Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard

This post details the 'lethal trifecta' of risks associated with AI agents having standing API keys and administrator credentials: access to private data, exposure to untrusted tickets, and the ability to communicate externally. It proposes solutions centered around delegated authorization, specifically using OAuth token exchange to carry user identity through the agent and MCP server. A security token service evaluates policy and issues short-lived, scoped credentials. The talk also contrasts intent-based authorization (as a proposal) with task-based policy, demonstrating how customer data access and database deletion can be denied, certificate renewal allowed, and server restarts blocked based on user role and explicit authorization, even after a human approval, thereby keeping authorization distinct from the correctness of an agent's answer.