Ravi Madabhushi: Agents Break Human-Centric Auth

Ravi Madabhushi, co-founder of ScaleGrid, argues that current authentication and authorization architectures, built with humans and traditional programs in mind, are failing to keep pace with the rise of AI agents. In a presentation titled "You Didn't Ship a Bug. You Just Wrote It for a Human," Madabhushi highlights critical security and architectural challenges posed by agents, emphasizing the need for a paradigm shift in how we manage access.

The Latency Spike That Revealed a Deeper Problem

Madabhushi shared an anecdote about observing rhythmic latency spikes every 15 minutes in their systems. This issue stemmed from a feature designed to track user activity: a 'last seen' timestamp. While suitable for human interaction, agents interacting with the API at a significantly higher frequency caused undue pressure on the database write system. The fix, batching updates, was straightforward. However, it led Madabhushi to a more profound realization: the underlying assumptions about authentication and authorization needed a complete overhaul when dealing with agents.

Human-Centric Architecture vs. Agent Needs

Madabhushi, with a decade of experience building identity platforms for millions of human users, pointed out that applications were historically designed for human actors. APIs were typically accessed by machines controlled by humans, which provided a degree of predictability. However, the advent of AI agents, which can access third-party data from applications like Salesforce, Databricks, HubSpot, and Notion, has drastically changed this picture.

A key observation is that most agents currently have excessive permissions and scopes relative to their actual responsibilities. This is not necessarily due to developer carelessness but rather a default pattern of granting broad access because existing systems lack the granularity to provide fine-grained permissions.

The Two 'Slots' That Don't Fit Agents

Madabhushi outlined two traditional access models:

• Interactive Human: A human user interacting with an application via a browser or mobile app. The same user authenticates and acts.
• Service Account/End-to-End Account: A machine identity with predefined permissions, often secured by credentials like API keys or SPIFFE. These are typically deterministic programs.

The core principle in both these models is that the entity authenticating is the same entity acting, and its permissions are fixed. For decades, this worked because programs were deterministic, meaning they would only do what they were explicitly programmed to do. Developers could inspect the code to ensure safety.

Agents Break Determinism and Identity

AI agents, however, fundamentally break these assumptions. Firstly, the principal (who is authorizing) is not the same as the actor (who is performing the action). Agents act 'on behalf of' users, requiring delegated access. Many systems lack robust OAuth support for this, making it difficult to distinguish between an agent acting on behalf of a user and the user acting directly.

Secondly, and more critically, agents are non-deterministic. Their behavior cannot be guaranteed by inspecting code alone. An agent's actions today do not guarantee the same behavior tomorrow or even in the next run. This unpredictability is a significant security risk.

The Problem of Over-Privileged Agents

The current approach often forces developers to choose between two 'lies':

• Lie 1: "The agent is itself." This involves giving the agent its own service account with broad access, effectively treating it as a standalone entity.
• Lie 2: "The agent is the user." This involves handing the agent the user's token, scoping it to a single user but losing the ability to audit actions at the agent level, leading to issues with agent speed and audit trails.

Both approaches collapse the critical distinction between who is acting and who is authorizing, and they discard the essential concepts of 'who acted' and 'for whom'.

Madabhushi illustrated this with tool surfaces for different users. While expected tool access is tailored, the reality is that agents often see the entire tool surface, regardless of the user they are acting for, increasing the risk of misuse.

The Path Forward: Fine-Grained, Auditable Access

To address these challenges, Madabhushi proposed key solutions:

• The actor (agent) must be bound to its principal (user) at all times.
• Agents need their own identity.
• Permissions must be extremely fine-grained, extending beyond current broad OAuth scopes. This means attribute-level, context-level, and principal-level scoping.
• Agents should operate under the principle of least privilege by default.
• Agents should be able to request just-in-time authorization for elevated scopes.

He cited ref.tools as an example of a customer whose entire user base consists of coding agents, highlighting the growing trend where actors are never principals. Madabhushi concluded by stressing the importance of deterministically controlling agent actions and having complete visibility into their activities, stating, "Praying that the agent doesn't end up doing what it's not supposed to do. And praying is not a strategy."

In essence, the industry needs to move beyond human-centric security models and architect systems that specifically account for the unique characteristics and risks associated with AI agents.