Intent Based Auth

2:16:24Hi.

2:16:25Hi.

2:16:27Hey, Dick.

2:16:29Hey, Davis.

2:16:29Hey, Ian.

2:16:30Hi, everyone.

2:16:31Welcome to AI Engineer New York.

2:16:34I'm super excited to be here today.

2:16:37My name is Allie Howe.

2:16:38I'm a member of technical staff at Keycard.

2:16:41I'm here with some amazing panelists today.

2:16:44We have Ian, CEO of Keycard.

2:16:47We have Michael Davis, global chief security architect at JPMorgan Chase.

2:16:52And we have Dick Hardt, the founder of AAuth and co-creator of OAuth with us on stage today.

2:17:00I'm super excited to talk to all of them about intent-based authorization.

2:17:04And to set the stage, I want to bring to light that as more companies are looking to give their agents increased levels of autonomy,

2:17:12they're looking to runtime authorization to help.

2:17:15Runtime auth is the practice of authorizing an agent per tool call rather than having

2:17:20the agent hold broad standing access that it will eventually misuse.

2:17:25However, is this tool call or not is never a simple question.

2:17:30is because many MCP tools and APIs are coarse-grained, humans struggle to write the

2:17:36perfect policy, and the environment around the agent will change as it runs.

2:17:41And intent can help by providing extra context so that at runtime we can make better authorization

2:17:47decisions about what an agent is allowed or is not allowed to do.

2:17:53So to continue, I would like to talk about, really dive into why do we need intent based

2:18:00off in the first place.

2:18:03have dramatically improved.

2:18:04They have bigger context windows.

2:18:06They're able to verify work because model vision capabilities have improved.

2:18:10and many contexts people are proclaiming that AGI is here.

2:18:14If the models are so good, if AGI is really here today,

2:18:18then why are teams struggling to give their agents more autonomy?

2:18:22Ian, let's start with you.

2:18:24You're helping many financial enterprises at Keycard.

2:18:27What are you seeing that's getting in the way?

2:18:28I think, broadly speaking, enterprises,

2:18:31especially financial services firms,

2:18:32regulated industries are almost always security first.

2:18:35It's how they build trust in their business

2:18:37and maintaining the business continuity

2:18:38is by our first priority.

2:18:40Then innovation is second, third, or fourth.

2:18:43I think, like, broadly speaking, in any enterprise,

2:18:46what you see is this, like, hodgepodge of different little islands,

2:18:49of different little identities, of different little systems

2:18:52from across all different worlds.

2:18:54And how do you actually tie that together

2:18:56in a way that an agent can navigate through that,

2:18:58ask for access, and then also ensure that the agent can outperform, like,

2:19:02something that was unintended by the user of the business.

2:19:05And the unfortunate situation is most of our systems today are coarse-grained, right?

2:19:09I don't know, Salesforce is a good example, where for a long time they had a single scope

2:19:13which was API on their OAuth, which is, in the context of an agent, not very helpful.

2:19:19So that's the broadly the first and foremost part, is that most of the systems they have

2:19:23for security today were designed for a world where humans were making all the decisions

2:19:26and software is very deterministic, not this new fangled magic box we've invented that basically

2:19:32reasons and tries over and over again to find a solution to a problem.

2:19:36How is OAuth part of the problem?

2:19:39How is OAuth getting in the way?

2:19:40Why is it not the right fit for agents?

2:19:42When people started looking at how do we authorize agents to access something, the

2:19:47tool that was sitting there on the shelf was OAuth.

2:19:50People grabbed that tool and said, here's the tool.

2:19:53This is authorization.

2:19:54It should be able to solve the problem.

2:19:56OAuth was not designed for this kind of world.

2:19:59It was designed originally for how do I let this website talk to this website.

2:20:04In OAuth 2, we added scopes. Before that, it was just do anything.

2:20:09But it required you to be pre-registered.

2:20:11It's expecting that there's a browser involved in a redirect.

2:20:15OAuth has evolved over the years to support some other things.

2:20:18But the agentic world is completely different.

2:20:20We don't know ahead of time what the agent needs to do.

2:20:23We need to go and make that decision over time.

2:20:25Different instances of an agent are going to need different kinds of things.

2:20:28and as Ian talked about, the granularity of the scopes

2:20:32that people says, well, we already have scopes for OAuth,

2:20:35let's just map those over to agents,

2:20:37is far too coarse-grained for what agents are doing.

2:20:42Davis, how are you seeing enterprises move towards higher levels of autonomy?

2:20:46Yeah, I think the key piece is how do you deal with that coarse-grained problem?

2:20:50And what I've seen the kind of more successful enterprises

2:20:53is they kind of board agents like they onboard developers, right?

2:20:57start with you don't get full commit access day one. You have to go through and add the

2:21:02levels of capability as they mature. So the definitions that enterprises are coming up

2:21:07with are what is the context that makes this agent safe. And it isn't just usually what

2:21:12the agent says. It can attest to something but it's other things like the environment

2:21:16around it and other information that can help you understand levels of autonomy. A very

2:21:21simple example would be where is the sandbox running? Is it in the sandbox? Those type

2:21:25but things can change the level of autonomy that's allowed.

2:21:29Absolutely.

2:21:29Yes, we mentioned that core screen access problem,

2:21:32and to put that into perspective, to give an example,

2:21:35with Notion’s MCP server, you can say fetch this page,

2:21:39which is like the view page tool or get page,

2:21:42but you can't say just get this database on this page.

2:21:45How is runtime authorization based on intent a better model?

2:21:49That's for anyone.

2:21:53I'll take a shot at it.

2:21:54So to me, this is something that the financial services industry,

2:21:57hopefully maybe we can learn from the background that banks have gone through.

2:22:02Banks moved long ago from authorizing and authenticating humans

2:22:05to authorizing the transaction, right?

2:22:08And when is that transaction occurring?

2:22:09At runtime, right?

2:22:11And so I think that runtime authorization is we're going to be able to learn

2:22:16from the scars of the past that we've had and apply it to this new problem.

2:22:21I also think that one thing is

2:22:23it's a lot easier to debug something at runtime

2:22:25when you understand the intent

2:22:26I think we've all remembered back in the day

2:22:29writing checks

2:22:30or seen those things on TV now I guess is the right thing

2:22:33but writing checks

2:22:35there was a memo field there

2:22:36that memo field was used to actually tell the intent

2:22:39of what this payment was

2:22:40but the check itself did have limits

2:22:42the price, the payee, the date

2:22:45etc.

2:22:46I think a lot of those concepts are now being applied

2:22:48and can be applied to help with this runtime

2:22:50time. Intense sort of one of those, you know, like many words, words are hard. And so, you know,

2:22:56building on the example here of making a payment of a transaction, right? You know, that's not a

2:23:01scope. That's, can I do this one thing in this particular context? Well, this one payment. But

2:23:08I think we need an agent to make any decision should it be able to do it. You need all the

2:23:13rest of the context of, well, why are we making this payment? What are all the things that happened

2:23:17before. Did we just make

2:23:19the same payment just like five

2:23:21seconds ago and now this is a double payment?

2:23:24Just because this is right in context by itself doesn't mean it's the right thing within the broader mission.

2:23:31In Auth, we're working on the concept of a mission that is what do we want the agent to accomplish big picture?

2:23:38And then each of the decisions are made within the context, the intent around what's happening big picture around doing that.

2:23:45and you need granularity at the transaction layer

2:23:48for many of the things to know what exactly is happening,

2:23:52not just I'm allowed to go and make payments.

2:23:56Yeah, I think one of the most interesting things,

2:23:58I think about a practical example,

2:24:00to understand why intents are required,

2:24:02is if you have two ChatGPT sessions or two Claude sessions,

2:24:04in one session I say, hey, help me go do some shopping,

2:24:07in the other session I say, hey, help me understand

2:24:10why there's a bug in production.

2:24:12Those have very different profiles in terms of what permissions they should have and also

2:24:17when they should bring you back into the loop.

2:24:19When should the human be involved again?

2:24:21At the end of the day, if we don't have intent or some capacity to relay what is the user

2:24:25or the business's intent with this thing, we actually can't get to autonomy.

2:24:30A lot of the talks this morning were, hey, we're going to run our business on agents.

2:24:33We're going to do all this stuff.

2:24:34Great.

2:24:35What happens the first minute, like a pocket OS style instance happens where it actually

2:24:39accidentally delete the production database instead of staging because it has coarse grained

2:24:42access instead of long scoped access.

2:24:45What we want as an industry is to leverage this magic box we've created to automate our

2:24:50lives.

2:24:51The current state of the world is that you can do that and take all of the risk and then

2:24:55you can see all of the instances that come from it.

2:24:57Until we solve that underlying problem, realizing true autonomy, being able to operationalize

2:25:02our business and be able to step away as humans and scale that, we have to solve intent first.

2:25:09Absolutely.

2:25:10And now that we understand why we need intent based off, let's talk about what it is practically.

2:25:15What are the primitives?

2:25:16What does it actually look like in practice?

2:25:18Dick hinted at it with the concept of the AAuth mission.

2:25:22So, Dick, elaborate on the mission.

2:25:24What is the mission based off of?

2:25:26Is it based off of the user's intent?

2:25:28Is it the agent's intent?

2:25:29Or is it a combination of the two?

2:25:32Well, the agent should be working on behalf of the person.

2:25:36And in AAuth, we define a person as either the organization or a human

2:25:40because it could be operating on either one of those.

2:25:43And so it needs to be acting in the best interest of the person that it's acting on

2:25:47because that is who's ultimately responsible for what the agent does.

2:25:53The agent can't be responsible.

2:25:56And so the mission is something that the person is giving the agent to do.

2:26:01the agent, a good agent, is going to go and negotiate with a person to go and talk more about

2:26:06what are the parameters around that. A good example is when you think of back in the day,

2:26:14which seems like three months ago, when you would want to code something up and you'd create a plan

2:26:19and then the agent would do the plan. Now you just tell it and it figures everything out.

2:26:22But that whole concept of what's a plan, what are you trying to do, and you give that to the agent,

2:26:28And so then that then is a context around where you're making authorization decisions later on.

2:26:33And then that mission identifier tracks through everything.

2:26:37So you can go and, you know, audit and be able to see what were all the things that happened

2:26:44and what were the decisions that happened in the context of this one mission, right?

2:26:48Where today, you know, there isn't really a good concept of agent identity or the mission, right?

2:26:54It's just making something and things are making decisions without really knowing which instance of the agent is doing it or what's the context of what mission is this involved in.

2:27:05Tell me more about that negotiation phase.

2:27:08Because what happens if a user is talking to an instant agent and it talks to the agent and says, I want you to go read the CEO's email.

2:27:16That's outside of the scope of that agent.

2:27:18So is that intent rejected from the user?

2:27:22Should be.

2:27:24So with a good separation, I don't know whether, I forget whether we're talking about this

2:27:29later, but the separation of concerns of the worker, right, there's an agent that's doing

2:27:34the work, and we believe there should be a separate agent that's supervising what this

2:27:39one does.

2:27:40And so that you have a separation of concerns where this one can't do any of the work, but

2:27:45it gets decided what this agent gets to do.

2:27:47And so if the user says, oh, I want you to go read the CEO's email, that's probably going

2:27:52to get caught in deterministic policies right away.

2:27:57not a vague thing.

2:27:59Reading somebody else's email, we've got good controls for that.

2:28:04telling the agent to send the CEO's, forward a CEO's email to the outside world, that's

2:28:13a little more vague, and that's the kind of thing that ideally comes back to a supervising

2:28:17agent says, that's probably a bad idea.

2:28:20And no, you can't do that.

2:28:22Absolutely. So I feel like that's another

2:28:23primitive, too, of intent-based office, is

2:28:25policy.

2:28:27Ian at Keycard, how are you seeing that? When a mission

2:28:30needs to change or a policy needs to update,

2:28:32how can Keycard help keep track of those

2:28:33changes as maybe the mission or policy

2:28:36updates need to be made? Yeah, I think, like,

2:28:37taking a step back, there's, like, actually, it was

2:28:39Davis and I were sitting in a room some time ago,

2:28:41and before,

2:28:44like, AAuth and some of these things

2:28:46It emerged in the ecosystem.

2:28:47One of the things we talked about was consent fatigue.

2:28:49I think at the minimum you always have this like how secure do you make a system versus

2:28:55the trade-off of the impact of the human.

2:28:57So a key card, our broad view on this is you want to have broad basic deterministic policy

2:29:02that basically says this is what must never happen effectively.

2:29:05Or these are the things that always require a human to be involved.

2:29:08And then from there what you really want to think about is okay, cool.

2:29:12well, now that I have that in place,

2:29:14there's a big gap between all of the policy

2:29:16I can write as a human or write as an organization

2:29:19and then what I actually want the policy to be

2:29:21in the specifics of a specific task.

2:29:23And so the real challenge is

2:29:26how do I layer over those two things?

2:29:28Because humans can't write at all.

2:29:29And so there's a version of that

2:29:31that is like a user or agent-to-agent interaction

2:29:33and they have an intent between those two

2:29:35of transactional intent.

2:29:37And there's also the business's intent

2:29:39for why they build or adopt an agent.

2:29:40So why did we buy Claude Code?

2:29:43Well, because we wanted to make our developers more successful

2:29:45or because we wanted to do these different things.

2:29:47And in the context of using Claude Code or whatever,

2:29:50why am I working in this moment with Claude Code

2:29:53while it's actually to fix a bug in staging, right?

2:29:55And those are two different types of intent.

2:29:56And if we can understand those two different things

2:29:59and then convert that some way into like a bounding box

2:30:03of what those agents can do,

2:30:04you can then basically calculate the intersection of that

2:30:06and say, okay, here's what you can actually do.

2:30:08And the trick for anyone building these systems is how do I ensure that I don't bring the

2:30:12user into the loop except when absolutely required because that's what's going to be

2:30:16the adoption curve problem.

2:30:18But that's also the adoption curve problem when it comes to, like, enabling agents to

2:30:20be autonomous in the first place.

2:30:23That makes sense.

2:30:24I like what you were saying with the intersection.

2:30:25I think that's a unique thing we don't talk about enough within identity and access management,

2:30:29right?

2:30:30Normally you get access to one thing, right?

2:30:32And so what I've seen successful kind of in this intent-based approach and where I get

2:30:36more excited is you can actually have

2:30:38those different intents be from different areas of the

2:30:40organization. And so you have

2:30:42the decoupling of these things that they can

2:30:44kind of live on their own, but then come together

2:30:46to form that decision.

2:30:48And that decision doesn't have to be static.

2:30:50So if we use the example of the CEO's email,

2:30:53well, if that context

2:30:54involves that's the administrative assistant,

2:30:56then yeah, maybe she is supposed to read the email.

2:30:58Or maybe just the calendar.

2:31:01And so I think when we see and we start

2:31:02thinking about these intersection components,

2:31:04we have a totally different way we can start

2:31:07expressing policy, but also starting to bring in not just the one side of the equation we

2:31:11always talked about before, which was the app doing something.

2:31:14Now we actually have the ecosystem you can bring in.

2:31:17And so the more I see organizations starting to realize that maintaining that state or

2:31:21that context of these other elements to be able to help with that intention can completely

2:31:25change the way you're effective at runtime authorization.

2:31:29And are you seeing this across enterprises today?

2:31:31Most people have mission tracking and policy tracking in place, or is that largely missing

2:31:35today. It's brand new still. Part of the reason why I'm excited to talk about it is

2:31:40it is changing the way to reason through this. Even in the most simplistic case, if you're

2:31:46a developer and you are thinking in terms of things like transaction and you have these

2:31:50concepts of intent, it makes it easier for you to potentially build the components that

2:31:55will be composed and used through that intention. I think it will give us more ways to reason

2:31:59through these and communicate and ultimately be more interoperable. To me, the last thing

2:32:05that I think is interesting is the

2:32:07diagnostics that you can run on this.

2:32:09Intention is something that flows

2:32:11through many events, potentially.

2:32:13And I think one of the examples

2:32:15I've seen before is talking about

2:32:17that mission flows through.

2:32:19It could be long-lived. It could be weeks.

2:32:21That intention can still be there.

2:32:22So it's still very, very early for most

2:32:25enterprises. Absolutely.

2:32:26And yes, that interoperability is key, and I think that's pretty

2:32:28hard for enterprises because they're

2:32:30between different clouds, different environments,

2:32:33different legacy systems, and that

2:32:34policy that mission has to hold through all of those

2:32:37different hops. A lot of enterprises

2:32:38still have to deal with the fact that the permission

2:32:40says read only and it's still read right.

2:32:43Right? It's like, you have the other problems

2:32:44you have to start dealing with. And so

2:32:46I think that it will help get

2:32:48the kind of taxonomy or language

2:32:50amongst people to be easier to interoperate.

2:32:53Absolutely.

2:32:55One of the reasons why I'm excited

2:32:56about intent-based authorization is

2:32:58because I think it has the ability

2:33:00to be a huge unlock for things

2:33:02like agentic commerce.

2:33:04So let's apply intent-based auth to something real.

2:33:07I think intent-based auth adds a lot of value here.

2:33:10And for users, it can help them ensure their agents

2:33:12buy the right item with their own personal budget.

2:33:15And for merchants, that means capturing the intent that

2:33:17gives them extra data to understand why a purchase

2:33:19is being made and if this agent should even

2:33:21be trusted to visit their site.

2:33:24Davis, when we think about agents in the context of financial services and agentic commerce, why is intent-based auth so important?

2:33:30I think simply it extends the concept, maybe not everybody is aware, but some are around, you know, know your customer, right? So I want to know my customer, know who they are, what they're doing. But I think also we're starting to see I want to know my agent, right? So I think that you have a coupling here around the agent itself, the intent of the actual user, the intent of the operator.

2:33:48operator, the intent of the processor, right, et cetera.

2:33:52Before now we couldn't really bring those together.

2:33:55It matters of course when it comes to things like commerce because you have additional

2:33:59layers on top of this around what was the intention for things like regulatory requirements,

2:34:04et cetera.

2:34:04And this is going to help, I think, simplify those operations, which means we'll get more

2:34:08access to these agents doing good work for us.

2:34:11That makes sense.

2:34:13And another blocker for agentic commerce is the fact that the web wasn't made for agents.

2:34:18Ian, can you tell us how agent identity can help?

2:34:21Yeah, I think stepping back,

2:34:23we've kind of always had this problem

2:34:24where like, what do you do with the unregistered client?

2:34:27So like, I show up on eBay, I haven't logged in,

2:34:30I'm using Chrome, eBay doesn't know who I am,

2:34:32how do I do guest checkout?

2:34:34How do I approve of a person?

2:34:35How do I, you know, so they can say,

2:34:37yeah, you can bid on this pair of socks for $50.

2:34:40And I think if we're all paying attention

2:34:42to what's going on in personal agents,

2:34:43Muse and Instinct and GrokBot,

2:34:46And recently this announcement around this personal agent protocol is the fundamental

2:34:52problem we have is how do you have an agent show up to a website, be able to interact

2:34:56with the website, know that you actually can trust that agent, so for a long time it captures

2:35:00on the web.

2:35:01Why?

2:35:01Because we want to prevent spam, we want to prevent abuse.

2:35:04So we added captures and that's something only a human could solve.

2:35:08So if we have a capture that stops spam so they can't spam the thing.

2:35:10Now we have agents and they've broken captures.

2:35:14But this has been a traditional problem on the web.

2:35:16In fact, if you think back two to three years, Vercel, which I think we're all aware of,

2:35:21was blocked in Spain.

2:35:22Why was Vercel blocked in Spain?

2:35:24Because Vercel shared the same IP addresses for every single host on Vercel, and there

2:35:29was one host on Vercel, one website on Vercel that they were hosting that was hosting, like,

2:35:34premier league content.

2:35:35And Spain decided, hey, in order for us to stop that premier league content being displayed

2:35:39illegally inside Spain, we're going to block all of Vercel.

2:35:41In the same way that Vercel has the problem, agents have the same problem, but so much

2:35:46worse.

2:35:47How do you have unregistered traffic you've never met before, show up to your front door

2:35:51and decide whether or not you let it in or not?

2:35:53That's the first and foremost fundamental problem we have to solve.

2:35:57It's the same issue with Muse and Instinct and what they're trying to do is how do we

2:36:00actually create agreeable rails so we can all operate on so as a downstream resource

2:36:05I can decide what agents will allow, who I trust, based on who users they are.

2:36:09And then on the other side, I can also know how to talk to those people.

2:36:14Makes sense.

2:36:15Dick, how is AAuth helping unlock the future of agentic commerce?

2:36:21Well, a key thing is a number of people have been building

2:36:24sort of proprietary closed-box systems, right?

2:36:27So I'm a fan of the concept of the personal agent protocol poppy,

2:36:35but it doesn't really go far enough, right?

2:36:37It's like, okay, well, now we've got a bit of an agent identity.

2:36:40We just use some of the building blocks,

2:36:41and it's an attractive approach because you're just doing it,

2:36:44but it doesn't solve many of the new things you need for an agentic world.

2:36:50And so a key motivator for people for having standards

2:36:55is that you can plug components from different places.

2:36:58So I'm a strong believer that we should have control over what our agents do.

2:37:04At some point, agents are going to be doing so much work,

2:37:07there's no way we can have human in loop approving everything, right?

2:37:09That's just not, we've already seen that that isn't going to scale.

2:37:12So that means we need to have a supervising agent

2:37:14that is our supervising agent that runs our policy

2:37:17and decides how we do things

2:37:19that should be independent of the agents doing all the work.

2:37:23And if we want to be able to plug and play those things,

2:37:26we need to be able to have a protocol to separate those.

2:37:29Otherwise, you know, the decision about what the agent can and can't do,

2:37:33what the guardrails, is decided by the agent,

2:37:36by the vendors of the agent around what you can and can't do.

2:37:39And I don't really want to go and give control to them

2:37:42to decide what I can do,

2:37:43and that all my decisions are based in there.

2:37:46I want to be able to pull that supervision into another component.

2:37:49And in order to be able to plug and play pieces,

2:37:51we need to have a protocol that things interoperate.

2:37:54I would just add to that.

2:37:55I think right now what we're seeing is we all want the web to be federated.

2:38:00That means websites or resources on the web

2:38:03can decide what they're allowed to do,

2:38:04but the standards upon which things operate should be federated and enable us all to interoperate.

2:38:09I think we're at a moment where things like, you know, we're at a moment where there's a couple

2:38:13large players, and the question for the industry is, are we going to settle on things that actually

2:38:17bias to the large players and give them, like, concrete blocked doors, or are we going to move

2:38:21to do the thing we've always done, which is build federated protocols? Things like OIDC,

2:38:25things like, you know, TLS, those things operated and enabled, like, a broad web, enabled a lot of

2:38:29commerce to occur, enabled a lot of information to flow, enabled all of us to have jobs in a way

2:38:33that because we could be inventive.

2:38:35And so the question I actually ask the broad industry is,

2:38:37okay, this stuff's coming,

2:38:39which version of the world do we want one way or the other?

2:38:43I think it's interesting that, let's say this all goes perfect,

2:38:46and we've got agents buying stuff and everybody's kind of happy.

2:38:49What I think will end up happening is we'll start realizing

2:38:52that we have another piece that we have to start working on,

2:38:53which is the human itself.

2:38:55And so one of the things I think when you start having intents being involved

2:38:58is you get what's called psychological ownership,

2:39:00meaning I actually now have a linkage between the human

2:39:02and the outcome of that agent.

2:39:04When you're just kind of disconnecting it

2:39:06or you connect it up on an OAuth scope

2:39:08or something like that in a claim,

2:39:10it's kind of magic.

2:39:11And you don't really know what's going on.

2:39:13And so I think with intention,

2:39:15it'll be easier for humans to take accountability

2:39:17when things do go wrong.

2:39:18And I think when you're talking about

2:39:19real money being transferred or things like that,

2:39:22you want to have that human ultimately accountable.

2:39:24I think many people have probably seen

2:39:25the 1979 IBM manual.

2:39:28It says, you know,

2:39:29and so that photo I think is very true

2:39:31that we can't have the machines be accountable, right?

2:39:34We're going to have to have the humans linked to it,

2:39:35and intention, I think, is that link.

2:39:38Yes, and then, yeah, another word for intent is motive,

2:39:42like we were talking about last night.

2:39:45And that ability to hold someone accountable,

2:39:48whether it's a person or an agent, I think is really important.

2:39:50I think intent can also help with that,

2:39:52be able to understand why did this go wrong?

2:39:54Was it the user was mal-aligned?

2:39:57The agent was mal-aligned?

2:39:59and then using that intent to be able to respond.

2:40:02For each of you, how are you seeing intent provide that benefit

2:40:05and the ability to respond to potentially a maligned user or agent?

2:40:09I think it's going back to what I mentioned before about diagnosing.

2:40:12So if you change the word intent to motive,

2:40:15then you change diagnostics to forensics.

2:40:18And I think anybody who's done debugging

2:40:19or had to do forensics of an AI agent gone rogue

2:40:22will know that trying to figure out what it was trying to do

2:40:25versus what the intention of the user was is very hard.

2:40:28right? So having some of that information being propagated and immutable through the system,

2:40:33et cetera, gives you some properties that allow you to more short circuit your investigation,

2:40:37right? And as those things become more interoperable, I think we're going to start

2:40:41seeing companies be able to more quickly kind of scope and identify, well, was this a human error?

2:40:46Was this an agent software error? What was that error? And handle that blast radius appropriately.

2:40:51We see in the financial system, right? You have different things when you're doing a transaction

2:40:54around, okay, I made this payment,

2:40:56but it was incorrect dollar amount

2:40:59or whatnot. You have clear guidelines on how

2:41:00to work with that. We don't have a lot of those

2:41:03when things go wrong right now. So I think

2:41:04intention will help us build those as we go

2:41:06forward.

2:41:10And I think one area where a recent

2:41:12incident kind of highlights where

2:41:14intent,

2:41:16you can have good intent, but still take

2:41:19potentially the wrong action is the

2:41:20resi incident that happened recently

2:41:22where an instinct agent

2:41:24went out on behalf of a user and tried to book a restaurant reservation on resi.com.

2:41:30That agent was very eager at 200 API calls an hour, and it ended up getting the user's

2:41:36resi account banned.

2:41:39Dick, how can AAuth budgets help in the case where an agent like that is using way too

2:41:44much of a downstream resource, but it still has good intent?

2:41:48Yeah.

2:41:48Well, this is another example about how just software is completely different now in the

2:41:52agentic world, right? When it was predetermined software, you know, that was a bug if you called

2:41:57200 times and you would fix it. Where now, well, the agent's like, well, I'll just keep trying until

2:42:02they win. And so we saw that as we were, you know, experimenting, working with people with A-Auth,

2:42:09and we realized, yeah, there's a big problem that agents will learn something and they'll just

2:42:15abuse the system from, they don't think it's of abuse, they don't know any different, there's been

2:42:20no signal to tell them that, oh, I should only use this amount of stuff.

2:42:24And so we added the concept of budgets, where not only do you give a token to the agent

2:42:29that's time-limited as to how long can they do a particular action, but also a budget

2:42:35of how much resource they can do.

2:42:37And so they have access until the token's either expired or they've exhausted the budget.

2:42:42And so that way, when they come back and they've exhausted all the budget, the supervision,

2:42:48you can go and decide, should I give more budget to this agent or not?

2:42:51As opposed to traditional rate limiting, which just cuts it off,

2:42:55and then what do you do?

2:42:57And it doesn't know, well, why did I get cut off or anything like that?

2:43:00Where in budget, there's continual feedback to the agent

2:43:04about how much budget was consumed,

2:43:05has an idea about how much budget it has,

2:43:07and so now it can operate within a budget, right?

2:43:11Like a person would do, about, oh, this resource is scarce,

2:43:15I'm going to be careful about how much I use this.

2:43:18And how does the brains versus the hands architecture concept come into play here to

2:43:23allow us to, okay, when a budget is close to being fully reached or is reached, how can the brain and hands separation of access and the credentials being separate from the agent and the model itself help us to be able to stop an agent from using too much of a downstream resource? Because if it's getting close, then maybe we don't exercise the ability to give it another credential, for example.

2:43:46Sorry, I didn't quite follow

2:43:48The echo in here is horrible

2:43:51No worries, that's for anyone

2:43:52But basically, so with the brains

2:43:54And the hands architecture that we're

2:43:56Converging on in an industry, we're basically

2:43:58Keeping the credentials and the access

2:44:00From an agent separate from the agent itself

2:44:02So there's no broad standing access

2:44:04That an agent has today, no API keys

2:44:06Which I know is a benefit of AAuth

2:44:08That AAuth allows agents to run without API keys

2:44:10How is that helpful

2:44:12In the context of the Resi incident?

2:44:16you've got the access to it

2:44:19sorry I still don't understand

2:44:20I can jump in

2:44:22I got you Dick

2:44:24broadly speaking I think if we look back

2:44:26at an incident that I just keep on top of my mind

2:44:28it's like Pocket OS where I found a random key

2:44:30on a disk

2:44:31obviously agents are deeply goal seeking

2:44:34so the core of the question

2:44:36is like okay well if we give these

2:44:38agents, the brain which is the model

2:44:40and the LLM and you have these hands

2:44:42which is you kind of put them in a sandbox

2:44:44and inside the sandbox are the tools.

2:44:47The final idea

2:44:48of the sandbox here

2:44:49is that you can control what's inside

2:44:52of it. So it can't actually get

2:44:54API access. And then if you have an

2:44:56egress proxy outside the sandbox

2:44:58that's where you get to have your authorization boundary.

2:45:00And so not only does it help

2:45:02do translation between systems

2:45:04which is like that's where AAuth can exist

2:45:06and talk to the outside world or determination

2:45:08but also means that the agent

2:45:10you have an ability to apply authorization

2:45:13at the egress proxy boundary.

2:45:14And so I think at the core of it,

2:45:17that model, which is the predominant model

2:45:19of Anthropic and OpenAI

2:45:20and many other labs are pursuing today,

2:45:22is the model that allows us to both have the things we want,

2:45:26which is how do we have these things experiment

2:45:29and try stuff out and do silly things,

2:45:31which is the core value,

2:45:32while also having a deterministic layer outside of it

2:45:35that can implement things like AAuth

2:45:37and all the other components we want in our protocols.

2:45:39I think the decoupling is valuable.

2:45:41going back to what I mentioned with forensics

2:45:43and be able to separate things, but I do think that we

2:45:45still have a lot to learn on it isn't just

2:45:47one brain. It's very easy

2:45:49actually to build your agent loop

2:45:51where you put the brain in the loop rather than outside

2:45:53the loop. An example of this would

2:45:55be people that are leveraging memory

2:45:57systems. They put in some

2:45:59memory and some context that is now used

2:46:01going forward for every agent that is

2:46:03biasing that agent to make a decision

2:46:05to tell the hands, in this case, to go do

2:46:07something it shouldn't do. One of the things

2:46:09that I think we don't talk about enough here is

2:46:11toxic combinations.

2:46:13And so when you do separate the hands

2:46:15and the brain and whatnot, you can actually

2:46:17change up what hands are available.

2:46:19So the example that I've seen

2:46:21be very successful is the removal of tools

2:46:23dynamically based on that actual brain

2:46:25and what it's doing. So the earlier

2:46:27example we gave of reading an email,

2:46:29there's nothing that says that, oh, if they're going to go

2:46:31write an email, I'm going to disable all

2:46:33web search tool calls or any

2:46:35other external egress capability

2:46:37tool call wise until the right email

2:46:39tool has been complete and that

2:46:41mission has been done, then I can re-enable them.

2:46:44And so I think that we're going to start becoming more and more

2:46:47engineering at these different kind of concepts. They are still complicated,

2:46:51they're still growing and still nascent, but I think it's a better separation than we have today.

2:46:56Yeah, and this is how these things we're talking about, which seemed like geeky

2:46:59problems actually then merge back up to real agent engineering problems, which is

2:47:03if you actually understand what you're doing, one of the biggest complaints, less now, but one of

2:47:07the The biggest complaint is context bloat, but intent systems can ensure the right capabilities

2:47:14should be given to the agent at the right time so they don't spend a bunch of time doing

2:47:18things they shouldn't be doing.

2:47:19It helps them navigate towards the goal state and put them on more of a paved path.

2:47:24So intent not only unlocks a bunch of security stuff, intent also will result in us spending

2:47:30less tokens because the agent will spend time doing less things that aren't the right pathway

2:47:34or it'll come up to the point and say, hey, I just can't do it.

2:47:37And so what we know about this era is so much of it is about nudging the agent in the right direction

2:47:41and ensuring you can't do the wrong thing, and that's how you get the outcome you want.

2:47:47Davis, how are you seeing intent-based auth as part of a larger strategy for production agents?

2:47:52I know when it comes to building, deploying, and operating agents in production,

2:47:57there's many different outcomes teams should be thinking about,

2:48:00such as discovering what's running, what the agent's capabilities are,

2:48:03the ability to validate inputs and outputs,

2:48:05constraining an agent like we talked about

2:48:07and using the egress proxy and different networking rules.

2:48:10How does all of this fit into play

2:48:11and what's working inside enterprises today

2:48:13to really be able to ship agents to production?

2:48:16I think we're following.

2:48:17It's helping move the kind of conversation

2:48:19from authentication to authorization

2:48:22and really like how do we do dynamic authorization?

2:48:25How do I validate that authorization?

2:48:26How do I have the human in the loop at the right time?

2:48:29Because I agree with what Dick was saying earlier

2:48:31that the human in the loop is somewhat of an anti-pattern

2:48:33in many ways, right?

2:48:34Because they can get fatigue, et cetera.

2:48:36But you need to have a way to bring them in

2:48:37when it's important.

2:48:38Those were not engineering discussions before, right?

2:48:41Now they're actually part of the engineering conversation

2:48:43where engineers are being involved

2:48:45in the authorization process.

2:48:47They're not just saying,

2:48:48oh, I've got my access, I'm good to go.

2:48:50So that actually changes the way we're seeing

2:48:51front models done.

2:48:52It changes the way we're seeing

2:48:53the full attack surface of applications in general.

2:48:56And so I think you're now looking at this authorization model

2:48:59as another kind of set of tools that you can use to reduce not just security issues,

2:49:06but flat-out error rates of your agent, right?

2:49:08Like, I mean, when you have less things the agent can do, it makes better decisions, right?

2:49:13And so fundamentally, we've seen, you know, real-world cases where the agent loop is just better, faster, stronger

2:49:19because you've actually spent the time on knowing what is the intent they're trying to get,

2:49:23what's the mission that they're trying to accomplish.

2:49:24And then last thing is it brings the people together in terms of,

2:49:28we now have other different people, the security team,

2:49:30the application team, they're now able to have a conversation

2:49:33that they're using the same language.

2:49:35And a lot of times when it came to identity,

2:49:37it was a completely different language, right?

2:49:39It was just like, get out of my way, what do I have to go do

2:49:42to go ahead and get my token and I can go forward.

2:49:44Now they're seeing that you can actually pair these things

2:49:46and leverage that capability to drive efficiency

2:49:49of your actual agent's outcome.

2:49:51That makes sense.

2:49:53Ian, how are you applying these concepts to software factories?

2:49:56I know today you released a reference architecture

2:49:59on the secure software factory.

2:50:01How are you applying the concepts of runtime authorization,

2:50:05constraining agents, and all of that to that?

2:50:07Yeah, I think, like, so there is a reference architecture

2:50:09we just published on agentbaseline.org.

2:50:12We talked about three different levels of factory,

2:50:14one being, like, a human-driven one,

2:50:16one being a workflow-driven one,

2:50:17one being, like, this agentic-driven one,

2:50:19which is, like, the thing we all basically want to get to,

2:50:21which is, like, it's driven by agents.

2:50:24And at all points in time, the runtime authorization is a core component of a larger ecosystem.

2:50:30It actually enables the factory to be able to be pointed in that direction and do the

2:50:34right thing and also get access to the right piece.

2:50:36And it looks different than previous things that you would have used, like a secret manager,

2:50:40because it's making very different decisions than previous generations' head for managing

2:50:45deterministic software.

2:50:46But it is a core component of enabling the entire thing to work, like when to bring someone

2:50:49into the loop, when what agents can pass what work off to what other agents.

2:50:52how can we have an agent that can have access to production systems and do an auto patch.

2:50:57These are fundamental questions of how do we actually solve at-scale software.

2:51:01Right now we're in a position where we've never been able to generate more software,

2:51:04but we have a complete bottleneck in getting into production and ensuring it works.

2:51:08And that's the next phase is how do you actually graduate from just using L1 to generate text

2:51:13and software to actually making it capable of deploying it into production, iterating on it,

2:51:18and getting it to a stable state quickly and then responding to instances that arise.

2:51:25Davis, on a podcast you did with me, we talked about how cybersecurity has something to learn

2:51:30from robotics.

2:51:31In robotics, there's this concept when maybe a robot raises its arm, it thinks, is it safe

2:51:35for me to raise my arm?

2:51:37Should I?

2:51:37Am I allowed to do that?

2:51:38But it also looks at its external environment and says, what has changed?

2:51:42Is it still safe for me to raise my arm?

2:51:44When we think about runtime authorizations, what do those decisions need to take into

2:51:49context beyond just intent?

2:51:51Yeah, I think having a model like this allows us to add in more sensors into our decisions.

2:51:57So the robotics example of an arm moving up or down, any of the external factors, it could be are there other objects near it, right?

2:52:04It could be temperature.

2:52:06It could be, well, am I moving and I don't want to move my arm while the rest of the robot is moving, et cetera.

2:52:12So it's usually looking at all different types of things.

2:52:14None of those are deterministic.

2:52:16They're all probabilistic.

2:52:17So there's a range of options, and it picks the best option based on all of those sensor data at one time.

2:52:23Most authorization decisions in organizations today are still single binary decision, right?

2:52:29And that just doesn't work in the future, right?

2:52:31So being able to pair the intent of what a user is trying to do with the ecosystem that the user is doing it in.

2:52:36That could be where they're doing it from, time of day, but it could be even more advanced things.

2:52:40Like, for example, should I let this administrator use Firefox to access this server right now

2:52:46when this server has high-risk vulnerabilities and their system hasn't been patched to?

2:52:52Now, all of a sudden, you're bringing in a lot more context into the environment around it.

2:52:57And again, that can be through different teams, but more importantly, through sensors.

2:53:01And I think we've all kind of seen the value of observability in general.

2:53:05Imagine being able to have this type of context at the span level from an OTEL perspective or something.

2:53:09You're looking at a trace, you've got a span, and you actually know what the environment was outside your application at that time, as well as what the user's intention was.

2:53:18That allows you to diagnose things in a completely different way.

2:53:21And so I think if we can bring in some of those

2:53:23concepts,

2:53:24we'll get shorter time, shorter to live authorization decisions

2:53:29have much more context than even just a user's intent.

2:53:31It'll be the state of the environment around it.

2:53:35That makes sense.

2:53:36And forward-looking, as we evaluate whether intent-based authorization

2:53:40is working in our environments, one natural place

2:53:42to look will be a log of the agent's actions, what was denied,

2:53:47what was allowed. Ian, why is it important to have your autolog separate from the agent

2:53:53itself, meaning outside of its control?

2:53:55I think this comes back to also just like why the unfortunate point has to be outside

2:53:58the primary hands and brains of an agent, right? You can't trust this thing. And so

2:54:03in the hugging phase incident, it had a couple of different components of it. I mean, one

2:54:06obviously abused a vulnerability we didn't know about in Squid proxy, but more importantly,

2:54:10he didn't have any observability or monitoring about what was going on. And so this thing

2:54:13was able to go to the open Internet through this vulnerability and there was no place

2:54:17at which recorded the different actions that this agent was taking and for them to monitor.

2:54:21So independent of whether we're applying an enforcement point to network traffic that's

2:54:26pushing it on the Internet that it's a reach of the agent to tamper with or solving vulnerabilities

2:54:31as their pop-up, this Hugging Face one is a little unique, we still need to actually

2:54:36have a record of who told this agent to do what thing for what purpose and is that still

2:54:40true?

2:54:41Because ultimately at the end of the day what we're dealing with agents is a liability question.

2:54:46I don't think we need more regulation around agents.

2:54:48What we need is our pre-existing laws around liability to be dealt with.

2:54:52Which is if I employ an agent to do some action, who is liable if that action causes damage?

2:54:57It is the person who employs it.

2:54:59Which could be an organization or a person or someone that delegated some action to something.

2:55:04That is the final question we have to deal with.

2:55:06And then of course you have to have the ability to answer that question.

2:55:09and which is, well, who did it,

2:55:10and which is where the tamper-resistant autolog comes from.

2:55:14Perfect.

2:55:15And then to wrap up, I wanted to ask you all a fun question.

2:55:18So there's the concept of the probability of doom or PDoom,

2:55:22where the AI doomers are saying that AI agents

2:55:24are going to release all sorts of havoc

2:55:28or be like the ruin to humanity,

2:55:29whereas the AI optimists are like,

2:55:31no, this is really poised to help us.

2:55:33It's not a genuine threat.

2:55:35For each of you on the panel,

2:55:37what is your take on this?

2:55:38is runtime authorization based on intent.

2:55:41The other things we talk about, like constraining agents,

2:55:43validating inputs, outputs,

2:55:45a holistic strategy for production agents,

2:55:47is that enough to save us?

2:55:49Is PDoom real, or is it not worth the hype?

2:55:54You get to start, Dave.

2:55:56Oh, I get to start, Dave?

2:55:56You've got that spicy look on your face.

2:56:01Well, part of your question is,

2:56:03are agents going to take over?

2:56:04And I think agents being fully autonomous

2:56:08and not really tied to a particular organization

2:56:10is still science fiction.

2:56:11So who knows, right?

2:56:14That's one direction.

2:56:16Another one is, in a responsible organization

2:56:18that's put in the right controls,

2:56:19agents aren't, we're getting and evolving enough

2:56:22of the tools to make sure that bad things don't happen

2:56:25in a responsible organization

2:56:26that's put in the right controls.

2:56:28And so that leaves two scenarios

2:56:29for where there's going to be a potential problem.

2:56:32One of those is, in an organization

2:56:34that hasn't got its act together,

2:56:36an insider threat could go and unleash an agent to cause havoc.

2:56:41So they've got some special access that other people have.

2:56:44The other one, the one that I'm more concerned about is,

2:56:46it's been shown the hugging faces,

2:56:50and if you watch the talk that they gave at Black Hat,

2:56:54that was really a call to arms around,

2:56:57here's a situation where we didn't want a bad thing to happen

2:57:01and a bad thing did happen.

2:57:02what about people that want bad things to happen and have these tools?

2:57:09And that, I think, is a threat that's the one that's potentially going to have...

2:57:13I mean, it's going to happen, and there's going to be some catastrophes.

2:57:16Hopefully, we're prepared enough that those aren't horribly disastrous.

2:57:20But it's going to be, you know, there's going to be some things that are, like,

2:57:24massive natural disaster-like scale issues caused by malicious

2:57:29actors, either intentionally or unintentionally, but it's where people aren't being responsible

2:57:36in their use of these super powerful tools.

2:57:41I can't give a specific probability, but what I can say is I think I've always been

2:57:49surprised and excited when the ingenuity of engineers gets involved in problem solving.

2:57:54and I think where we're at the stage now

2:57:56some of the new capabilities within agents, etc

2:57:58we have real engineers, folks that are here

2:58:00actually just iterating on the problem

2:58:02and we're starting to see just tremendous improvement

2:58:05in my mind

2:58:06some of the capabilities that will be available to

2:58:08change what our future can be

2:58:10and so to me, I have no problem

2:58:12believing the engineers are going to figure out a solution here

2:58:16Maybe I have the hottest take

2:58:17I can't say it's equal to zero

2:58:19but I would say it's approaching your asymptotically zero

2:58:22is the probability the world is going to end

2:58:23I think the incentive structure for most people is to continue.

2:58:27And also, at the end of the day, we still have liability frameworks.

2:58:30And I think generally humans are good people,

2:58:33so we don't set out to destroy the world specifically.

2:58:36I also think, broadly speaking, these agents,

2:58:38I have this sort of hot take, I say,

2:58:40which is they can just be unplugged, but I think it's just true.

2:58:42It's like, at the end of the day, they're computers,

2:58:45you can unplug them.

2:58:48So, broadly speaking, I don't believe in the debate.

2:58:50I don't think it's real.

2:58:51I think at the upside of it, I kind of believe more to what Dave's disposition is, we're

2:58:56iterating very quickly.

2:58:58We're figuring out where these things can work and where they don't.

2:58:59And when they don't work, they create damage.

2:59:01And that's what ultimately sort of the antibody of society is that says, hey, maybe we shouldn't

2:59:08do this.

2:59:08It's probably a bad idea.

2:59:09I'm the doomer on the panel.

2:59:12It's unfortunate for people like the founder of Pocket OS who lost a bunch of data.

2:59:17But it's great for the rest of us because we all learn together.

2:59:19and at the end of the day, that results in people not doing things

2:59:23that don't make a lot of sense and I think that will continue to be true.

2:59:26Makes sense. Thank you each for your expertise and your time here on this panel today

2:59:30and thank you to the audience for listening and we'll catch you next time.

2:59:34Thank you.

2:59:35Thank you so much.