Before this demo the Expense Desk agent used a static API key. That key held unrestricted permissions to the Ledger API via the Expense MCP server. Then Kim Maida of Keycard and Mason Egger of Temporal showed a runtime replacement on AI Engineer. An attacker with local disk access could steal the old key. A remote attacker now gets a token that expires within minutes.
Static keys do not expire.
Maida traced the fix to Token Exchange, an open standard since 2020 that extends OAuth 2. The flow issues a subject token for the principal. It exchanges that token through Keycloak's Security Token Service. The issued access token expires within minutes and should never be stored on disk.
"The agent has unrestricted access to any and all permissions in that API key," Maida said. Her workshop moved step by step from an unidentified agent to an agent with its own identity to delegated human identity. The stack included Keycard Vault to keep LLM keys off disk, the Keycard CLI to populate secrets dynamically, the Keycard SDK mint function to request the exchange, and the Keycard Console to audit applications, resources and activity logs.
Egger paired that with Temporal's Durable Execution Framework. Workflows define parent logic and Activities run child tasks that can fail and retry. A native Interceptor injects identity and permissions, the Worker-Server model rebuilds state after failure, the Temporal Web UI shows history, and a Payload Encoder encrypts that history. Egger said no LLM calls were redone and no previous Activities were re-executed after a worker failure. He cited integrations with OpenAI, Pydantic AI, LangChain and an agentic harness.
What still has to happen is delegation. The workshop runs in a pre-provisioned shared Keycard organization and sandbox with admin access and checkpoints for each lesson, fronted by an Expense MCP server and a custom LangChain Expense Desk app tied to the Ledger database. Outside the demo, Microsoft Entra now creates agent identity from a blueprint that holds credentials and mints identities per tenant, which frames why vendors are shifting to runtime exchange over long-lived keys. The next checkpoint is human user identity and delegation.
