Who is Calling? Identity for Agents with AAuth
summary
AAuth gives every agent its own cryptographic identity and replaces brittle API keys with proof of possession via HTTP message signing; three token types (agent, resource, auth) bind identity, authorization and the called resource together. A separate person server or governor holds the mission, evaluates contextual justifications for each commitment (contracts like a restaurant reservation), and approves or denies actions so agents never impersonate humans. TypeScript, Python and .NET libraries exist and several deployments run in production.
AI-written summary · about
chapters (9)
- 0:00Agent delegation basics
- 3:51Agent commitments problem
- 7:00Introducing AAuth
- 10:28AAuth status/resources
- 13:18Agent tokens and provider roles
- 15:07Contextual authorization
- 18:40Policy decisions over rules
- 21:08Security model and governor
- 22:36Closing remarks & Q&A
related talks
01h 22mIdentity for AI Agents
20mCIAM for AI: Authn/Authz for Agents
17mDon't give your agent the master key
25mAgents Are Not Users or Services: Securing AI Traffic with a New Identity Model
33mIAM, Agent: Identity for Autonomous AI
04mYou Don't Need a New Identity Platform for the AI Era
33mAgent-Based Digital Identity Architecture
25mIdentities and Authentication for Your Agents With Keycloak