing is to have the trac-traceability we just saw is on the logs, right?

220. 29:44

     And what if we wanna revoke it? Let's try-- Let's try to revoke it and try to, for example, read my emails. So we're gonna revoke it first, so it cannot see a thing.

221. 29:56

     Uh, doo-doo-doo. Oh, I lost the page. Here. So in agents, we can revoke the agent. So bye-bye. And now we can say, "Read that last email you just sent."

222. 30:18

     Okay. You see? The connection got revoked. So what happened now? Why it can read it anyway?

223. 30:36

     Because what we did is, like, he created another agent, another identity, because I revoked th-the one before. But this is just happening because the get, the list, is a default capability in our host.

224. 30:49

     Because for us, it's safe. What if now I wanted to say, um,

225. 30:56

     send a email saying hello to myself? It will do the same. It will ask for it. So actually, it's working, right? I can actually revoke it. I can see the logs.

226. 31:09

     I can say what the agent can do or not. Don't you think it's, uh, it's, it's kind of nice to have this kind of workflow? It's more controlled.

227. 31:18

     Yeah? You have any questions about this? H- Something that pops into your mind? Yeah. [inaudible]

228. 31:25

     Yes. Yes. Fine, yeah. Every constraint that you wanna m- be careful about, you can put in the capabilities. So it's good.

229. 31:39

     Could you put that in the same kind of vault? Like, say you're administering this-

230. 31:40

     Mm-hmm

231. 31:43

     ... server with capabilities in it.

232. 31:45

     Yeah.

233. 31:45

     You know, certain things are more dangerous than others.

234. 31:45

     Yes.

235. 31:45

     You can define a vault with maximum time-

236. 31:47

     Yes

237. 31:47

     ... that an agent can run for.

238. 31:47

     Yes, exactly. You can say m-maximum, maximum time of ex-executing. You can say the time. You can say everything. Yeah, it is. [laughs] Thanks. There.

239. 32:00

     So I'm understanding right, instead of how it kind of normally happens without Agent Auth, where the harness itself enforces human in the loop-

240. 32:11

     Mm-hmm

241. 32:12

     ... you're kind of shifting that to the proxy layer or to the MCP server, and that's what's enforcing human in the loop?

242. 32:19

     Well, you can have both.

243. 32:21

     Okay.

244. 32:21

     Our idea is, like, to be safe, but not to be annoying. Imagine every time you had to read something or had to approve every time. You're gonna hate us, you know?

245. 32:29

     So the idea is, like, a, a host, for example, or incluso... Sorry, I was, I was talking in Spanish. [laughs] Include, um, or like maybe a host or, like, someone specific you want.

246. 32:40

     Like, for example, let's say a CEO can't do everything and they, like, are recently joined, just have, like, this specific access. So you can do it, like, by user policies, as I was talking about, or you can do it, like, host policies.

247. 32:52

     So you have to be, like, in the middle, I think, of, like, good UX, uh, in the good u- user experience, but also secure enough.

248. 33:00

     But ultimately, it kind of centralizes that enforcement.

249. 33:04

     Yeah. Is the ser- Yeah. Yeah. Yeah, because, uh, Agent Auth, what we're doing, like I said, I said you can try it out, uh, with the server part is the one that's gonna verify the agents, like back with the users, gonna verify the policies.

250. 33:17

     We're gonna verify it has access or not. So yeah, all the time verifying. So yeah.

251. 33:24

     Great. Um, so the whole idea was to show you this. Uh, I was trying to ask the agent to send. Uh, I need to confirm. So you see? So I-- here I have the request.

252. 33:37

     I didn't accept it. So let's say I deny it. It will be like the same. I just did.

253. 33:45

     So ideally, he wouldn't. You see? That's red. Okay. So it's working good. So he wants me to allow it, and I'm gonna, I'm gonna... So can you tell me agent status?

254. 34:00

     So you can have all the time, like track down what agent is doing, if revoked or not. It has... Yeah.

255. 34:08

     So what are the parts pretty easy here? It's, it's like MCP server, um, the control the internal MCP server, you can have, uh, skills that, uh, you know, want to have open MCP server office without the skills, and it's still gonna control them, um-

256. 34:25

     Oh, are you saying if you have, for example, a skill that is saying to use the MCP server differently?

257. 34:30

     Using the open API, uh, like-

258. 34:32

     Directly

259. 34:33

     ... [inaudible]

260. 34:34

     Yeah. Well, actually, what we are doing is we are enfor- and this just an example for you to see how the protocol is doing, just like a demo. But you can enforce, for example, that the agent, the only thing that can use, um, is the MCP tools, in this case.

261. 34:48

     That's what we did with the plugin. But yeah. You have, like, for our next protocol, it's gonna be like more, um, more capped down. So the only way the agent can go out and ask for services is through the Agent Auth Protocol.

262. 35:03

     So it's a good, really good question. Yeah.

263. 35:09

     What was the other UI that you were showing?

264. 35:09

     The what, sorry?

265. 35:10

     The other UI for the-

266. 35:12

     The proxy?

267. 35:13

     Yeah.

268. 35:13

     Here.

269. 35:19

     Is this, this is part of the auth variant that you have?

270. 35:24

     Yes. Uh, you have this in the directory. Now you can use it. Like, when you log into, for example, you are connecting a lot of services in the directory.

271. 35:31

     So the agent, when it connects to the MCP, can know the capabilities that it can do. So inside of the MC- the proxy, you can see, for example, in the Gmail, you can see all the capabilities the agent can do.

272. 35:42

     You can see, like, the agents doing stuff, the logs and everything. So every log is, like, capped down by provider.

273. 35:50

     Okay? [laughs] Okay, um, and about that, um, our actually proxy is just a directory. It's not a real proxy. For us, like, proxy is a really bad idea. It's not scalable because proxy uses data.

274. 36:04

     So in this case, it's just like a directory matching intent with capabilities.

275. 36:11

     Okay. Um, so... [sighs] Okay. So back again, if you wanna try it, you can. Like, it's, it's there live. You can use, like, the Agent Auth plugin, the SDK.

276. 36:27

     It's really nice because- We started, like, from the problems, and now actually the solutions, right? Like the discovery, authorization, and identity. Um, this is kind of, uh, what I will show you guys, like MCP, how to connect it.

277. 36:42

     Um, the SDK side with MCP is the one that is creating the, the, the keys and assigning to the, to the agents. And the server side is, like, verifying, authorizing grant, um, giving the grants that are also authorized by the user and, and so on.

278. 37:00

     So for me, the most interesting thing of all is we need to stop giving credentials, our credentials, to our agents. We need to give them authority.

279. 37:16

     This... Should we stop saying, like, "Pretend to be me," instead of saying, like, "Act for me within these limits"?

280. 37:26

     So we are almost in the end. If you have any questions, something that pops into your mind, or it could be also an addition of what I'm saying. I don't know if you ever thought of this.

281. 37:37

     Do you think it's a good idea that we implement something like this? I'm not saying this one, but maybe. Yeah? [laughs]

282. 37:44

     Okay. The idea is that this is open for everyone, so I would love you guys to join us on Discord, or you can send me a message, send me an email, be in the channel.

283. 37:55

     Like, be active, because if we improve this for all, it's gonna be good for all of us. Yes.

284. 38:01

     I see, uh, on the website this is a Python REST API. SDKs are still in development.

285. 38:06

     Yes.

286. 38:07

     If I go on, like, GitHub and look at the GitHub that's up there, can I actively start contributing-

287. 38:12

     Yes

288. 38:12

     ... to the development?

289. 38:12

     Yes, please. And please do. Yes. Please do. [laughs]

290. 38:17

     Sure.

291. 38:18

     Um, yeah, I'll just say, um, as far as, like, adoption, like, do we have to be on, like, Better Auth- Better Auth kind of stack?

292. 38:25

     No, it's totally ID agnostic.

293. 38:27

     Okay. So you can be-

294. 38:27

     Yes.

295. 38:28

     Like, we could use whatever we're on right now-

296. 38:31

     Yeah

297. 38:31

     ... and utilize this?

298. 38:31

     Exactly. That's the idea.

299. 38:33

     I'll also second what the gentleman was saying over there. Like, we're a large enterprise.

300. 38:37

     Mm-hmm.

301. 38:37

     Having something like IAM roles so that you don't have to define, like, each claim-

302. 38:42

     Yes

303. 38:44

     ... like, if you could just assume all the

304. 38:46

     Yeah. [inaudible] Yeah, but that's on our V2, and that's our prime focus now. So yeah, that's a great idea. [laughs] Great. Any- anyone else? Yes.

305. 38:56

     There's a KR protocol on the IETF track. Is that the same thing?

306. 39:00

     No, it's different.

307. 39:02

     Okay.

308. 39:02

     Yeah.

309. 39:03

     So no relation.

310. 39:04

     No. We also... A- I mean, we have, like, as an inspiration, like, everything that's out there, but it's not the same. It's different. Yeah. Because they are not still treating agents as a principal.

311. 39:14

     Okay.

312. 39:14

     We are treating agents as a principal. They have their own identity. So from that, it's different in that way.

313. 39:20

     And now, you-- there's no intents to go contribute to the IETF one? Or-

314. 39:25

     I, I don't know. We don't-- I don't have that information. [laughs]

315. 39:30

     Yes.

316. 39:30

     How would you distinct this between the AI Gateway?

317. 39:35

     I'm sorry, what?

318. 39:38

     How would you distinct this specific solution versus the AI Gateway?

319. 39:41

     Oh. Yeah. The... You see, I-- it's connected because of the discovery, but the... it's still the same. Like, for me, the most important part is, like, the agents be principals, have their own identity.

320. 39:54

     AI Gateway doesn't ha- doesn't do that yet. I hope [laughs] it does. But the whole idea is to have, like, traceability, have the whole life cycle, and to be able to track down and hunt, if you want, an agent.

321. 40:08

     So that you only ha-have if you have identity on e- on each agent, and AI Gateway is not providing that. Okay. Sure. Is there any more questions?

322. 40:21

     Okay. Well, you can reach me in the... That's my email if you want to email. If you, if you want to contribute together, uh, we... would be nice. Uh, that's my LinkedIn, too, and the Discord channel from the whole Agent Auth Protocol.

323. 40:34

     Okay, thank you so much. It's been a nice one. [laughs] [audience clapping] [outro jingle]