OAuth isn't enough for agents: Keycard demos short-lived creds and task-based policy
AI Engineer · youtube · 2026-10-12
At AI Engineer, Keycard's Kim Maida staged an overpowered on-call agent demo: armed with standing API keys and an admin's database credentials, it drops a billing database, restarts production, and scales from 4 to 40 pods—adding $420/hour to the bill.
The core problem
- Private data + untrusted tickets + external service access = the "lethal trifecta": the agent's credentials carry far more authority than any single ticket requires.
- A human approval button alone can't tell whether the approver is actually authorized to approve the action.
The fix
- Delegated authorization via OAuth token exchange: carry the user's identity through the agent and MCP server, evaluate policy at a security token service, and issue short-lived credentials scoped to the requested access.
- A second demo uses task-based policy: customer data access and database deletion are denied, certificate renewal allowed; a server restart stays blocked even after approval because the user's role lacks authority, while scaling proceeds when authority matches.
- Intent-based authorization is flagged as a proposal, not a finalized standard; identity, delegation, and policy decisions are made visible across the request chain, decoupled from whether the agent's answer is correct.
More from coding & agent
- JetBrains study: coding-agent benchmarks should match real users' task flows — JetBrains-Research · 2026-10-12
- Agent Cards and MCP tool descriptions are unverified claims — a team built signed A2A tests — Suncly_com · 2026-10-12
- Voice agent fills CRM fields at 90% confidence — yet payments bounce on wrong account numbers — CoursePopular824 · 2026-10-12
- Dev keeps Codex as code reviewer on top of Claude-generated code — MartinGTobias · 2026-10-12
- How a broken customer ID let a support agent 'resolve' tickets it never read — aiagentguide · 2026-10-12
- OpenEnv Arena offers free GPU compute to train your environment, weights open sourced — ben_burtenshaw · 2026-10-12