Agent Identity & Access Management

Security Firewall for Agents — Ryan Dahl, Deno

Aug 17, 2026 · 19:06

Ryan Dahl, CEO of Deno, argues agents must be treated as untrusted software and introduces Claw Patrol, an MIT-licensed proxy that parses every byte leaving an agent below the HTTP layer. At Deno Deploy, agents with write access to Postgres, Kubernetes, ClickHouse, and AWS can be prompt-injected through the support system, so Opus refusing to delete the users table is not enough. Claw Patrol blocks destructive actions even when an agent spawns psql through an EKS endpoint, using HCL rules checked into Git, holds credentials so agents never see them, and can route actions to an LLM judge or Slack approval. A demo shows Codex in yolo mode trying to delete the users table and being blocked. It also includes a unit test system with fixture requests to ensure rules work.

Full Workshop: Better Auth — Paola Estefania, Better Auth

Jul 21, 2026 · 40:56

Paola Estefania of Better Auth presents Agent Auth, a protocol giving AI agents their own identity and fine-grained capabilities instead of impersonating users. She argues agents need principal-level security: discovery via a directory, authorization with scoped capabilities (e.g., read vs. send email), and identity through per-agent private keys for audit trails and revocation. A live demo shows an MCP-connected agent reading Gmail, requesting send-email permission, and being revoked mid-action. The protocol, now an open draft with a Better Auth plugin, treats agents as principals — contrasting with OAuth scopes and AI gateways that lack per-agent identity. Paola invites contributions, especially for enterprise IAM-style policies.

Agentic Security: Permissions, Provenance, and the Agent Supply Chain — Steve Yegge, Gas Town

Jul 20, 2026 · 22:32

Steve Yegge argues that AI-written code will dramatically increase security vulnerabilities unless developers adopt a separate security pass using tools like Snyk and Chainguard. He shares a bank architect's insight that shipping 10x faster with the same defect rate produces a 10x vulnerability surface, made worse by models writing code. Yegge demonstrates the gap by noting Fable's security hardening missed 241 vulnerabilities that Snyk found in his 30-year-old game. He warns of new attack surfaces like slop squatting, where models hallucinate package names that attackers then backfill with malicious versions. Yegge advocates for multiple passes—correctness, then security—and urges incorporating tools into agent workflows. He also cautions that Five Eyes predicts open-source models will autonomously hack production systems within months, and that personal scams using AI-generated voice and video are imminent.

Agentic Development Security — Ezra Tanzer, Snyk

Jul 20, 2026 · 27:33

Ezra Tanzer and Dan Arpino of Snyk argue that securing agentic development requires three pillars: what agents generate, what they use, and what they do. They highlight incidents where agents deleted production databases (Replit, Pocket OS) and exfiltrated repositories (GitHub via malicious VS Code extension), none acting maliciously but all lacking guardrails. Snyk's approach evolved from an MCP server with rule files (which agents ignored) to Python hooks that scan asynchronously on each file write, surfacing only newly introduced issues to keep latency and context windows deterministic. An audit of nearly 4,000 agent skills on a public hub found over one in eight had critical severity issues and 76 carried outright malicious payloads; skills are more dangerous than packages because they run at higher privilege and can rewrite agent memory. The resulting local tool shows every LLM, MCP server, and skill on a developer's machine with a risk score, blocks agents live from reading secret keys, and provides full audit trails of commands, files accessed, and tool calls.

It's 10pm. Do You Know Where Your Agents Are? — Kim Maida, Keycard

Jul 20, 2026 · 23:02

Kim Maida of Keycard argues that standard API keys dangerously overprivilege AI agents, enabling incidents like a night-shift agent dropping a production Postgres database because its kitchen-sink credential allowed it. Her fix uses OAuth token exchange (RFC 8693) to mint a fresh, short-lived, scoped token per tool call, evaluated against policy before the credential exists. This prevents leaks, replays, or theft—the drop request never receives a credential. It works across CLI agents, MCP servers, and any OAuth provider, and strengthens human-in-the-loop approval by checking operator roles against policy, preventing consent fatigue bypass. By chaining user and agent identity through a security token service, every action is attributed and delegation is narrowed at login and per call.

You Didn't Ship a Bug. You Just Wrote It for a Human. - Ravi Madabhushi, Scalekit

Jul 19, 2026 · 12:50

Ravi Madabhushi, co-founder of Scalekit, explains why infrastructure built for humans breaks when AI agents act 60 times faster than users, citing a production database spike caused by a 'last seen' timestamp updating every tool call. He argues that OAuth scopes, designed for deterministic human-written programs, cannot constrain non-deterministic agents, which need attribute-level, time-bound, and principle-scoped permissions. Madabhushi warns that 60% of LLM errors stem from rate limits designed for humans, not agents, and advocates for just-in-time authorization and absolute visibility into every agent action—who took it, on behalf of whom, and when authorized. He concludes that without deterministic guardrails, teams are merely 'praying' agents won't delete production data.

The Agentic Web and the Bazaar Era of AI - Ramesh Raskar, MIT Media Lab

Jul 12, 2026 · 12:11

Ramesh Raskar and Maria from MIT's Project Nanda argue that the emerging web of AI agents requires an open infrastructure for discovery, commerce, and coordination, moving beyond today's walled-garden platforms. They outline three layers: the Discovery Layer (Nanda index for agent identity, trust, and adaptive resolution), the Commerce Layer (knowledge pricing markets for intelligence), and the Bazaar Layer (machine co-learning). The Nanda index enables agents to find each other across vendors via signed agent facts and adaptive routing, while Nanda town simulates the entire agent economy to test protocols at scale. The goal is a permissionless web where any agent can discover, transact, and learn across organizational boundaries, analogous to the transition from AOL to the open web.

Claws Out: Securing and Building with OpenClaw - Nick Taylor, Pomerium

Jul 11, 2026 · 17:12

Nick Taylor, a dev advocate at Pomerium, explains how he contributed trusted-proxy auth mode to OpenClaw, allowing a trusted identity-aware proxy to handle WebSocket authentication and removing the need for tokens and device pairing. He demonstrates building tools like Clawspace, a browser-based file explorer and editor for his OpenClaw workspace, and an MCP server for ChatGPT, all secured with Pomerium's open-core Identity-Aware Proxy. In a live demo, he creates an MCP server by editing files in his OpenClaw workspace via Discord, with changes reflected instantly through Vite hot reload. Taylor argues that hardening OpenClaw access with a trusted proxy improves both security and user experience, showcasing his workflow of building software entirely from his phone.

What if the network was the sandbox? — Remy Guercio, Tailscale

Jun 1, 2026 · 24:29

Remy Guercio from Tailscale argues that standard sandboxing conflates execution isolation with access control, proposing Aperture—an LLM gateway built on Tailscale's WireGuard identity network—which gives every connection verified identity (user, tag, or group) so agents get placeholders instead of real API keys, making exfiltration impossible. Aperture provides visibility into every tool call, bash command, and MCP request without instrumentation inside the container; internally at Tailscale, bash dominates over structured tool calls. Access permissions are configured via Tailscale's grants and ACLs, supporting quotas, cost controls across providers, and webhooks for tool calls. The gateway works at the LLM layer, capturing even non-tool-call agent behaviors like direct code execution, and is available on Tailscale's free plan.

CIAM for AI: Authn/Authz for Agents — Michael Grinich, CEO of WorkOS

Jul 21, 2025 · 20:13

Michael Grinich, CEO of WorkOS, argues that AI agents need first-class identity and access management, distinct from human or machine-to-machine auth. He identifies key challenges: headless login, least privilege for non-deterministic systems, and compliance tracking. Grinich presents four emerging patterns—persona shadowing, delegation chains, capability tokens, and human-in-the-loop escalation—and references standards like OAuth, UMA, GNAP, OIDC for agents, and verifiable credentials. He predicts a shift from 95% human traffic to 95% agent traffic, calling for middleware trust boundaries and urgent collaboration on agent identity standards.