World's Fair 2025
Securing Agents with Open Standards — Bobby Tiernay and Kam Sween, Auth0
Overview
This talk addresses the critical security challenges arising from increasingly capable AI agents that perform actions in the real world. It emphasizes the need for robust identity and access control mechanisms to prevent issues like secrets in prompts, overly broad scopes, and difficult troubleshooting. The core thesis is that by adopting open standards and implementing proper identity management, developers can build more secure and trustworthy AI agent systems.
Who should watch
- AI Engineers
- Product Managers
- Builders working with AI agents
- Developers concerned with agent security and access control
- Those facing challenges with agent delegation and authorization
Key takeaways
- As agents move beyond chat to perform real-world actions, security cracks appear, leading to secrets in prompts, broad scopes, and visibility issues.
- Excessive agency, or giving agents too much access without guardrails, is a primary source of GenAI risks, often stemming from insufficient scoping, monitoring, and user-tying of access.
- Using shared, static keys for agent API access is fragile; a better pattern involves agents requesting user-specific, short-lived tokens from a backend via mechanisms like token exchange.
- Establishing clear agent identity is crucial for tracing activity and control, anchoring agent behavior to real users through standards like OAuth 2.1 and token exchange.
- Fine-grained authorization is essential for Retrieval Augmented Generation (RAG) systems, enforcing access policies at the retrieval layer to prevent sensitive data leaks.
- Client-Initiated Backchannel Authentication (SIBA) provides a secure way for agents to request user consent for sensitive actions, especially useful for background agents or screenless scenarios.
- The adoption of standards like OAuth 2.1, OIDC, and SIBA is vital for building secure agent systems, moving security from an afterthought to an integrated part of development.
- Tools and platforms are emerging to simplify the implementation of these security patterns, wrapping complex standards into more developer-friendly experiences.
Notable quotes
*As agents start to do more things in the real world... cracks are starting to appear and it's pretty clear secrets end up in prompts, scopes get too broad and troubleshooting gets really really hard.*
*If that access isn't scoped, monitored, and tied to a real user, you're wide open to abuse and unintended behavior.*
*If your agent doesn't have identity, it doesn't matter how well you scope your tokens or rotate tokens, you still have don't have real control here.*
Unofficial community note. Prefer the recording for nuance.