riverside erika, dan, brittany magic episode nov 14, 2025 overcommitted

riverside erika, dan, brittany magic episode nov 14, 2025 overcommitted 🔗 **Source:** [riverside erika, dan, brittany magic episode nov 14, 2025 overcommitted](https://www.youtube.com/watch?v=JegPm8zxyhg) > [!note]+ Document Notes > tags: [ai-agents, identity-authentication, enterprise-security] > author: Overcommitted Podcast > source: YouTube > reference: https://www.youtube.com/watch?v=JegPm8zxyhg > date created: 2024-11-14 00:00 > > # 🏷️ Title: Securing AI Agents: Identity and Authentication in the Age of Autonomous Code >  ## 🧰 Action Inbox - [H1] Research OAuth specifications for AI agent authentication — 05:23 #security - [H2] Implement granular permissions over broad API keys — 32:15 #authorization - [H3] Study IETF AI agent identity drafts — 20:45 #standards ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [FusionAuth](https://fusionauth.io) - [IETF Working Groups](https://ietf.org) ## 📝 Summary - AI agents create new security challenges as they operate autonomously with access to private data and external communication - Current identity protocols like OAuth can be extended rather than replaced to handle agent authentication - Enterprise adoption is still experimental, with more promise than proven large-scale deployments - The "lethal trifecta" of private data access, untrusted content exposure, and external communication creates unique threat vectors - Standards are emerging but still in early development across IETF working groups ## 📖 Main Content AI agents represent a fundamental shift in how software operates, moving from deterministic code to non-deterministic workflows defined in natural language. This creates new security challenges around identity and authorization. Dan Moore, Senior Director of CIAM Strategy at FusionAuth, explains that agents fall between human users (slow and non-deterministic) and traditional software (fast and deterministic) - they are fast but non-deterministic. The core security risk comes from what Simon Willis calls the "lethal trifecta": agents have access to private data, are exposed to untrusted content, and can communicate externally. Unlike traditional software, agents can be instructed through natural language to misuse their permissions in ways that are difficult to predict or prevent. Current OAuth protocols appear sufficient for agent authentication when properly implemented with granular scopes and fine-grained authorization systems like RBAC or ABAC. The industry is developing standards through IETF working groups, with Model Context Protocol (MCP) standardizing on OAuth for enterprise use cases. ## 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=JegPm8zxyhg?t=0) — [H1] Introduction to AI Agent Security - Key idea: Securing autonomous code agents requires answering fundamental identity questions - Evidence: "We are talking about securing autonomous code that they control through AI agents" #### ⏱️ [03:15](https://www.youtube.com/watch?v=JegPm8zxyhg?t=195) — [H2] Defining AI Agents - Key idea: AI agents are workflows defined in natural language rather than static code - Evidence: "The workflow used to be defined in code or in static configuration, and now it's more in natural language" #### ⏱️ [05:23](https://www.youtube.com/watch?v=JegPm8zxyhg?t=323) — [H2] Non-Deterministic Security Risks - Key idea: Agents are fast and non-deterministic, creating new threat vectors - Evidence: "Human beings are slow and non-deterministic and software...is fast and relatively deterministic...agents kind of fall in this middle ground" #### ⏱️ [07:45](https://www.youtube.com/watch?v=JegPm8zxyhg?t=465) — [H1] The Lethal Trifecta - Key idea: Three capabilities combine to create unique security risks for agents - Evidence: "Access to private data...exposure to untrusted content...and then there's the ability externally communicate" #### ⏱️ [09:30](https://www.youtube.com/watch?v=JegPm8zxyhg?t=570) — [H3] Separation of Concerns Solution - Key idea: Different agents should handle different functions to limit attack surface - Evidence: "You have different agents that have access to different sets of tools or different sets of data" #### ⏱️ [12:00](https://www.youtube.com/watch?v=JegPm8zxyhg?t=720) — [H2] Enterprise Adoption Reality - Key idea: More experimentation than proven large-scale deployments currently - Evidence: "I've not seen some really large public like case studies where people are like successful with this" #### ⏱️ [15:30](https://www.youtube.com/watch?v=JegPm8zxyhg?t=930) — [H2] Green Field vs Brown Field Development - Key idea: Agents work better for new projects than existing complex systems - Evidence: "When you're doing green field development, agents are an amazing productivity boost...brownfield development...suddenly there's a whole lot more context" #### ⏱️ [18:45](https://www.youtube.com/watch?v=JegPm8zxyhg?t=1125) — [H1] Current Standards Development - Key idea: Multiple IETF working groups are addressing agent identity - Evidence: "AI was mentioned in every single meeting I went to...there was an agent draft mentioned there" #### ⏱️ [20:15](https://www.youtube.com/watch?v=JegPm8zxyhg?t=1215) — [H2] Agent Communication Protocols - Key idea: Two main approaches emerging for agent-to-agent communication - Evidence: "Agent to agent protocol...and then there's MCP which is model context protocol" #### ⏱️ [22:30](https://www.youtube.com/watch?v=JegPm8zxyhg?t=1350) — [H2] OAuth for Agent Authentication - Key idea: Existing OAuth protocols can be extended for agent use cases - Evidence: "MCP...seems to have been kind of standardized on OAuth for the majority of kind of enterprisy use cases" #### ⏱️ [25:45](https://www.youtube.com/watch?v=JegPm8zxyhg?t=1545) — [H3] Developer Security Awareness - Key idea: Developers need greater security consciousness in the agent era - Evidence: "The average developer needs to know a little bit more about security" #### ⏱️ [28:00](https://www.youtube.com/watch?v=JegPm8zxyhg?t=1680) — [H2] Wild West Current State - Key idea: Agent security feels like early internet development phase - Evidence: "There is a little bit of wild west feel to a large chunk of this...probably is a little bit like the early internet" #### ⏱️ [32:15](https://www.youtube.com/watch?v=JegPm8zxyhg?t=1935) — [H1] Granular Permissions Best Practice - Key idea: OAuth tokens with scopes preferred over broad API keys - Evidence: "I think that OAuth tokens properly constrained with scopes and probably fine grained access...is probably the path forward" #### ⏱️ [35:30](https://www.youtube.com/watch?v=JegPm8zxyhg?t=2130) — [H2] FusionAuth's Agent Strategy - Key idea: Supporting client credentials and authorization code grants for agents - Evidence: "That's all using kind of client credentials grant for OAuth or the authorization code grant" ## 📚 References - [FusionAuth Platform](https://fusionauth.io) - [IETF Working Groups](https://ietf.org) - [AWS Agent Core Framework](https://aws.amazon.com) - [Model Context Protocol (MCP)](https://modelcontextprotocol.io) ## 🗣️ Paraphrase - AI agents represent workflow automation controlled by natural language rather than static code configuration - The combination of private data access, untrusted input processing, and external communication creates unprecedented security risks - OAuth protocols with proper scoping and fine-grained authorization appear sufficient for agent authentication needs ## 📰 Newsletter **Securing AI Agents: The New Frontier of Identity Management** As AI agents move from experimental tools to enterprise systems, security professionals face a critical challenge: how do we authenticate and authorize autonomous code that makes decisions based on natural language instructions? The key insight from identity experts is that agents create a "lethal trifecta" - they can access private data, process untrusted content, and communicate externally, all while being non-deterministic in their behavior. This combination enables new attack vectors where malicious instructions can cause agents to exfiltrate sensitive information. The good news? We don't need to reinvent authentication. OAuth protocols, properly implemented with granular scopes and robust authorization frameworks, provide a foundation for agent security. The challenge lies in applying these principles consistently as standards continue to evolve. **Key Takeaways:** - Implement separation of concerns with specialized agents for different functions - Use OAuth tokens with fine-grained scopes rather than broad API keys - Stay informed about emerging IETF standards for agent identity - Apply existing security best practices while remaining aware of new threat models Resources: [FusionAuth Documentation](https://fusionauth.io), [OAuth 2.0 Security Guide](https://oauth.net), [IETF Agent Identity Drafts](https://datatracker.ietf.org) ## ✅ Action Items #### DevRel - Developer advocacy: Create workshops on OAuth implementation for AI agents - Education: Develop training modules on agent security best practices - Developer experience: Improve SDK documentation for agent authentication flows - Community management: Facilitate discussions on emerging agent identity standards #### OSPO - Policy & Governance: Establish guidelines for agent deployment and access controls - Security Management: Implement vulnerability assessment processes for agent systems - Developer Support: Provide tooling for secure agent development practices - Community Engagement: Participate in IETF working groups on agent identity standards #### Community - Maintainers: Develop governance templates for agent integration projects - Contributors: Create onboarding materials for agent security contributions - Sponsors: Fund research into agent identity and authorization frameworks ## 🧪 Hypotheses - OAuth protocols with proper scoping can adequately secure AI agent authentication - Separation of agent concerns will become a critical security architecture pattern - Enterprise adoption of agents will accelerate once identity standards mature - Non-deterministic agent behavior will require new threat modeling approaches ### 📊 Methodology - Study design: Comparative analysis of API key vs OAuth token security for agents - Data sources: IETF draft analysis and enterprise adoption case studies - Experiments: Implement agent authentication patterns in controlled environments ### ❓ Questions - How will agent identity standards evolve across different enterprise contexts? - What authorization frameworks best support fine-grained agent permissions? - How do we balance agent autonomy with security constraints? ### 🔮 Future Research - Long-term impacts of non-deterministic systems on security architecture - Integration patterns between human and agent identity systems - Governance frameworks for multi-agent system authorization ### 💡 Implications - Practice: Security teams need to understand OAuth implementation for agent systems - Policy: Organizations must develop agent deployment and access control policies - Security: New threat models required for non-deterministic autonomous systems - Education: Developer training must include agent-specific security considerations ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade (technical content appropriately complex) #### 👀 Visual learners - Present: Conceptual diagrams of agent authentication flows - Improve: Add architecture diagrams showing agent separation patterns #### 🔊 Aural learners - Present: Podcast format with conversational explanation style - Improve: Audio summary highlighting key security principles #### 🗣️ Verbal learners - Present: Clear definitions of technical terms like "non-deterministic" - Improve: More analogies comparing agent behavior to familiar systems #### 🧩 Kinesthetic learners - Present: References to hands-on experimentation with agent frameworks - Improve: Step-by-step OAuth implementation guides for agents #### 🧠 Logical learners - Present: Structured progression from problems to solutions - Improve: Decision trees for choosing authentication approaches #### 🧑‍🤝‍🧑 Social learners - Present: Interview format with expert discussion - Improve: Community forums for agent security discussions #### 🧘‍♀️ Solitary learners - Present: Comprehensive notes and references for independent study - Improve: Self-assessment checklists for agent security implementation #### 🌿 Naturalistic learners - Present: Ecosystem thinking about agent interactions - Improve: Analogies to natural systems and emergent behaviors ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure and descriptive content - Improve: Add alt text for any technical diagrams referenced #### Keyboard navigation - Present: Standard podcast controls and navigation - Improve: Ensure transcript navigation supports keyboard users #### Contrast and readability - Present: Standard text formatting meets contrast requirements - Improve: Ensure technical terms are properly highlighted #### Media and captions - Present: Audio content with full transcript - Improve: Add timestamps for easier navigation ### 🌍 DEIB Assessment #### Cultural breadth - Present: Technical discussion accessible to global developer audience - Improve: Include perspectives from different regulatory environments #### Inclusive language - Present: Gender-neutral technical terms and clear explanations - Improve: Define acronyms and industry jargon more consistently #### Neurodiversity support - Present: Well-structured content with clear section breaks - Improve: Add visual cues and consistent formatting patterns #### Representation - Present: Diverse podcast hosts with technical expertise - Improve: Include voices from different organizational contexts ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Clear logical progression from agent capabilities to security risks - Inductive strength: Good use of specific examples to support general principles - Causal reasoning: Well-established links between agent properties and security implications - Analogical strength: Effective comparison to early internet development challenges #### Fallacies - Appeal to authority: Some reliance on expert opinion without detailed justification - Hasty generalization: Limited enterprise case studies used to draw broad conclusions #### Tone of voice - Overall tone: Professional and accessible, balancing technical depth with practical guidance ### 🛡️ DARVO Analysis - Deny: No denial patterns observed - Attack: No attacks on accusers present - Reverse victim/offender: No victim/offender reversals identified - Emotional cues and rhetoric: Professional, educational tone throughout ## 🎯 Conclusion AI agents represent a significant shift in how we think about identity and authorization, combining the speed of software with the unpredictability of human behavior. While this creates new security challenges, existing OAuth protocols provide a solid foundation when properly implemented with granular scopes and sophisticated authorization frameworks. The key is applying proven security principles while remaining aware of the unique threat models that non-deterministic autonomous systems introduce. As standards continue to evolve through IETF working groups, developers and security professionals must balance innovation with careful attention to established security practices. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad Purpose: Stage CEE units that become Literature notes. Split level: H3 ### [H1] AI agents create novel security risks through non-deterministic behavior > [!quote] [Securing AI Agents: Identity and Authentication](https://www.youtube.com/watch?v=JegPm8zxyhg) by [[Dan Moore]] via [[Overcommitted Podcast]]. Published 2024-11-14. Accessed 2024-11-14. > "Agents are fast and non-deterministic...they can be instructed to access your private data and then send it off." Establishes the fundamental security challenge --- ## Full Transcript [00:00] Welcome to the Overcommitted Podcast, [00:02] your weekly dose of real engineering [00:05] conversations. I am your host today, [00:07] Erica, and I am joined by Hey, I'm [00:09] Britney Ell. We met while working on a [00:12] team at GitHub and quickly realized we [00:15] were obsessed with getting better at [00:17] what we do. So, we decided to start this [00:19] podcast to share what we've learned. [00:22] We'll be talking about everything from [00:23] leveling up your technical skills to [00:25] navigating your professional [00:26] development. All with the goal of [00:28] creating a community where engineers can [00:30] learn and connect. Today we are not just [00:34] talking about securing users. We are [00:37] talking about securing autonomous code [00:39] that they control through AI agents. [00:42] Specifically, as these agents move into [00:45] our enterprise systems, we're asking the [00:47] fundamental questions of who are you and [00:50] what are you allowed to do? And these [00:52] become huge challenges for our security [00:55] stack. So to help us navigate this [00:58] critical shift, we are bringing in an [01:01] undisputed expert in identity and [01:04] authentication, Dan Moore, who is the [01:07] senior director of CIAM strategy and [01:10] identity standards at Fusion O. We will [01:13] be discussing what current identity [01:16] protocols are being challenged by the [01:17] rise of agents and what new standards [01:21] are emerging to give autonomous coding [01:24] agents a more secure, verifiable and [01:27] official identity. So Dan, welcome to [01:30] the show. Let's talk about this evolving [01:33] landscape of identity. Feel free to [01:35] introduce yourself. Say hi. [01:37] >> Sure. Yeah. Yeah. Hey, thank you so much [01:39] for having me, Britney Erica. I am [01:41] thrilled to be here. Um, and the short [01:44] answer about who I am is I've just been [01:46] in the developer world for about 25 [01:48] years. Played a lot of different roles. [01:51] My current role, as you mentioned, is is [01:53] at Fusion. We're an authentication [01:55] provider. We are really focused on [01:57] customer authentication, but as you [02:00] alluded to, a big part of that, at least [02:02] in the last year or two, has been well, [02:04] what's [02:07] um, you know, agents? I know we're going [02:09] to kind of dig into kind of what that [02:10] is, but um we are extremely interested [02:14] in kind of helping people secure their [02:15] systems uh for users as well as for [02:18] agents. [02:18] >> Well, yeah, you teed it up perfectly. [02:20] Let's start there. When we talk about AI [02:23] agents, what exactly are we talking [02:26] about? Is it just a fancy name for a [02:29] piece of software or is it something [02:31] different? And do we even have a [02:35] definition? [02:36] Yeah, I think it's a great question [02:38] because I think the honest truth is that [02:41] people are there are definitely people [02:43] out there using AI agents to accomplish [02:46] tasks to get stuff done, especially in [02:48] the coding realm, but also outside of [02:50] the coding realm. But I think that we're [02:53] still kind of groping our way towards an [02:55] actual real definition of of something. [02:57] But the way I think about it, and this [02:59] came up in a conversation the other day, [03:00] is it's really like a workflow or a set [03:04] of pieces of software that can like [03:06] accomplish workflows, which we've had [03:07] for decades, right? Workflow software [03:09] has been around for a long time. The [03:11] difference is that the workflow used to [03:13] be defined in code or in static [03:16] configuration, and now it's more in [03:18] natural language. And so the idea you [03:20] can actually kind of give an agent a [03:23] task in relatively natural language and [03:25] have it not to overuse the word grope [03:28] but grope towards accomplishing it which [03:30] is what they do is to some extent a game [03:33] changer. Well, so yeah, when this piece [03:36] of code does start making decisions on [03:40] its own, um how does that change some of [03:43] these security risks that we face? And [03:47] what are the biggest things that um we [03:51] need to worry about when it's an agent [03:53] authenticating um or authorizing [03:56] authorizing versus a human? [03:58] >> Sure. And I will say it is worth taking [04:00] a step back and saying the security [04:01] problems that these new agents create [04:05] are similar. Boy, maybe they're a little [04:08] bit different in in scope, but like [04:10] they're similar to the security problems [04:11] that we have right now, right? Because [04:14] there's plenty of plenty of security [04:16] holes that humans drive through that [04:19] agents are going to also be able to kind [04:21] of attack or exploit. You know, I guess [04:25] I I just want to say before people get [04:26] all concerned about securing AI agents, [04:28] they should be like, "Hey, what are we [04:29] doing to follow all the rules and all [04:31] the things that we should do to secure, [04:33] you know, stuff." Anyway, so set set [04:35] that aside. The way I think about it is [04:36] that human beings are slow and [04:38] non-deterministic and software as [04:41] written, you know, 5 years ago, 10 years [04:43] ago, even the vast majority of software [04:45] right now is fast and relatively [04:48] deterministic, right? Charity majors [04:50] might have some issues about that how [04:52] deterministic it is, but it's pretty [04:53] deterministic and easy to reason about. [04:55] Whereas agents kind of fall in this [04:56] middle ground and so they are fast and [04:59] non-deterministic. So um so there's this [05:01] great thing called the lethal trifecta [05:04] which Simon Willis who's written a ton [05:06] about AI and LMS in general talks about [05:09] and the idea is that agents have access [05:12] to private data which again software [05:14] does too. It's exposure to untrusted [05:17] content which again software does too. [05:19] And then there's the ability externally [05:21] communicate. And so the issue is that [05:23] because agents are non-deterministic and [05:26] because they read that untrusted [05:28] content, they can then be instructed to [05:31] access your private data and then send [05:33] it off in an email. And this is a real I [05:36] mean I would consider this to be a new [05:37] threat because um because of the ability [05:40] to follow like arbitrary instructions, [05:42] right? Like if a piece of code got an [05:44] arbitrary instruction, it didn't [05:45] understand. I should be careful here. [05:47] There are ways to craft it, but it's a [05:49] much higher bar to like make a [05:52] deterministic piece of software do stuff [05:54] it's not supposed to do. Whereas with [05:55] agents, they found over and over again, [05:57] it's relatively easy to do that. Those [05:59] are kind of the bigger changes that I [06:01] see coming down the pike is how can we [06:03] address this? I mean, the non-inerminism [06:06] is the joy and the pain of agents, [06:08] right? Like the fact that we can like [06:10] give it something and as I mentioned [06:12] earlier can kind of maneuver away its [06:14] way towards achieving a goal is a huge [06:16] win. But that also means that other [06:18] people who can communicate with it can [06:20] do the same thing and kind of bend the [06:22] agent away from the goal that we set it [06:26] >> and non-deterministic in this case [06:29] meaning can you like sort of define that [06:32] with [06:32] >> sure what you mean there? [06:34] >> Yeah. Yeah. Yeah. It's a great um sorry [06:37] I shouldn't uh I work in the office [06:39] space and like using jargon is something [06:41] that like I try not to do because it's [06:43] so easy to kind of get over your skis um [06:46] and assume kind of everyone knows uh [06:48] what you know but that's a great call [06:49] out. So nondeterministic in my mind [06:52] means that or sorry let's start with [06:55] deterministic. Deterministic is you give [06:57] the same inputs and you get the same [07:00] output. So math is a perfect example of [07:02] the deterministic system. gravity to [07:04] some extent is too, right? Whereas [07:06] non-deterministic means you give it the [07:08] same inputs and you not won't [07:10] necessarily give the same outputs. [07:12] Whether human society, conversations [07:15] with your partner, like these are all [07:17] things that are non-deterministic [07:18] because they're affected by the current [07:21] state of things. And so if you've ever [07:23] asked the same question of an LLM, [07:26] you're going to get back slight. I mean, [07:29] here's the thing, like they're they're [07:31] slightly different, right? or they could [07:32] be kind of massively different depending [07:34] on on um the the the way that well I [07:39] should be careful there because I'm [07:40] definitely not an LLM like create [07:42] creation expert so but it at the end of [07:44] the day it's it's not a system where you [07:47] put in the same thing and you get the [07:49] same thing out. [07:50] >> Makes sense. Um, yeah. So, you're saying [07:52] that that creates scenarios where it's [07:56] unpredictable how they might act in [07:59] different scenarios, [08:01] >> especially with untrusted input, right? [08:03] Like that's where it gets really kind of [08:05] scary. And the honest truth is, [08:07] unfortunately, we think about untrusted [08:09] input as something an attacker provides, [08:11] but it could also be we make a mistake, [08:13] right? Like we fat finger something or [08:15] we um aren't as clear in our intent as [08:18] as we want to be. And that's all input [08:20] that like you aren't sure how things are [08:23] going to go. And that's a new kind of [08:26] security threat model. [08:28] >> And yeah, it I guess it like there's [08:31] there's different boundaries where this [08:34] can be be dangerous like within your own [08:37] system is one thing and then sort of [08:39] like crossing system boundaries too. [08:42] There's the question of like how much [08:44] context, how much data gets like carried [08:47] across from one system to another and [08:50] you're talking about like privacy like [08:53] you know how do I authorize this context [08:56] versus something else. Yeah, I think [08:58] actually that points to one of the [09:00] solutions to this is that you start to [09:02] have these kind of sub aents that you [09:05] know may have access like I mean one way [09:07] to deal with that lethal ultra effect I [09:09] mentioned is that like you have [09:12] different agents that have access to [09:13] different sets of tools or different [09:14] sets of data and if you have one that [09:18] can read your email and another that can [09:20] send your email it's going to be really [09:22] hard for an attacker to be able to kind [09:23] of get [09:26] uh that email, you know, that private [09:28] data is sent off because you have to [09:30] like basically now attack two different [09:31] LLMs. So, kind of more separation [09:34] concerns, which again, this is not [09:37] software [09:38] um it's not revolutionary, right? It's a [09:40] lot of the same principles. We're just [09:42] having to apply it in new context, [09:43] right? Separation concerns is a great [09:45] thing for security, [09:47] >> right? Yeah. Going back to your point [09:49] where the best practices for human [09:53] authorization is the same idea for like [09:57] agentic authorization like you don't [09:59] want to give a human the keys to [10:02] everything across all system boundaries. [10:05] We try to enforce data protection and [10:08] David privacy and minimum required [10:10] access controls. Same rules apply for [10:13] agentic identities as well. [10:15] >> Yep. [10:16] >> This is very fascinating. I don't [10:17] personally work on the identity side at [10:20] all. So, I'm just a software engineer [10:22] and I just want to know like what do I [10:24] need to do to keep these things working [10:26] and not exposing anybody to problems? [10:28] But I'm curious, I do work on the [10:30] enterprise side and I'm curious what [10:32] you're seeing right now in terms of [10:33] enterprise adoption of agents. Are there [10:36] any like specific business or [10:37] administrative problems associated with [10:39] with, you know, that companies are [10:41] experiencing or butdding up against when [10:42] they want to use agents? [10:45] >> Sure. I mean, I guess I would say that [10:47] like first of all, it feels like there's [10:49] a ton of people there experimenting with [10:50] this stuff and I think there's [10:52] definitely a feeling that there's a [10:53] there there. I think that I've not seen [10:56] some really large public like case [10:59] studies where people are like successful [11:01] with this. And I don't know whether [11:03] that's because it's harder to be [11:04] successful with or because the people [11:06] who are successful are are keeping their [11:08] lips shut because it's like a big [11:10] competitive advantage. You know, you [11:11] definitely hear about uh people doing [11:14] this around coding. I definitely have [11:16] interviewed people that are doing [11:18] spectriven development and finding that [11:20] to be very successful. It's kind of a [11:22] oneperson show, which obviously is kind [11:24] of the opposite of an enterprise, which [11:26] actually speaks to I think one of the [11:28] complexities is I feel like when you're [11:30] doing green field development, agents [11:33] are an amazing productivity boost. [11:36] Whereas when you're doing brownfield [11:38] development or improving existing [11:40] software, suddenly there's a whole lot [11:42] more context that needs to be available [11:44] to the agent for it to make intelligent [11:46] suggestions and it's less of a it's less [11:49] fun, right? Or maybe it's less that's [11:51] the wrong word. Fun is something that [11:52] human beings think about green field [11:54] development. It's less capable might be [11:56] a good way to put it. But I think that [11:59] around your specific question on [12:00] enterprises, anything that is doing text [12:02] evaluation, we talked to somebody [12:04] recently who is doing like extraction of [12:07] form fields, you know, a lot of document [12:09] management stuff. I think AI is is a [12:11] good fit for, you know, as far as kind [12:13] of pure agent stuff. Like the honest [12:16] truth is [12:18] I feel like there's a lot more smoke [12:20] than there is fire right now. Oh, [12:21] there's a lot of people who are like [12:22] building out all these agent systems and [12:24] then you ask them like hey I shouldn't [12:26] say a lot of people I'm familiar with a [12:27] couple people who've built out some [12:28] agentic systems and you're like this is [12:30] cool like who's using this and they're [12:32] like well I am to build other products [12:34] and you're like that's great right and [12:36] that that is a definitely use case but [12:38] it's not like the enterprises are like [12:40] pulling people in and like saying hey we [12:42] need to do this now one thing I have [12:44] heard is that having a natural language [12:47] interface of an LLM into data [12:51] uh and into documentation is very [12:54] powerful for improving the knowledge [12:56] worker experience. But I don't know if I [12:58] would call those agents, right? That's [12:59] like more just like a more natural [13:01] language interface. [13:02] >> Yeah, that makes sense. Are there any [13:03] like standards or is like the industry [13:05] approaching any sort of way to make sure [13:07] that these are actually secure? I mean, [13:09] I feel like you said that there's not a [13:11] lot of people doing this yet, but [13:13] there's lots of like concepts of plans [13:16] towards doing it. I'm curious this like [13:19] is there anything that the industry as a [13:21] whole is saying like okay this is a way [13:23] that we can trust securing agents. [13:26] >> Sure. So you actually kind of asked two [13:28] different questions which are there [13:29] standards and are we converging? I think [13:32] that like there are 100% standards. I [13:34] just went to the IETF meeting in [13:36] Montreal and there was I think AI was [13:40] mentioned in every single meeting I went [13:42] to and I went to most of the web stuff. [13:43] I didn't go to like the telefony stuff, [13:46] but like there was an agent draft [13:49] mentioned there I I think in every [13:51] single meeting I went to, but I think [13:53] it's all still early early days. And so [13:56] they're trying to solve in some cases [13:58] they're trying to like think of agent [14:01] identity as a workload identity, right? [14:04] So there's the whimsy group. Um there's [14:07] a draft from Aaron Perki who's an octag [14:10] guy who's talking about cross trust [14:14] boundary authentication. I feel like [14:17] there's a there's two kind of main ways [14:19] that agents communicate. There's the [14:21] agent to agent protocol which basically [14:23] has um a lot of different it it's kind [14:26] of a pick your flavor kind of protocol [14:28] when it comes to identity and then [14:30] there's MCP which is model context [14:32] protocol and that seems to have been [14:35] kind of standardized on OOTH uh for the [14:40] majority of kind of enterprisy use [14:42] cases. Um so there's a lot of activity [14:44] in the OOTH working group around some of [14:47] the kind of follow on standards around [14:49] that like how to make it easier for um [14:52] MCP clients which essentially are like [14:54] IDs or um other kind of AI agents to [14:58] register with an authorization server [15:00] and then like what goes in the token. [15:02] But to me, a lot of this comes back down [15:05] to what we talked about earlier, which [15:07] is doing stuff that we know is good [15:10] practice, which is like principal lease [15:12] privilege. It's sophisticated [15:14] authorization schemes maybe past [15:16] arbback, right? Once you get a certain [15:18] size like rebback or aback or pback and [15:21] the nice thing about implementing those [15:22] is that helps you whether you're [15:25] implementing for agents or you're [15:26] implementing for users at scale. And I [15:29] still think that those are [15:31] underappreciated and underimplemented, [15:33] but maybe AI agents will be a catalyst [15:35] for kind of pushing more people to to [15:36] handle that. [15:37] >> Yeah, it kind of seems like the average [15:38] developer needs to know a little bit [15:40] more about about security and not than [15:42] they ever really needed to before at [15:44] least right now until there's like, you [15:46] know, an idea around like the right way [15:49] to do this because people are still [15:51] trying to figure it out. What would you [15:53] re [15:53] >> actually can I ask you real quick? I [15:55] mean so so when you say that like do you [15:57] mean because they're using AI agents and [16:00] so they need to have some consciousness [16:02] of about that or because they're [16:04] building software that will be used by [16:06] an AI agent or why do you think develop [16:08] why do you think now is the time for [16:10] because I mean security people have been [16:12] like developers need to know about [16:13] security for you know shift left and [16:15] like you know for a long time so why is [16:18] now why is it more important now in your [16:21] opinion [16:22] >> sense I think that there's like more out [16:23] of the box options [16:25] for regular O than there is for AI [16:27] agents where like I would never do it. I [16:29] would never roll my own and figure out [16:31] how to do this for like any website that [16:33] I create. But if I'm creating some sort [16:35] of an AI agent, like it doesn't sound [16:36] like there's like a thing that exists [16:38] yet that I can say like, okay, this is [16:40] going to cover a lot of the security [16:42] concerns. [16:43] >> I mean, that makes sense. And I think [16:45] some of that's because it's early days [16:46] and some of it's because [16:47] >> the protocols are still being like [16:49] hammered out, right? like um the MCP [16:52] spec. There's a new release coming in 11 [16:55] days and it's going to have some shifts [16:58] even in in how you do kind of OOTH for [17:01] MCP clients. Um and that's like you know [17:05] it's only been out for a year and [17:06] there's already been like multiple [17:07] different ways to do stuff. So that [17:09] makes sense. Thank you. I think also [17:12] like an awareness that this [17:15] standardization is like still forming is [17:18] also important because I mean I guess [17:21] there's like the whole legal side of [17:24] things where like that isn't even [17:26] figured out yet necessarily of like if I [17:31] um like if I direct an agent towards a [17:34] certain goal and it takes nefarious [17:36] actions to get there, am I responsible? [17:40] And like I don't know as a like we're [17:44] mentioning like what you know the risks [17:46] are as a developer like why you might [17:48] need to know like you know as a [17:50] developer knowing like hey somebody [17:53] potentially like promises me this [17:56] agentic workflow that's going to like [17:58] solve all my problems like okay well [18:01] like you know both eyes open like look [18:04] at what it's actually doing like [18:06] understand that you know this this like [18:10] identity and authorization piece might [18:11] not necessarily be a completely solved [18:14] problem yet. So like if somebody's [18:16] promising you like you know all the [18:18] guardrails are there and like don't [18:20] worry about it like maybe question that [18:23] maybe look at it twice before you like [18:25] again like kind of authorize it to do [18:28] something that you wouldn't want to be [18:30] responsible for. [18:32] >> Yeah, that that's a great point. like [18:33] there is a little bit of wild west feel [18:36] to a large chunk of this, you know, [18:38] right now. And just like I think I mean [18:42] I'm trying to think of like an analogous [18:44] situation. I honestly probably is a [18:47] little bit like the early internet, [18:49] right? When people weren't sure like [18:50] what to do about credit cards or could [18:52] you even pay with a uh something over uh [18:55] the internet with a credit card and [18:57] developers to Britney's point need to be [18:59] a lot more like cognizant of that kind [19:01] of stuff. Now it's a lot more accepted. [19:04] So there's, you know, you don't even [19:05] think about that kind of thing. But [19:06] we're in back in the early days, which [19:08] is which is exciting and scary and [19:10] spooky all at the same time. [19:11] >> I feel like I'm hearing that um that [19:14] crossover and overlap a lot in a lot of [19:16] different spaces right now. Like [19:18] everybody's like this feels like the dot [19:20] bubble, you know, not just in terms of [19:22] what's coming out, but like economically [19:24] and like, you know, just the vibes that [19:26] we're getting. And it's going to be [19:28] interesting because I think uh you know [19:31] obviously we're still using the internet [19:33] even though it at the time I would [19:35] imagine it probably felt like we were [19:36] you know not going to for a while. So [19:38] >> yeah I think people always knew that it [19:41] was going to be big. I don't think [19:42] people like knew exactly how in-depth it [19:47] would get into our lives. But I don't [19:49] think anyone after even like 99 2002 [19:52] when it was like the depths of the [19:54] nuclear winter people weren't like I'm [19:56] never going to use the internet again. [19:57] It was just too easy to do things. So um [20:01] you know and I think that is exactly [20:03] analogous here is like there's no doubt [20:05] in my mind in 5 years from now we'll be [20:08] using Gen AI in some form right like [20:11] what it actually looks like I don't know [20:12] what's the Google maps of Gen AI. You [20:15] all are too too young to remember Google [20:17] Maps, but it was it was amazing when it [20:19] came out. You're like, "Oh my god, I can [20:20] scroll around and like and it blew my [20:22] mind and it's not it came out of Ajax [20:25] and it came out of the early internet, [20:27] but like it was not something that like [20:29] any anyone people had to invent it. So [20:32] like what are the things that people are [20:33] going to invent with AI?" Sorry, we're [20:35] kind of far a field from authorization [20:37] and identity, but you know, I I I don't [20:40] want to be like an old man shaking my [20:41] fist on the lawn, but I I feel like we [20:43] are going to have those kind of moments [20:44] again uh in the next couple years. [20:47] >> Yeah. Yeah, I agree with that. I uh is [20:49] there so before we go back to the [20:50] authorization space I'm curious you [20:52] having had the experience of living [20:54] through that time is there anything that [20:56] you're telling developers right now like [20:58] things to do for their career to like [21:00] you know bubble prevent themselves or [21:02] anything like that to like is this I [21:04] mean obviously these geni skills aren't [21:07] going to be completely useless cuz like [21:08] you said we're probably still going to [21:09] be using it. I'm not going back to the [21:11] time where I had to write tests myself [21:13] um like that's that's just not [21:15] happening. So I feel like there's still [21:16] going to be something that's around. So, [21:18] are these skills still worth investing [21:19] in in your opinion? [21:21] >> AI skills or what skills I'd recommend? [21:23] >> AI skills, AI development, you know, [21:25] like building these AI agents. Is it [21:27] worth, you know, you think these are [21:28] still going to be around? [21:30] >> Yeah. I mean, I don't I don't know [21:31] enough about AI agents to tell you that, [21:34] right? I think that like whenever [21:35] there's a new tech coming on, and this [21:37] happened with mobile, it happened with [21:39] cloud, happened with um you know the [21:42] internet itself, happened with like [21:44] React like there's like two paths, [21:46] right? You can either be kind of at the [21:48] forefront surfing that and like making [21:51] the investment in time and energy to [21:53] kind of be that local an expert of some [21:56] kind, right? You can be local to your [21:57] company. You can be like in your [21:58] community. You could be like worldwide [22:00] like but like staking claim to that. And [22:02] I've seen people create great careers [22:04] doing that. Then there's the people who [22:06] are like actually I'm going to be a [22:08] follower and I'm going to wait for [22:09] things to shake out which is a little [22:12] it's a different kind of risk, right? [22:13] because it's possible that you could [22:16] miss something that is good and you [22:20] won't be able to like stake your claim [22:22] as widely, right? If you're the [22:24] thousandth React developer, you're not [22:26] going to be as known as the second React [22:29] developer, but you also miss on things, [22:31] right? Like, so you might miss um [22:34] Ember.js or Meteor, right? which were [22:37] big big, you know, front-end frameworks [22:39] for a little while and then now I I [22:41] think they're still used, but like [22:42] they're definitely not winners. And so [22:44] if you're a world-class expert in Ember, [22:46] your options are a lot smaller and [22:49] you've invested all that time and effort [22:50] than if you're a world-class expert in [22:52] React. The thing I would say, and I, you [22:55] know, if someone came up to me and said, [22:56] "Hey, how can I avoid getting smacked [22:59] around by this bubble?" It's like be [23:01] close to the business, understand how to [23:03] solve problems, be a collaborator and um [23:08] you know and be aware of these [23:10] technologies. I don't think you need to [23:11] be an expert in them, but I think you [23:12] need to I mean listen to podcasts like [23:14] this one, right? and like be aware of [23:16] that, be aware of this kind of um stuff [23:20] so that when it gets to the point where [23:23] you're um you're not blindsided, but [23:27] being close to the business and like I [23:28] mean I honestly think that there will be [23:30] an idea of a developer 15 years from now [23:33] because taking people's wants and [23:35] desires and determining what's real and [23:37] what's what they will pay for and what [23:40] how it fits into complicated [23:42] technosocial systems like software like [23:45] big software uh projects that is not a [23:49] normal skill and that is a skill that [23:51] like I think developers are well suited [23:52] to like offer not not programmers you [23:55] notice I didn't use the term programmer [23:56] I said developers in my in my mind [23:58] >> thanks for the plug for this podcast [24:02] appreciate it uh extra boost let's go [24:05] back to authorization and uh dig a [24:08] little bit more into technical details [24:11] so when an agent needs to open a file or [24:15] an internal tool. In your mind, how is [24:19] the best way for it to prove that it has [24:21] permission? Is it sort of giving [24:24] a machine a broad security pass? Um or [24:29] do we think that the system needs to [24:31] evolve to adapt to um having a more [24:34] native agent ability within the system [24:38] um to have specific granular [24:40] permissions? I mean I think that [24:42] granular permissions are the way to go [24:44] for sure like and if you you know I [24:47] think that the two paths you can lay out [24:49] are like API keys and oath tokens right [24:52] or access tokens and I feel like to some [24:55] extent we talked about echoes of the [24:57] past like this whole AI making like [25:01] software like calling other software [25:04] services feels a lot like the API [25:07] landscape of like the 2010s and we've [25:09] been through that And I'm not saying [25:11] OOTH is perfect. I'm not saying bearer [25:13] tokens are perfect, but there's like a [25:14] lot of infrastructure around it. It's [25:16] kind of a well-known protocol. And so I [25:19] think that OOTH tokens properly [25:21] constrained with scopes and probably [25:24] fine grained access behind that rebback, [25:27] arbback, pback, we talked about that a [25:28] little bit, is probably the path [25:30] forward. I'll also say that's in kind of [25:32] production context. I think there's like [25:34] this idea of like non-prod context of [25:36] like your own laptop where you can yolo [25:39] things a lot more and I definitely have [25:42] read this was probably six months ago [25:44] where someone was just like I just gave [25:46] Cloud total access to my computer and it [25:48] can do whatever it want and everything's [25:50] under git control right you know and [25:52] pushed remotely so if it totally blows [25:55] things up I I don't care because I just [25:57] kind of fall back and then I can just [25:59] type whatever I want and and Claude kind [26:02] of can run wild and I would never do [26:04] that in production, but in nonprou, it [26:06] seems like it's a good way to build an [26:08] intuitive sense for like how this piece [26:10] of software, you know, interacts with [26:12] the environment it's in. [26:13] >> Makes sense. For fusion specifically, [26:16] how are you focused on identity right [26:19] now? And what are you planning in this [26:22] new wave of nonhuman users? Yeah. And I [26:26] I would say first of all that as we I [26:28] kind of mentioned earlier like there's a [26:30] ton of still like web apps that are like [26:32] you know Britney you said that like you [26:35] know how to like put Oser Roth into a [26:38] normal app and I totally agree that a [26:40] lot of folks do but there's a ton of [26:41] folks and I've been at conferences where [26:43] they're like yeah we still maintain our [26:44] own o system or we rolled our own. So [26:47] there's a lot of hate to be made just [26:48] from that perspective, right? But we are [26:52] an OOTH system [26:55] port some of the grants that I would [26:57] expect agents to use. Um I've been [26:59] playing with AWS agent core which is a [27:03] agent building framework that AWS is [27:06] going to be they just went in GA and [27:08] they're um going to be talking about a [27:10] lot of reinvent. I've been playing [27:11] around with that and that's all using [27:13] kind of client credentials grant for [27:15] OOTH or the authorization co-rant and [27:18] those are kind of client credentials is [27:20] good for when you have agents talking to [27:22] each other kind of that are independent [27:25] and then the authorization co-rand is [27:27] great when it's Dan who wants to give [27:30] delegate access to an agent to go update [27:33] his Google calendar or you know interact [27:36] with this other service as you know on [27:38] behalf of Dan. So the delegation [27:41] scenario. So I think that in I I don't [27:44] see right now any reason from the [27:46] identity and authorization space to kind [27:49] of reinvent the wheel. it feels like we [27:51] we should push OATH and and I mentioned [27:54] it was being brought up in the IETF like [27:56] there's definitely extensions coming [27:58] that are talking more about that aspect [28:00] of it but I think that there's no from [28:03] what I can see there's no reason to kind [28:06] of throw the entire thing out and kind [28:08] of start from the beginning again [28:10] because we have these building blocks [28:11] that work for software and work for [28:13] humans right now and as I mentioned [28:15] agents are kind of a mix and so I think [28:17] we can continue to push the OS [28:20] specification forward and and solve [28:21] these problems. [28:22] >> I am going to take some homework and [28:24] learn more about the OOTH spec. I uh I'm [28:27] I'm now very interested in more about [28:29] how that's implemented. [28:30] >> Yeah, [28:31] >> please. I can send you some articles if [28:34] if you want because I think there's [28:36] definitely some good content out there [28:38] that's talking about this in the general [28:40] sense and also in the context of of just [28:42] agents. [28:43] >> Yeah, that'd be great. And we can check [28:45] them out in the show notes, too. [28:47] >> Awesome. Well, this has been a [28:49] fascinating conversation and we always [28:51] end with a fun segment and today's fun [28:55] segment is inspired by this topic of [28:58] agents and you mentioned sub agents at [29:00] the beginning. Um, and for anyone who [29:04] hasn't worked with a sub agent, um, a [29:06] lot of them are defined with this like [29:08] specification file, which is basically [29:10] text that tells them you are I mean any [29:13] agent you kind of tell them this is what [29:15] you are, this is what you're good at, [29:17] and sort of like super boosting their [29:19] powers. So, I thought it would be fun to [29:22] think about if we were agents, what spec [29:27] files we would write for ourselves to [29:30] super boost our abilities. So, I can go [29:34] first. Um, [29:37] I would [29:40] I would do something around [29:43] communication and like writing because I [29:47] always think that's a really hard piece. [29:50] And I think specifically like asking [29:53] myself followon questions and like [29:57] understanding what other people would [29:59] ask or like what other people might [30:02] think about. So, you know, my spec file [30:04] might be something along the lines of [30:07] like generating different perspectives [30:10] and having like helpful sort of like [30:13] discussions, you know, sort of like a [30:15] set of rubber ducks that all have [30:18] different identities and can like ask me [30:20] different questions to make sure I'm [30:22] thinking through something fully. So, [30:24] that would be that would be my [30:26] superpower. Spec file. Britney, do you [30:28] want to go next? This is like an [30:29] incredibly introspective question [30:31] masquerading as something that is not. I [30:34] love this. I think that if I were to [30:37] have like a spec file or at least like a [30:39] desired trait basically that I would [30:41] write, it would be that I'm really good [30:43] at like following up with people and [30:46] like keeping in touch with people. I [30:48] feel like that's a skill that I'm not [30:49] super good at uh and would like to get [30:52] better at. So, I'd be an expert in [30:55] friendship or something like that. [30:59] Really good at, you know, keeping up [31:01] with the folks that I already know and [31:02] like building those stronger ties. Dan, [31:05] do you want to go next? [31:06] >> Interesting. Yeah. Wow. I feel like we [31:08] could have an entire podcast about this [31:10] this this uh question. Um, and the one [31:14] thing that this is kind of off topic, [31:16] but like it almost sounds like a spec [31:19] file or a skills file is like a mantra [31:22] for the agent in something that like [31:25] repeats to itself and like becomes [31:26] better at. So I'm like, oh, is that like [31:30] mean the reverse is true for us? like my [31:32] anyway um mine would be my entire life [31:35] I've been my entire adult life beliefs [31:39] has been driven by my my desire and lack [31:42] of fear and willingness to ask good [31:45] questions and importantly I think listen [31:49] to the answers and as I've gotten older [31:51] I think I have a little more nuance [31:53] about when the right time to ask the [31:55] questions is so I'd kind of add that in [31:56] too but I also would say that I think [31:58] each of these spec files comes with a [32:00] license and is going to be GPL licensed [32:03] so that it infects other people with the [32:04] same skill to like ask good questions [32:06] and listen to the answers. [32:07] >> Well, thank you both for going with me [32:09] on that journey of introspection. I know [32:12] it was it was a little metup [32:15] feels fun to think about. Well, thank [32:17] you again Dion for joining us. If people [32:20] want to find you, where can they uh look [32:22] you up? [32:23] >> Sure. Yeah. So, I'm on LinkedIn more. m [32:27] o r e ds or danorboulder will pop me up [32:31] or blue sky is the other place that I [32:33] hang out and talk a lot and that's [32:35] mords.com is my profile name and then if [32:38] you want to learn more about fusionoth [32:40] or I also write on the blog there a lot [32:42] it's fusion.io O and uh would love to [32:45] connect with anybody on social. Know [32:47] people always say this, but I'm happy to [32:49] hear from anybody who is discovered me [32:52] or my thoughts through the Overcommitted [32:55] podcast. Happy to connect. [32:57] >> Well, thank you listeners so much for [32:59] tuning in to Overcommitted. If you like [33:01] what you hear, please do follow, [33:02] subscribe, or do whatever it is you like [33:04] to do on the podcast app of your choice. [33:07] Check us out on Blue Sky and share with [33:09] your friends. Until next time, goodbye.  ## 📺 Video ![](https://www.youtube.com/watch?v=JegPm8zxyhg) --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=JegPm8zxyhg)* **[00:00]** Welcome to the Overcommitted Podcast, [music] your weekly dose of real engineering conversations. I am your host today, Erica, and I [music] am joined by Hey, I'm Britney Ell. We met while working on a team at GitHub and quickly realized we were obsessed with getting better at what we do. So, we decided to start this podcast to share what we've learned. We'll be talking about everything from leveling up your technical skills to navigating your professional development. All with the goal of creating a community where engineers can learn and connect. Today **[00:33]** we are not just talking about securing users. We are talking about securing autonomous code that they control through AI agents. Specifically, as these agents move into our enterprise systems, we're asking the fundamental questions of who are you and what are you allowed to do? And these become huge challenges for our security stack. So to help us navigate this critical shift, we are bringing in an undisputed expert in **[01:03]** identity and authentication, Dan Moore, who is the senior director of CIAM strategy and identity standards at Fusion O. We will be discussing what current identity protocols are being challenged by the rise of agents and what new standards are emerging to give autonomous coding agents a more secure, verifiable and official identity. So Dan, welcome to the show. Let's talk about this evolving landscape of **[01:34]** identity. Feel free to introduce yourself. Say hi. >> Sure. Yeah. Yeah. Hey, thank you so much for having me, Britney Erica. I am thrilled to be here. Um, and the short answer about who I am is I've just been in the developer world for about 25 years. Played a lot of different roles. My current role, as you mentioned, is is at Fusion. We're an authentication provider. We are really focused on customer authentication, but as you alluded to, a big part of that, at least in the last year or two, has been well, **[02:04]** what's um, you know, agents? I know we're going to kind of dig into kind of what that is, but um we are extremely interested in kind of helping people secure their systems uh for users as well as for agents. >> Well, yeah, you teed it up perfectly. Let's start there. When we talk about AI agents, what exactly are we talking about? Is it just a fancy name for a piece of software or is it something different? And do we even have a **[02:35]** definition? Yeah, I think it's a great question because I think the honest truth is that people are there are definitely people out there using AI agents to accomplish tasks to get stuff done, especially in the coding realm, but also outside of the coding realm. But I think that we're still kind of groping our way towards an actual real definition of of something. But the way I think about it, and this came up in a conversation the other day, is it's really like a workflow or a set of pieces of software that can like **[03:06]** accomplish workflows, which we've had for decades, right? Workflow software has been around for a long time. The difference is that the workflow used to be defined in code or in static configuration, and now it's more in natural language. And so the idea you can actually kind of give an agent a task in relatively natural language and have it not to overuse the word grope but grope towards accomplishing it which is what they do is to some extent a game changer. Well, so yeah, when this piece **[03:36]** of code does start making decisions on its own, um how does that change some of these security risks that we face? And what are the biggest things that um we need to worry about when it's an agent authenticating um or authorizing authorizing versus a human? >> Sure. And I will say it is worth taking a step back and saying the security problems that these new agents create are similar. Boy, maybe they're a little **[04:08]** bit different in in scope, but like they're similar to the security problems that we have right now, right? Because there's plenty of plenty of security holes that humans drive through that agents are going to also be able to kind of attack or exploit. You know, I guess I I just want to say before people get all concerned about securing AI agents, they should be like, "Hey, what are we doing to follow all the rules and all the things that we should do to secure, you know, stuff." Anyway, so set set that aside. The way I think about it is that human beings are slow and **[04:38]** non-deterministic and software as written, you know, 5 years ago, 10 years ago, even the vast majority of software right now is fast and relatively deterministic, right? Charity majors might have some issues about that how deterministic it is, but it's pretty deterministic and easy to reason about. Whereas agents kind of fall in this middle ground and so they are fast and non-deterministic. So um so there's this great thing called the lethal trifecta which Simon Willis who's written a ton about AI and LMS in general talks about **[05:09]** and the idea is that agents have access to private data which again software does too. It's exposure to untrusted content which again software does too. And then there's the ability externally communicate. And so the issue is that because agents are non-deterministic and because they read that untrusted content, they can then be instructed to access your private data and then send it off in an email. And this is a real I mean I would consider this to be a new threat because um because of the ability **[05:40]** to follow like arbitrary instructions, right? Like if a piece of code got an arbitrary instruction, it didn't understand. I should be careful here. There are ways to craft it, but it's a much higher bar to like make a deterministic piece of software do stuff it's not supposed to do. Whereas with agents, they found over and over again, it's relatively easy to do that. Those are kind of the bigger changes that I see coming down the pike is how can we address this? I mean, the non-inerminism is the joy and the pain of agents, right? Like the fact that we can like **[06:10]** give it something and as I mentioned earlier can kind of maneuver away its way towards achieving a goal is a huge win. But that also means that other people who can communicate with it can do the same thing and kind of bend the agent away from the goal that we set it >> and non-deterministic in this case meaning can you like sort of define that with >> sure what you mean there? >> Yeah. Yeah. Yeah. It's a great um sorry I shouldn't uh I work in the office space and like using jargon is something **[06:41]** that like I try not to do because it's so easy to kind of get over your skis um and assume kind of everyone knows uh what you know but that's a great call out. So nondeterministic in my mind means that or sorry let's start with deterministic. Deterministic is you give the same inputs and you get the same output. So math is a perfect example of the deterministic system. gravity to some extent is too, right? Whereas non-deterministic means you give it the same inputs and you not won't necessarily give the same outputs. **[07:12]** Whether human society, conversations with your partner, like these are all things that are non-deterministic because they're affected by the current state of things. And so if you've ever asked the same question of an LLM, you're going to get back slight. I mean, here's the thing, like they're they're slightly different, right? or they could be kind of massively different depending on on um the the the way that well I should be careful there because I'm definitely not an LLM like create **[07:42]** creation expert so but it at the end of the day it's it's not a system where you put in the same thing and you get the same thing out. >> Makes sense. Um, yeah. So, you're saying that that creates scenarios where it's unpredictable how they might act in different scenarios, >> especially with untrusted input, right? Like that's where it gets really kind of scary. And the honest truth is, unfortunately, we think about untrusted input as something an attacker provides, but it could also be we make a mistake, **[08:13]** right? Like we fat finger something or we um aren't as clear in our intent as as we want to be. And that's all input that like you aren't sure how things are going to go. And that's a new kind of security threat model. >> And yeah, it I guess it like there's there's different boundaries where this can be be dangerous like within your own system is one thing and then sort of like crossing system boundaries too. There's the question of like how much **[08:44]** context, how much data gets like carried across from one system to another and you're talking about like privacy like you know how do I authorize this context versus something else. Yeah, I think actually that points to one of the solutions to this is that you start to have these kind of sub aents that you know may have access like I mean one way to deal with that lethal ultra effect I mentioned is that like you have different agents that have access to different sets of tools or different **[09:14]** sets of data and if you have one that can read your email and another that can send your email it's going to be really hard for an attacker to be able to kind of get uh that email, you know, that private data is sent off because you have to like basically now attack two different LLMs. So, kind of more separation concerns, which again, this is not software um it's not revolutionary, right? It's a lot of the same principles. We're just having to apply it in new context, right? Separation concerns is a great **[09:45]** thing for security, >> right? Yeah. Going back to your point where the best practices for human authorization is the same idea for like agentic authorization like you don't want to give a human the keys to everything across all system boundaries. We try to enforce data protection and David privacy and minimum required access controls. Same rules apply for agentic identities as well. **[10:15]** >> Yep. >> This is very fascinating. I don't personally work on the identity side at all. So, I'm just a software engineer and I just want to know like what do I need to do to keep these things working and not exposing anybody to problems? But I'm curious, I do work on the enterprise side and I'm curious what you're seeing right now in terms of enterprise adoption of agents. Are there any like specific business or administrative problems associated with with, you know, that companies are experiencing or butdding up against when they want to use agents? >> Sure. I mean, I guess I would say that **[10:47]** like first of all, it feels like there's a ton of people there experimenting with this stuff and I think there's definitely a feeling that there's a there there. I think that I've not seen some really large public like case studies where people are like successful with this. And I don't know whether that's because it's harder to be successful with or because the people who are successful are are keeping their lips shut because it's like a big competitive advantage. You know, you definitely hear about uh people doing this around coding. I definitely have interviewed people that are doing **[11:18]** spectriven development and finding that to be very successful. It's kind of a oneperson show, which obviously is kind of the opposite of an enterprise, which actually speaks to I think one of the complexities is I feel like when you're doing green field development, agents are an amazing productivity boost. Whereas when you're doing brownfield development or improving existing software, suddenly there's a whole lot more context that needs to be available to the agent for it to make intelligent suggestions and it's less of a it's less **[11:49]** fun, right? Or maybe it's less that's the wrong word. Fun is something that human beings think about green field development. It's less capable might be a good way to put it. But I think that around your specific question on enterprises, anything that is doing text evaluation, we talked to somebody recently who is doing like extraction of form fields, you know, a lot of document management stuff. I think AI is is a good fit for, you know, as far as kind of pure agent stuff. Like the honest truth is I feel like there's a lot more smoke **[12:20]** than there is fire right now. Oh, there's a lot of people who are like building out all these agent systems and then you ask them like hey I shouldn't say a lot of people I'm familiar with a couple people who've built out some agentic systems and you're like this is cool like who's using this and they're like well I am to build other products and you're like that's great right and that that is a definitely use case but it's not like the enterprises are like pulling people in and like saying hey we need to do this now one thing I have heard is that having a natural language interface of an LLM into data **[12:51]** uh and into documentation is very powerful for improving the knowledge worker experience. But I don't know if I would call those agents, right? That's like more just like a more natural language interface. >> Yeah, that makes sense. Are there any like standards or is like the industry approaching any sort of way to make sure that these are actually secure? I mean, I feel like you said that there's not a lot of people doing this yet, but there's lots of like concepts of plans towards doing it. I'm curious this like is there anything that the industry as a **[13:21]** whole is saying like okay this is a way that we can trust securing agents. >> Sure. So you actually kind of asked two different questions which are there standards and are we converging? I think that like there are 100% standards. I just went to the IETF meeting in Montreal and there was I think AI was mentioned in every single meeting I went to and I went to most of the web stuff. I didn't go to like the telefony stuff, but like there was an agent draft mentioned there I I think in every single meeting I went to, but I think **[13:53]** it's all still early early days. And so they're trying to solve in some cases they're trying to like think of agent identity as a workload identity, right? So there's the whimsy group. Um there's a draft from Aaron Perki who's an octag guy who's talking about cross trust boundary authentication. I feel like there's a there's two kind of main ways that agents communicate. There's the agent to agent protocol which basically **[14:23]** has um a lot of different it it's kind of a pick your flavor kind of protocol when it comes to identity and then there's MCP which is model context protocol and that seems to have been kind of standardized on OOTH uh for the majority of kind of enterprisy use cases. Um so there's a lot of activity in the OOTH working group around some of the kind of follow on standards around that like how to make it easier for um MCP clients which essentially are like **[14:54]** IDs or um other kind of AI agents to register with an authorization server and then like what goes in the token. But to me, a lot of this comes back down to what we talked about earlier, which is doing stuff that we know is good practice, which is like principal lease privilege. It's sophisticated authorization schemes maybe past arbback, right? Once you get a certain size like rebback or aback or pback and the nice thing about implementing those is that helps you whether you're **[15:25]** implementing for agents or you're implementing for users at scale. And I still think that those are underappreciated and underimplemented, but maybe AI agents will be a catalyst for kind of pushing more people to to handle that. >> Yeah, it kind of seems like the average developer needs to know a little bit more about about security and not than they ever really needed to before at least right now until there's like, you know, an idea around like the right way to do this because people are still trying to figure it out. What would you re >> actually can I ask you real quick? I mean so so when you say that like do you **[15:57]** mean because they're using AI agents and so they need to have some consciousness of about that or because they're building software that will be used by an AI agent or why do you think develop why do you think now is the time for because I mean security people have been like developers need to know about security for you know shift left and like you know for a long time so why is now why is it more important now in your opinion >> sense I think that there's like more out of the box options for regular O than there is for AI **[16:27]** agents where like I would never do it. I would never roll my own and figure out how to do this for like any website that I create. But if I'm creating some sort of an AI agent, like it doesn't sound like there's like a thing that exists yet that I can say like, okay, this is going to cover a lot of the security concerns. >> I mean, that makes sense. And I think some of that's because it's early days and some of it's because >> the protocols are still being like hammered out, right? like um the MCP spec. There's a new release coming in 11 days and it's going to have some shifts **[16:58]** even in in how you do kind of OOTH for MCP clients. Um and that's like you know it's only been out for a year and there's already been like multiple different ways to do stuff. So that makes sense. Thank you. I think also like an awareness that this standardization is like still forming is also important because I mean I guess there's like the whole legal side of things where like that isn't even figured out yet necessarily of like if I **[17:31]** um like if I direct an agent towards a certain goal and it takes nefarious actions to get there, am I responsible? And like I don't know as a like we're mentioning like what you know the risks are as a developer like why you might need to know like you know as a developer knowing like hey somebody potentially like promises me this agentic workflow that's going to like solve all my problems like okay well like you know both eyes open like look **[18:04]** at what it's actually doing like understand that you know this this like identity and authorization piece might not necessarily be a completely solved problem yet. So like if somebody's promising you like you know all the guardrails are there and like don't worry about it like maybe question that maybe look at it twice before you like again like kind of authorize it to do something that you wouldn't want to be responsible for. >> Yeah, that that's a great point. like there is a little bit of wild west feel **[18:36]** to a large chunk of this, you know, right now. And just like I think I mean I'm trying to think of like an analogous situation. I honestly probably is a little bit like the early internet, right? When people weren't sure like what to do about credit cards or could you even pay with a uh something over uh the internet with a credit card and developers to Britney's point need to be a lot more like cognizant of that kind of stuff. Now it's a lot more accepted. So there's, you know, you don't even think about that kind of thing. But **[19:06]** we're in back in the early days, which is which is exciting and scary and spooky all at the same time. >> I feel like I'm hearing that um that crossover and overlap a lot in a lot of different spaces right now. Like everybody's like this feels like the dot bubble, you know, not just in terms of what's coming out, but like economically and like, you know, just the vibes that we're getting. And it's going to be interesting because I think uh you know obviously we're still using the internet even though it at the time I would imagine it probably felt like we were you know not going to for a while. So **[19:38]** >> yeah I think people always knew that it was going to be big. I don't think people like knew exactly how in-depth it would get into our lives. But I don't think anyone after even like 99 2002 when it was like the depths of the nuclear winter people weren't like I'm never going to use the internet again. It was just too easy to do things. So um you know and I think that is exactly analogous here is like there's no doubt in my mind in 5 years from now we'll be using Gen AI in some form right like **[20:11]** what it actually looks like I don't know what's the Google maps of Gen AI. You all are too too young to remember Google Maps, but it was it was amazing when it came out. You're like, "Oh my god, I can scroll around and like and it blew my mind and it's not it came out of Ajax and it came out of the early internet, but like it was not something that like any anyone people had to invent it. So like what are the things that people are going to invent with AI?" Sorry, we're kind of far a field from authorization and identity, but you know, I I I don't want to be like an old man shaking my **[20:41]** fist on the lawn, but I I feel like we are going to have those kind of moments again uh in the next couple years. >> Yeah. Yeah, I agree with that. I uh is there so before we go back to the authorization space I'm curious you having had the experience of living through that time is there anything that you're telling developers right now like things to do for their career to like you know bubble prevent themselves or anything like that to like is this I mean obviously these geni skills aren't going to be completely useless cuz like you said we're probably still going to be using it. I'm not going back to the time where I had to write tests myself **[21:13]** um like that's that's just not happening. So I feel like there's still going to be something that's around. So, are these skills still worth investing in in your opinion? >> AI skills or what skills I'd recommend? >> AI skills, AI development, you know, like building these AI agents. Is it worth, you know, you think these are still going to be around? >> Yeah. I mean, I don't I don't know enough about AI agents to tell you that, right? I think that like whenever there's a new tech coming on, and this happened with mobile, it happened with cloud, happened with um you know the internet itself, happened with like **[21:44]** React like there's like two paths, right? You can either be kind of at the forefront surfing that and like making the investment in time and energy to kind of be that local an expert of some kind, right? You can be local to your company. You can be like in your community. You could be like worldwide like but like staking claim to that. And I've seen people create great careers doing that. Then there's the people who are like actually I'm going to be a follower and I'm going to wait for things to shake out which is a little it's a different kind of risk, right? because it's possible that you could **[22:16]** miss something that is good and you won't be able to like stake your claim as widely, right? If you're the thousandth React developer, you're not going to be as known as the second React developer, but you also miss on things, right? Like, so you might miss um Ember.js or Meteor, right? which were big big, you know, front-end frameworks for a little while and then now I I think they're still used, but like they're definitely not winners. And so if you're a world-class expert in Ember, **[22:46]** your options are a lot smaller and you've invested all that time and effort than if you're a world-class expert in React. The thing I would say, and I, you know, if someone came up to me and said, "Hey, how can I avoid getting smacked around by this bubble?" It's like be close to the business, understand how to solve problems, be a collaborator and um you know and be aware of these technologies. I don't think you need to be an expert in them, but I think you need to I mean listen to podcasts like this one, right? and like be aware of that, be aware of this kind of um stuff **[23:20]** so that when it gets to the point where you're um you're not blindsided, but being close to the business and like I mean I honestly think that there will be an idea of a developer 15 years from now because taking people's wants and desires and determining what's real and what's what they will pay for and what how it fits into complicated technosocial systems like software like big software uh projects that is not a normal skill and that is a skill that **[23:51]** like I think developers are well suited to like offer not not programmers you notice I didn't use the term programmer I said developers in my in my mind >> thanks for the plug for this podcast [laughter] appreciate it uh extra boost let's go back to authorization and uh dig a little bit more into technical details so when an agent needs to open a file or an internal tool. In your mind, how is the best way for it to prove that **[24:21]** it has permission? Is it sort of giving a machine a broad security pass? Um or do we think that the system needs to evolve to adapt to um having a more native agent ability within the system um to have specific granular permissions? I mean I think that granular permissions are the way to go for sure like and if you you know I think that the two paths you can lay out are like API keys and oath tokens right **[24:52]** or access tokens and I feel like to some extent we talked about echoes of the past like this whole AI making like software like calling other software services feels a lot like the API landscape of like the 2010s and we've been through that And I'm not saying OOTH is perfect. I'm not saying bearer tokens are perfect, but there's like a lot of infrastructure around it. It's kind of a well-known protocol. And so I think that OOTH tokens properly constrained with scopes and probably **[25:24]** fine grained access behind that rebback, arbback, pback, we talked about that a little bit, is probably the path forward. I'll also say that's in kind of production context. I think there's like this idea of like non-prod context of like your own laptop where you can yolo things a lot more and I definitely have read this was probably six months ago where someone was just like I just gave Cloud total access to my computer and it can do whatever it want and everything's under git control right you know and pushed remotely so if it totally blows **[25:55]** things up I I don't care because I just kind of fall back and then I can just type whatever I want and and Claude kind of can run wild and I would never do that in production, but in nonprou, it seems like it's a good way to build an intuitive sense for like how this piece of software, you know, interacts with the environment it's in. >> Makes sense. For fusion specifically, how are you focused on identity right now? And what are you planning in this new wave of nonhuman users? Yeah. And I **[26:26]** I would say first of all that as we I kind of mentioned earlier like there's a ton of still like web apps that are like you know Britney you said that like you know how to like put Oser Roth into a normal app and I totally agree that a lot of folks do but there's a ton of folks and I've been at conferences where they're like yeah we still maintain our own o system or we rolled our own. So there's a lot of hate to be made just from that perspective, right? But we are an OOTH system port some of the grants that I would **[26:57]** expect agents to use. Um I've been playing with AWS agent core which is a agent building framework that AWS is going to be they just went in GA and they're um going to be talking about a lot of reinvent. I've been playing around with that and that's all using kind of client credentials grant for OOTH or the authorization co-rant and those are kind of client credentials is good for when you have agents talking to each other kind of that are independent and then the authorization co-rand is great when it's Dan who wants to give **[27:30]** delegate access to an agent to go update his Google calendar or you know interact with this other service as you know on behalf of Dan. So the delegation scenario. So I think that in I I don't see right now any reason from the identity and authorization space to kind of reinvent the wheel. it feels like we we should push OATH and and I mentioned it was being brought up in the IETF like there's definitely extensions coming that are talking more about that aspect **[28:00]** of it but I think that there's no from what I can see there's no reason to kind of throw the entire thing out and kind of start from the beginning again because we have these building blocks that work for software and work for humans right now and as I mentioned agents are kind of a mix and so I think we can continue to push the OS specification forward and and solve these problems. >> I am going to take some homework and learn more about the OOTH spec. I uh I'm I'm now very interested in more about how that's implemented. **[28:30]** >> Yeah, >> please. I can send you some articles if if you want because I think there's definitely some good content out there that's talking about this in the general sense and also in the context of of just agents. >> Yeah, that'd be great. And we can check them out in the show notes, too. >> Awesome. Well, this has been a fascinating conversation and we always end with a fun segment and today's fun segment is inspired by this topic of agents and you mentioned sub agents at the beginning. Um, and for anyone who **[29:04]** hasn't worked with a sub agent, um, a lot of them are defined with this like specification file, which is basically text that tells them you are I mean any agent you kind of tell them this is what you are, this is what you're good at, and sort of like super boosting their powers. So, I thought it would be fun to think about if we were agents, what spec files we would write for ourselves to super boost our abilities. So, I can go **[29:34]** first. Um, I would do something around communication and like writing because I always think that's a really hard piece. And I think specifically like asking myself followon questions and like understanding what other people would ask or like what other people might think about. So, you know, my spec file **[30:04]** might be something along the lines of like generating different perspectives and having like helpful sort of like discussions, you know, sort of like a set of rubber ducks that all have different identities and can like ask me different questions to make sure I'm thinking through something fully. So, that would be that would be my superpower. Spec file. Britney, do you want to go next? This is like an incredibly introspective question masquerading [laughter] as something that is not. I love this. I think that **[30:36]** if I were to have like a spec file or at least like a desired trait basically that I would write, it would be that I'm really good at like following up with people and like keeping in touch with people. I feel like that's a skill that I'm not super good at uh and would like to get better at. So, I'd be an expert in friendship [laughter] or something like that. Really good at, you know, keeping up with the folks that I already know and like building those stronger ties. Dan, do you want to go next? **[31:06]** >> Interesting. Yeah. Wow. I feel like we could have an entire podcast about this this this uh question. Um, and the one thing that this is kind of off topic, but like it almost sounds like a spec file or a skills file is like a mantra for the agent in something that like repeats to itself and like becomes better at. So I'm like, oh, is that like mean the reverse is true for us? like my anyway um mine would be my entire life I've been my entire adult life beliefs **[31:39]** has been driven by my my desire and lack of fear and willingness to ask good questions and importantly I think listen to the answers and as I've gotten older I think I have a little more nuance about when the right time to ask the questions is so I'd kind of add that in too but I also would say that I think each of these spec files comes with a license and is going to be GPL licensed so that it infects other people with the same skill to like ask good questions and listen to the answers. >> Well, thank you both for going with me **[32:09]** on that journey of introspection. I know it was it was a little metup [gasps] feels fun to think about. Well, thank you again Dion for joining us. If people want to find you, where can they uh look you up? >> Sure. Yeah. So, I'm on LinkedIn more. m o r e ds or danorboulder will pop me up or blue sky is the other place that I hang out and talk a lot and that's mords.com is my profile name and then if you want to learn more about fusionoth **[32:40]** or I also write on the blog there a lot it's fusion.io O and uh would love to connect with anybody on social. Know people always say this, but I'm happy to hear from anybody who is discovered me or my thoughts through the Overcommitted podcast. Happy to connect. >> Well, thank you listeners so much for tuning [music] in to Overcommitted. If you like what you hear, please do follow, subscribe, or do whatever it is you like to do on the podcast [music] app of your choice. Check us out on Blue Sky and share with your friends. Until **[33:10]** next time, goodbye.