Kamil Potrec from Keycard presents an overview of agent authentication and authorization challenges in modern software systems, particularly focusing on agents interacting with Model Control Plane (MCP) servers. He explains that users typically obtain access credentials like personal access tokens (PATs) to authorize actions, but agents themselves also need credentials, such as API keys, to perform tasks. These agents often call external tools or services via MCP servers, which use service accounts with aggregated permissions to access backend systems. However, this setup creates ambiguity about who is actually making requests—the user or the agent—and raises security concerns due to the non-deterministic nature of agents and the widespread distribution of credentials.
The talk highlights several security issues with current practices, including the difficulty of attributing actions to specific users, the risk of credential misuse when tokens are stored insecurely, and the over-privileged nature of service accounts. Unlike traditional software, agents can act autonomously and persistently, often bypassing controls and using credentials in unintended ways. Kamil emphasizes that while technologies like OAuth and workload identity federation exist to address these problems, they have not been widely applied to agents, partly due to the complexity of managing multiple APIs, legacy systems, and diverse authentication methods at scale.
To build a robust agent authentication system, Kamil outlines key requirements: issuing distinct agent identities, expressing delegation semantics to control which users and agents can act on behalf of others, providing scoped and short-lived credentials, and supporting federated trust across heterogeneous systems. Additionally, policies must govern agent actions, including human approvals where necessary, and comprehensive audit logs are essential for accountability. He stresses that while these solutions are conceptually straightforward, implementing them at scale is challenging due to the diversity of systems and the complexity of agent interactions.
Kamil critiques the reliance on client-side SDKs for managing credentials, noting their limitations in adoption, language support, and security, especially since agents can manipulate or persist credentials within their execution environments. Instead, he advocates for moving credential management to secure enclaves and using gateways as control points that mediate all agent communications. Gateways can enforce policies, attenuate requests, provide observability, and enable instant revocation of credentials, though they introduce latency, require strict network controls, and become high-value targets themselves. This architectural approach helps isolate sensitive credentials from agents and enhances security.
Finally, Kamil introduces Keycard’s solution, which offers a unified control plane for agent identity issuance, token federation, policy enforcement, auditing, SDKs, and optional gateways. This platform is designed to be flexible and interoperable, allowing organizations to adopt components as needed to secure their agent ecosystems. He concludes by urging the community to prioritize agent authentication as a critical security measure, use open standards for interoperability, and avoid relying solely on LLMs to implement these complex systems. He invites attendees to learn more at Keycard’s booth and explore resources like agentbaseline.org for reference implementations.
Useful Links
