Kamil Potrec of Keycard used an AI Engineer session to make the case that agents need their own identities, separate from the users who launch them, and Potrec said that without that separation you cannot answer who made a request.
That question is the failure mode. Potrec walked through the common stack where a user hands an agent a personal access token, the agent adds its own API key for the model provider, then calls tools via remote MCP servers that wrap internal APIs, databases and external systems like an invoicing service, and the MCP server sees only the user identity while the agent decides on its own whether to send an invoice.
The pattern Potrec described ran on borrowed time. For years OAuth and short-lived, scoped credentials existed, Potrec said, but teams accepted over-privileged service accounts for service-to-service calls because deterministic software could be reviewed before release, and Potrec argued agents break that assumption because they are non-deterministic and will act helpfully, maliciously, or under manipulation with whatever keys they can reach. At scale Potrec put numbers on it that matter: hundreds of APIs each with a different authentication method and authorization server, thousands of users who must consent to arbitrary agent actions, and multi-hop delegation between agents where the hop count is unknown, according to Potrec.
Potrec’s fix reuses old primitives. Agents should advertise how to get access, clients should discover that metadata, agents should authenticate first with workload identity federation, private keys or certificates, then obtain a short-lived token scoped to one tool and one interaction, and MCP servers should validate the issuer, verify the signature and enforce policy on every request with full audit, Potrec said. Because SDKs leave gaps across languages and cannot be injected into closed agents like Cloud Code, and because agents can cache tokens inside their execution environment, Potrec pushed the credential brokering out of the agent into a vaulting service and a gateway in the request path that can inject credentials, attenuate overly broad legacy tokens to read-only and revoke instantly by checking policy per request, which Potrec said is impossible with pure short-lived tokens alone.
The gateway does not solve everything. Potrec said it adds latency as an extra hop, it fails if agents can bypass it without network controls, it does not cover local tool execution, it still requires agents to authenticate to the gateway, it becomes a high-value target, and it needs someone to operate routes, policies and connectors, while federation itself is already productized elsewhere, with AWS IAM offering outbound identity federation for workloads to external services, according to AWS. Potrec flagged that Keycard is building a single control plane for agent identities, federated trust, policies, audit, client and service SDKs and a gateway, and he pointed to agentbaseline.org as a reference implementation, while the talk disclosed no patch, no CVE and no breach count to model risk. One deployment that forced all agent-to-MCP traffic through attested workload identities would change the read, and until then the open question is how many of those hundred-plus APIs will accept federated agent identities instead of another shared service account.
