AI Agents Need Better Auth, Not Just Credentials

In the rapidly evolving world of AI agents, security and authorization are paramount. During a workshop at the AI Engineer World's Fair, Paola Estefania highlighted the critical need for a more robust approach to agent authentication, moving beyond simply handing over credentials.

The Problem: Over-Privileged Agents

Estefania pointed out that when users grant AI agents access to their personal accounts, such as Gmail or calendars, they often give the agent the same level of access they themselves possess. This practice is risky, as it allows the agent to "act on behalf of us, but pretending to be us." She drew an analogy to hiring someone for a company: you wouldn't give a new employee the CEO's credentials because of the potential for misuse. Similarly, with AI agents, simply granting access to everything is a flawed security model.

The Solution: Authority Over Credentials

The core idea presented is to "hire your agent" by giving them specific authority rather than blanket access through credentials. This involves several key components:

• Discovery: Agents need a way to discover what services they can interact with and what actions they can perform. This could be through a standardized protocol or a directory where services list their capabilities.
• Authorization: Instead of granting full access, agents should be authorized for specific tools and actions, with granular controls like read-only access or specific functions.
• Identity: Every agent should have its own identity, similar to how users have identities. This allows for better tracking of actions performed by specific agents on behalf of users.

Estefania emphasized that this approach shifts the paradigm from agents hiding behind users to agents acting as distinct principals with their own verifiable identities.

Key Concepts: Capabilities, Identity, and Traceability

Estefania elaborated on the concept of capabilities, which are more granular than traditional scopes. For instance, instead of a broad "read" scope, capabilities can define specific actions like "read emails" or "send email." This allows for much finer-grained control over what an agent can do.

Furthermore, giving agents their own identity, potentially through a private key, enables them to sign tokens and operate with metered access. This means that logs can clearly identify which agent performed which action, rather than just seeing a user's interaction. This identity also allows for traceability, meaning if an agent misbehaves, its access can be revoked by identifying its specific origin.

The Agent Auth Protocol

The proposed Agent Auth Protocol aims to address these challenges through three layers: plugin, registry, and client. The protocol allows services to publish their capabilities, enabling agents to discover and utilize them securely. Estefania highlighted that while many services still rely on older authorization methods, the protocol can translate these into a more modern, capability-based system.

The protocol includes features like a well-known agent configuration endpoint, similar to OIDC, and a mechanism for listing capabilities. For services that don't natively support this, a middleware approach can be used to convert existing API specifications, like OpenAPI JSON, into agent capabilities.

Demonstration and Future Outlook

Estefania provided a demonstration showcasing how the system works, including connecting to an MCP server and requesting to read emails. The demo illustrated the process of an agent discovering capabilities, requesting authorization, and the subsequent logging of its actions. This end-to-end traceability, she argued, is crucial for building trust and security in the agent ecosystem.

The team is working on a V2 of the protocol, which will further enhance capabilities like multi-step workflows and long-lived agents, ensuring that the system remains secure and user-friendly. Estefania encouraged broader adoption and contribution to the open-source project, emphasizing the goal of making AI agents safer for everyone.