Securing Agents with Open Standards
summary
Shows a concrete architecture that replaces shared API keys with short-lived per-user tokens minted via token exchange, an open-source Node.js/TypeScript agent and an MCP server, plus a live CLI demo of a local trading assistant that uses SIBA back-channel auth to push approvals to a trusted device. It uses a token vault to avoid baked-in secrets and enforces RAR/fine-grained retrieval policies for RAG; demo concept proves end-to-end flows though the live demo hits connectivity hiccups.
AI-written summary · about
chapters (15)
- 0:00Introduction to agent security
- 1:05Security challenges of smarter agents
- 3:12Shared credentials vs scoped tokens
- 4:15Identity and delegation fundamentals
- 5:40OAuth 2.1 and token exchange
- 6:00Fine-grained authorization in RAG
- 6:43Client-initiated back-channel auth
- 7:25Securing MCP servers
- 8:08Demo overview and setup
- 13:26Why identity matters for local agents
- 14:29Complexity balance in demos
- 14:49Live demo walkthrough
- 16:34Key takeaways and standards
- 17:16Making standards easier to use
- 18:01Closing and Q&A invitation
related talks
01h 22mIdentity for AI Agents
19mDon't give your agent the master key
24mBuilding Trustworthy AI Authentication & Authorization for AI Agents
17mDon't give your agent the master key
52mAI Agents Need Permission Slips
40mIn AI We Trust? Securing the Future, One Agent at a Time
25mWho Let the Agents Out? Securing AI Workflows the Right Way
23mTrust, But Verify: Human-in-the-Loop for Agents That Actually Matter