Who Is Making This Request? Agent Auth 101 - Kamil Potrec, Keycard

Highlights

• Traditional software and agents differ primarily because non-deterministic reasoning loops cause agents to handle data unpredictably after tool calls.

• Access tokens placed on personal machines remove corporate infrastructure protections and lack easy revocation mechanisms.

• Workload identity federation, private key authentication, and certificates allow systems to make agents authenticate before issuing any credentials.

• Using gateways or proxies establishes a physical control layer that prevents agents from obtaining raw credentials and enables instantaneous request revocation.

• Keycard provides a single control plane handling agent identities, token issuance, federation, policies, audit logging, and client SDKs.

Timeline

1. 00:43 - 05:15

   Agent Communication and Credential Risks

   Users frequently obtain personal access tokens that agents pass through or use alongside static keys. When an agent retrieves a pending invoice, it might mistakenly or maliciously send that invoice directly to a user, leaving no way to determine whether the human or the agent initiated the request. Furthermore, access tokens lack attribution, are easily moved to personal machines, and remain difficult to revoke.

   • Agents communicate with model providers via API keys and utilize remote Model Context Protocol servers for tool calls.
   • MCP servers use service accounts with aggregated permissions because they act across multiple users and back-end systems.
   • Non-deterministic reasoning loops allow agents to process retrieved data and execute unintended actions without clear user attribution.
2. 05:15 - 08:21

   Applying Dynamic Authorization and Industry Standards

   Technology to solve these security problems has existed for years without strong industry incentive. Instead of forcing users to fetch static access tokens, agents can advertise how to access resources and embed request capabilities directly into clients. However, deploying this at scale is difficult due to fragmented APIs, diverse agent architectures, and the lack of a single coordination hub.

   • OAuth enables dynamic credentialing where clients request authorization from external systems for specific, limited interactions.
   • Workload identity federation, private key authentication, and certificates enforce proper agent authentication before credential issuance.
   • Scaling agent security requires solving multiple challenges simultaneously, including hundreds of distinct APIs, diverse agent types, and user consent attribution.
3. 08:21 - 16:23

   Limitations of SDKs and the Role of Gateways

   Delivering secure agent authentication requires policy expression, audit logs, and adaptive layers to handle legacy software. While writing shared libraries and SDKs seems viable, adoption gaps, multi-language requirements, and persistent agent behaviors undermine client-side security. Moving credentials out of agent execution environments into secure vaults and routing calls through gateways creates a physical control layer that blocks unauthorized actions and improves request observability.

   • A proper agent authentication system requires dedicated agent identities, delegation semantics, short-lived scoped credentials, and federated trust.
   • Client-side SDKs fail to secure credentials because agents can bypass controls or exploit execution environments when bugs occur.
   • Gateways place credentials inside secure enclaves, intercept traffic, inject credentials at runtime, and enable instantaneous request revocation.
4. 16:23 - 18:26

   Unified Control Planes and Open Standards

   Replicating security functionalities across every team is impractical, which led to the creation of unopinionated unified platforms for secure agent operations. Developers must utilize open standards to ensure interoperability and avoid hardcoding credentials into agent logic. Reference implementations such as those at agentbaseline.org help teams adopt secure architectural patterns.

   • Keycard provides a single control plane issuing agent identities, handling federation, enforcing policies, and supplying client SDKs.
   • Agent authentication is no longer optional because agents have proven untrustworthy in complex real-world environments.
   • Agentbaseline.org offers a reference implementation of a software factory utilizing these security capabilities.