# Better Agent Auth — Bereket Habtemeskel & Paola Estefania, Better Auth AI Engineer · 2026-07-21 Paola Estefania of Better Auth presents Agent Auth, a protocol giving AI agents their own identity and fine-grained capabilities instead of impersonating users. She argues agents need principal-level security: discovery via a directory, authorization with scoped capabilities (e.g., read vs. send email), and identity through per-agent private keys for audit trails and revocation. A live demo shows an MCP-connected agent reading Gmail, requesting send-email permission, and being revoked mid-action. The protocol, now an open draft with a Better Auth plugin, treats agents as principals — contrasting with OAuth scopes and AI gateways that lack per-agent identity. Paola invites contributions, especially for enterprise IAM-style policies. ## Questions this episode answers ### What is the Agent Auth protocol and how does it improve security for AI agents? Paola Estefania explains that Agent Auth is a protocol that gives agents their own identity, fine-grained capabilities, and discovery, instead of using user credentials. She likens it to hiring an employee: you don't give them the CEO's credentials, but assign scoped authority. This prevents agents from having unrestricted access and enables audit trails, revocation, and safer delegation. The goal is to stop agents from "pretending to be you" and instead "acting for you within limits." [8:47](https://aie.addtry.com/bd30cf4d-2c8a-4323-b042-488b8bb8dec6?t=527000) ### What are capabilities in Agent Auth and how are they different from traditional OAuth scopes? Paola Estefania explains that capabilities are fine-grained permissions that describe specific actions an agent can perform, such as "list emails" or "send email," rather than broad scopes like "read." This allows precise control: you can grant an agent read-only access or restrict it to certain operations. Capabilities are mapped from service endpoints (e.g., via OpenAPI specs) and listed in a directory, letting agents discover what they can do and users grant only what’s needed. [9:26](https://aie.addtry.com/bd30cf4d-2c8a-4323-b042-488b8bb8dec6?t=566000) ### How does the Agent Auth protocol give agents their own identity and allow traceability? Paola Estefania says each agent gets a private key and its own identity, becoming a principal actor rather than hiding behind a user. This enables minting tokens signed by the agent, so audit logs show exactly which agent acted on behalf of which user. Admins can then trace actions to a specific agent, and if an agent misbehaves, they can revoke its access individually, rather than disconnecting entire services. It brings enterprise-style IAM to AI agents. [7:23](https://aie.addtry.com/bd30cf4d-2c8a-4323-b042-488b8bb8dec6?t=443000) ### How can I try out Agent Auth today, and does it require using Better Auth? Paola Estefania demonstrates that you can try Agent Auth via the Agent Auth protocol website, using their directory and MCP server. You log in, connect services like Gmail, and the agent requests capabilities through a device-flow approval. It works with any framework—Better Auth is not required; the plugin is just one implementation. The SDK and server-side verification are available, and you can contribute to the open-source project for further development, including pending Python, Rust, and Go SDKs. [23:07](https://aie.addtry.com/bd30cf4d-2c8a-4323-b042-488b8bb8dec6?t=1387000) ## Key moments - **[0:00] Intro** - **[0:59] The Problem** - [1:18] Paola Estefania asks how many attendees give AI agents access to Gmail or calendar—far fewer hands go up than those who use agents daily. - [1:52] “When we give agents our credentials, we're having them act on our behalf but pretend to be us.” - [2:12] Q: Is it a good idea for agents to pretend to be us? — “Not a great idea,” says an attendee. - [2:30] Paola Estefania: We are in the same security awakening with AI agents as when the internet first became public and everyone realized data was exposed. - [2:50] Paola Estefania introduces the 'hire your agent' analogy: when you hire a person, you give them their own access, not the CEO’s credentials. - **[4:28] Discovery** - [4:50] Three core problems for agent security: how agents discover what they can do, how to authorize them with fine-grained permissions, and how to trace their actions back to an identity. - **[6:39] Authorization** - [7:02] Agent discovery should work like a phone book: agents look up a directory to find available capabilities and how to call them. - [9:05] Using capabilities instead of broad OAuth scopes allows granting permission to specific actions, like reading but not deleting emails. - [10:23] Agent Auth proposes a well-known endpoint, similar to OIDC’s .well-known, where agents can discover how to interact with a service. - [11:56] Until services implement Agent Auth, OpenAPI specs can be translated into capabilities, acting as a middleware for agent discovery. - [14:00] The Agent Auth directory lists capabilities like Gmail’s 20 endpoints, giving agents a phone book of what they can do. - **[17:24] Identity** - [18:00] Agent Auth gives every agent its own private key, enabling it to sign its own tokens and act as a distinct principal. - [18:30] Agent Auth shifts the paradigm from agents hiding behind a user to agents acting as principals with their own identity, visible in logs. - [19:10] Q: If an agent deletes a database, can you revoke its access? — Yes, you can revoke the agent’s identity, terminating its access. - [19:50] Q: How do you trace which human was behind an agent’s destructive action? — The agent’s token always links back to the user, so audit logs show both agent and user. - [21:20] Agent Auth introduces the concept of a 'host'—the execution environment like Claude or Cursor—which can also be authorized or revoked. - **[22:02] Protocol** - **[23:07] Live Demo** - [25:00] In a live demo, an agent uses the Agent Auth MCP to request read access to Gmail, and the user approves via device flow. - [26:40] After reading an email, the Agent Auth dashboard shows the agent’s ID, host, user, and action, proving traceability. - [27:40] When the agent tries to send an email, it must request a new capability because the default host policy only grants read access. - [29:10] After revoking the agent’s access, the agent can no longer read emails and must create a new identity to regain read capability. - [32:00] Q: Can capabilities include time periods or maximum execution time? — Yes, you can set constraints like time limits in the capabilities. - [32:40] Q: Does Agent Auth shift human-in-the-loop enforcement to the proxy or MCP server? — You can have both; the goal is to balance security and UX by allowing some actions without constant approval. - **[37:05] Wrap-up** - [38:10] Q: Is Agent Auth related to the AAuth protocol on the IAM track? — No, they are different; Agent Auth treats agents as principals with identity. - [39:00] Q: How is Agent Auth different from AI gateway? — AI gateway doesn’t provide agent identity; Agent Auth gives each agent a principal identity for traceability. - [40:05] “Stop giving credentials to our agents. We need to give them authority.” ## Speakers - **Paola Estefania** (guest) ## Topics Agent Identity & Access Management ## Mentioned Better Auth (company), Agent Auth (product), Gmail (product), MCP (product) ## Transcript ### Intro **Paola Estefania** [0:13] Well, hello everyone. Can you hear me all okay? Yes? Perfect. Well, welcome to our talk—our workshop, actually. Um, I know maybe you were expecting Bereket also; he couldn't come, but we made this workshop together for you. Okay? So, as you see, you have the QR code; you can go ahead and go there. It's, um, our page for Agent Auth protocol, so that you have it and I don't have to spell it for you. Um, okay, so my whole idea today is instead of, like, me telling you stuff and you do this and show you how to do stuff, I want us to take one hour, at least, to think about Agent Security, Agent Auth. ### The Problem **Paola Estefania** [0:59] Because sometimes we're excited about, like, this new AI era,right? But we never think about—or maybe yes, but not as much as I wished. What happens when you, for example, say, "Hey agents, what are my—maybe my schedule for tomorrow? What are—send an email." Have you ever thought of this? How many of you, like, raise your hand? Like, how many of you use AI agents every day? Okay, higher! Don't be shy. Okay, great. How many of you give them access to your Gmail, to your calendar, to your personal accounts? How many of you? Oh, so much less. Okay. The ones that do, like, what do you do with it? Like, you connect an MCP server. Okay, yes. And you have another one. Good. Maybe you connect, like, your personal token to, like, .m endpoint. Okay. So what happens when we do this? We're actually doing it like the agents are acting on behalf of us, but pretending to be us. So do you think that's a good idea? Yes or no? Who thinks that's a good idea? **Guest** [2:12] Not a great idea. **Paola Estefania** [2:13] Not a great idea. Why? **Guest** [2:16] I want to go around and use your identity to do things with my own money. **Paola Estefania** [2:21] Exactly. And why we didn't think about this, like, before. Okay, so it doesn't matter. Here we are. We're thinking about it. I always remember, uh, the time, like, when the internet came. Like, I'm old, almost 40, so I remember. And everybody was so happy about it. But then I started to question, like, okay, everything, the whole data is public. It's like, we're in the same moment today,right? Like, we're really excited about AI, and then after, we start to think about security. But it's good. So why I put there "hire your agent." The analogy I want you to think about: let's say you have a company or are part of a company, and you hire someone. Do you give them—you need them to have access to things of the company,right? So what do you do with these people when you join? Or when you join, what do they give to you? You have your own email,right? Your own access, your own credentials. So if you think about it in the agent world, what are we doing without agents? We are—it's like we are doing, like, the CEO credentials,right? You never say, "Okay, this is the credentials of the CEO. Go and read the email." No. Because everything, anything could happen. This is the same. The idea will be "hire your agent," in a sense of give them your agent's authority instead of your credentials. Do you think it's a good idea? How? Yes or no? Okay. My idea is, like, I know sometimes, um, we could be shy, but I want—I think it would be nice, like, if we can interact a bit. Because it's a moment that, thanks to Agent Auth and all of us being here all of your time, we can get together and think about something. I think it's not common,right? So make 100% of it. Um, okay, great. So did you all get the page there? The QR code? Yeah? Great. So remember, like, my idea of saying, "Okay, agents read my emails,"right? Have you ever thought, like, how the agent gets to there? How it gets to your email? First of all, how do agents know what they can do? ### Discovery **Paola Estefania** [4:38] Huh? **Guest** [4:41] Description. Like, uh, if the topic follows the box, what it's supposed to do. **Paola Estefania** [4:46] Okay, great. So you do it by hand,right? It's not something automatic. **Guest** [4:51] No. So the agent can learn the description. **Paola Estefania** [4:54] Yes. Exactly. But exactly. But somehow. Huh? **Guest** [5:01] Context window. **Paola Estefania** [5:02] Exactly. Context window also, too. But you always somehow connected something to the agent, like, "Okay, this is what you can do." Right? So what if we have, like, an ideal world, or an agent can go to maybe a directory and say, "Oh, this is the whole thing I can do. And this is all the things I can execute." That would be the smartest idea,right? Have you ever used a phone book? Yeah,right? It's the same. Like, who I can call. So I go and look in the phone book. And there I have how to call. I have the number. It would be the same. What I want to do and how do I call it. So that was our first problem: discovery. How agents discover what they can do. And the idea will be it will be an automatic way, not just us all the time telling how and connecting and stuff,right? Then also, there's another part. It would be nice to tell the agents, or, like, grant agents what they can do and what not, but really specific. The ones that connected the Gmail accounts, maybe they all gave them read access,right? Just read so we can, I don't know, don't send or, like, not remove anything so it's more safe. Okay. But what if you have so many important, uh, information there that then, if the agent, something gets, um, wrong and somebody else can read your data? It's not good either. It's not safe in any way. So what if we can get all these what the agent can do, all these tools, as he mentioned, and you can grant access to every tool. Like, this yes, this no, this reading, it's okay. That would be a better idea,right? So we think about authorization to that agent. Not, like, to act on behalf of me and have everything I can do, then the agent can do. ### Authorization **Paola Estefania** [6:53] It's like going back to the "hire" example, that a person, like, I just hired, has all the same access that the CEO. Or maybe you have an assistant, uh, or a friend that does something for you, like, in your real life. You will never give your access to all your things,right? And if you do, you change them after. So this is the same thing. And also, okay, we have an ideal world where agents can discover what they can do. Then we can tell them what they can do or not. But how do we trace them down? How do we trace today what the apps do or not when we authorize them? Huh? **Guest** [7:38] Audit logs. **Paola Estefania** [7:40] Exactly. Audit logs. So perfect. Audit logs. So how in the audit logs, like, I see what? I need to see some identification,right? Which agent did what on behalf of which user. In order to do that, that comes to our main thing: give the agent's identity. If we have if every agent has identity, we can trace them down. We can know what the agent did, what, when, on behalf of which user. It seems like so much, so much better,right? And also, what else you can do when you can trace someone. Regarding to the whole hiring thing, you can fire them if they do something wrong. You can revoke access. In the same way, the agent will be revoked if you know who they are. If something went wrong with today's things, you have to disconnect the whole thing,right? Yes or no? So imagine having, "Oh, this agent fucked up." Sorry for the word. You can remove it. That's it. So we have traceability. We have the whole thing. Okay. So as it comes out, as a sum-up, we have the discovery issue, where the agent can go, find the service and read the capabilities, authorization, what this agent can do, scope down, and who is this agent. Are you on board with this? Do you think it's a good idea? You have any questions? Like, jump in. Okay, great. Have you ever heard of capabilities? Raise your hand. Yes? Okay. Do you all know what a capability is? Who doesn't know? Okay. Almost the whole room. Okay. So the idea of using capabilities is instead of using scopes. You know, like, scope is like a big thing. For example, you have the read scope. So it what does it mean? It's like nothing so specific. The idea of a capability is what agent can do, but it's more capped down. So I can actually determine what an action agent can do. So the idea is going back to the example I put in the beginning. Let's say you talk to the AI in the chat and you say, "Okay, give me my emails from the last week." So the agent has an intent to do something,right? It has to be a way that that intent has to be mapped to a tool or maybe several tools. So that's kind of the idea. The tools will be like capabilities, and an intent will be matched to that. So that's what we were solving with discoverability. If you ever read the protocol that we are proposing, or maybe read it later, you will see, um, our idea of a well-known agent configuration endpoint. If you know a little bit about identity, you remember OIDC,right? OIDC Connect. It's the same well-known. And the idea is, like, to an agent have, like, a public place to know how they can interact with a service. Like, everything. They can have encryption, etc. So it will be something like this. And also a place to list capabilities and stuff. But what happens, for example, in a world like today, that we are still I hope in the future we adopt this. But in the meantime, all the services, they're still working just with OAuth. So how do we do it in the meantime? What do we need to agents to be able to know what they can use from each service? Let's say Gmail. We can build something like a directory. So the idea is, um, to have something. I'm going to sit here. So let's say most of the you're familiar for OpenAPI? OpenAPI spec. Yes? Okay. So most of the common services we use, they all implement OpenAPI. So we have, like, a kind of a place to we, as developers or engineers, we can say, "Okay, what this service can do?" So the idea is to use that and convert it to capabilities. So at the beginning, until we every service is speaking OAuth. So let's say, for example, do you guys use I don't know. Tell me a service you use. Huh? **Guest** [12:24] OpenAI. **Paola Estefania** [12:25] OpenAI? Huh? **Guest** [12:28] Gmail. **Paola Estefania** [12:29] Okay. Gmail, we have it there. But let's say, for example, let's see if it works. OpenAI, openapi.json. And sometimes they have public they have the public. But we need, like, a JSON. Uh, I don't see it. OpenAPI, open okay. I do know. I think it's this one. No. Well, you know what? That was wrong. **Guest** [12:58] Why? **Paola Estefania** [12:58] Notion. Notion has a really good one. I wanted to use another one from you guys, but the Notion is more reachable. So here. So you see? So if you have, for example, not every service has, but the openapi.json, what we're doing with the Agent Auth protocol is translating this. Oh, I already registered it. So I'm going to show you guys. Yeah. Where is this one? Sorry. Don't see it here. Okay. It will form something like this. This is, like, an example, but it's, like, the same. So you will get all the capabilities from the endpoints. You see? Sometimes you see, like, a delete, a get. So it will kind of be like the actual approach, like, a middleware to this point. Yes? **Guest** [14:00] So it might not be a policy. **Paola Estefania** [14:02] Oh, sorry, guys. Thank you for telling me. And, uh, okay. Here. There is better? Oh, thank you. Sorry, guys. Okay. So the idea is to see here. It's like you can translate the endpoints to capabilities. So because we are still this is just because we still we don't, uh, have so much services, or let's say none, like, implementation to OAuth. But the idea is, like, in the meantime, we have something that translates this. So what does this mean? It means, like let me check. It means, like, you will have something. For example, do you have there in the Agent Auth protocol, do you see do you have a directory? This directory will have, for example, the Gmail one that we did the same. So you see you have, for example, 20 lists of capabilities. So the idea is, like, you grab what the service can do, what it's exposing, maybe through OpenAPI, or maybe you do it yourself because, um, for example, maybe you want to automate a workflow. So the idea is, like, everything gets listed here. So the directory will be like a phone directory for the agent. Are you following me? **Guest** [15:22] Yeah. **Paola Estefania** [15:23] Yeah? **Guest** [15:23] Is it similar to, like, Findra now? Like, Findra? **Paola Estefania** [15:28] The what? Sorry. **Guest** [15:28] Like, Findra? **Paola Estefania** [15:30] Yes. I mean, it's a good point. Did you hear did you hear him? Like, Findra and OAuth? Okay. So the idea is, yes, in a sense of having the most scoped thing as possible. But still, Findra and OAuth still goes, like, minting a token to the user. We want to mint a token for the agent. So what we are switching is the principle. We now want that the agents are a principal actor. But it's a really good thing. That's why we inspire on that. I think it's one of the best things we can do. Okay. Great. Um, so going back to the capabilities, the idea is what I just said, like, having this scope once. You have, like, the readings, or, like, maybe, uh, just the gets, or the deletes, or the posts. Like, everything is quite discerned. So you can decide what the agent can or not. Okay. Until here, you have any questions? Yes? **Guest** [16:30] What is the API license offer that Findra and, uh, they both. **Paola Estefania** [16:35] Yeah. Yeah. That's that really sucks. Uh, the idea is, um, you can do it manually. You can actually declare everything. So in the directories or in the future, the agent knows what to do. It's, like, less common, but yeah, it could happen. But the idea is, like, in the meantime, we do this until services implement this Agent Auth. But yeah, it's a good question. Um, okay. So remember, like, our problems,right? So now we are trying to get a solution for how, like, the agent is the agents know what they do with the directory. Then we have a way to authorize them through capabilities. And now, if you remember, we said it was a good idea to get them identityright. So what we come ### Identity **Paola Estefania** [17:27] is giving agents, like, a private key, like, a famous private key. So each agent will have its own. And that will be attached to the identity. Um, so in that sense, because every agent has its own identity, now if you I see you want me to put this on light mode too? **Guest** [17:49] Yeah. **Paola Estefania** [17:50] Ah, what did you say that's before? Okay. Let's go back to this. There. That's better? Great. Zoom in. Okay. There? Great. So now that the agent will have, like, access to its own private key, they can sign tokens. They can have, like, their own minted tokens. And everything is encrypted with the private key. So what this means, like, from now on, instead of, like, a service, let's say Gmail, seeing, like, a user interacting with the service, we can have a log that we actually say, "Okay, this agent is doing something on my behalf that is connected to the user." But it's actually, for example, an agent from Cursor, or an agent from Claude, or an agent from whatever. So we are changing the paradigm. We are stopped seeing as an agent is, like, hiding behind the user. And now the agent is there as a principal acting. So it's for me, it was really exciting. So do you have any concerns about this private key private key policy, things? Yeah? **Guest** [19:03] Like, for example, if an agent was, like, using your entire database or whatever, like, you revoke access to the. **Paola Estefania** [19:10] Exactly. That's beautiful,right? You can say, "Oh, this is not doing what it's supposed to be doing." And I go and I revoke it. So it's good. And maybe you can think of, like, okay, the I revoke it, but the access token is still there. So what you can do is, like, delete it with the GDI. So bye. Yes? **Guest** [19:32] How do I know what human being operated the agent that deleted the production database? **Paola Estefania** [19:38] Mm-hmm. Always the token always the agent, they always have a user they are reporting to. They are never detached. So always the agent is, like, with the user. **Guest** [19:50] From an audit perspective. **Paola Estefania** [19:52] Yeah. **Guest** [19:53] You know, on that point, if an agent was to delete, like, would the principal of the agent show up, like, on logs such that, like, it was the agent? **Paola Estefania** [20:01] Yes. **Guest** [20:02] Okay. **Paola Estefania** [20:02] Yes. Exactly. You have, like, all the information. The agent, also the host. We are introducing a new thing that is called host. That is, like, the place where you are, like, creating decisions from. So you actually can also delete the host. You can say, "Okay, this host is not authorized." So you can see the host. You can see the agent ID. You can see the user. You can see everything. Okay. Great. More questions? Okay. Don't be shy. Like, we are here for this. Yes? **Guest** [20:34] So this is nice, honestly. But for the Gmail function, you said you'd like to buy the authentication stuff. **Paola Estefania** [20:40] Can you speak a little bit higher? **Guest** [20:41] Oh, yeah. So I'm seeing that, like, I'm going to need basic agent authentication. Are you able to cover that with, like, a cross-edge? For example, like, if you have a GitHub, you can use identities. **Paola Estefania** [20:53] Mm-hmm. **Guest** [20:53] And authenticate your users? **Paola Estefania** [20:56] Yeah. That's a great question. Um, actually, it's more like an enterprise focus,right? So because we did this in February, the things changed so much until now. Like, for example, agents are not so ephemeral. Maybe you have forever-long agents,right? Or maybe you have two agents. Or maybe you have agents inside of a company, and they have policies. So we are working on that in a new draft. And we are addressing that too, um, because it's something quite, um, important to address. So yes. I was about to say that in the end, but yeah, we're about to release a new draft with, uh if you have this is an open source. It's a project that we want all of us own. So if you have some ideas, like, you reach out, like, like that one, for example, it's really good. So we can improve. It's good for ourselves and good for everyone. And I don't want this to be just, like, for enterprise. It's just to all of us that use AI that would be safe. So thank you. Okay. So that was just discussing about the we want to be too. Um, great. So three layers, then one protocol. Why we say this? Because if you go and in the search in the website, you will see we published, like, a first version, just like a draft, or an Agent Auth plugin inside of Better Auth. ### Protocol **Paola Estefania** [22:16] The idea is you can use this and play around and see what you come up with. So in the Agent Auth plugin, you can, uh, use it, like, on the server side. So a server can verify an agent, or issue grants, or enforce whatever constraint that you have been doing with that. Also, on the SDK side, uh, we ship it with an MCP. So you can connect it to your cloud to try it out. You can add it to your whatever you're using, Cursor, whatever you're using with MCPs. And also, the other layer is the directory. It's just a place, like a phone book, like, where the intent match what the action. So intent will be matching the capabilities. Um, so the idea is that we can see it in action. ### Live Demo **Paola Estefania** [23:07] So what we will do, if you want, you can go to what I shared in the QR code. Let's go to the page. Okay. You will see a directory there. Did you all find the directory button? You will you will come into this, and you will see a connect button. So you have to log in first, for sure. And you will see a connect. And then you will see the MCP. So you can connect that, for example, to the cloud. I have it here. I wanted to show you guys a bit what we were talking about. So let's say we say I'm going to ask for emails, okay? I just did a bunch of demo emails, but I'm going to show it to you guys so I don't share, like, personal information. But for example, I have my MCP connected. So you will see something like this. Uh, connectors, customize. Here, you see Agent Auth. You will see something like this. Then you can approve or disapprove always deny with just the Agent Auth, um, MCP. And if it's that my idea is, like, you try it out just with the MCP of Agent Auth so the agent doesn't have access to other tools. So it's, like, the principal one to see how it interacts and how it gets the identity. Our whole idea is, like, when you use this MCP, the agent will have an identity, will request you for capabilities, and will try to execute it. And you we will see the logs and everything, um, uh, running. Okay? So let's see, for example, um, hey, bring me my last email. Oh, sorry. So it's going to use the Agent Auth connectors. Can you see? It's too small. It's okay? Okay. Okay. You see? It's using the because it has the MCP, it's using the directory to see from my intent of, like, bring me my last email, which capabilities are out there. And he's asking for approval. We are using here device, uh, device flow. Do you know the device flow? Are you familiar? It's just, like it's, like, connecting a device. So we are acting like it's the it's the agent is another device. So you can see, uh, the agent called is called email reader. That's for default. You can change later if you want to. It's requesting me to read and list my emails. We're going to approve. And I'm going to show you that, guys, later. So the idea here, um, is that the agent will connect. We get the identity. He, uh, will have the last email. Okay. Okay. Great. We have a nice email. So we know agents can read emails. That's not the demo. The demo is what what happens. So remember, at the beginning, we said if we gave identity, we can have logs. So let's see what the agent did. So I know I have an active agent. There's an email reader. It has this agent ID. It's in a local device. It has these things. And also, I can see here this agent with this user ID. Okay. I see the agent here. Just is the email reader, and he got these results. So I'm actually tracking down what the agent did,right? So now, let's say I want the agent to, I don't know, send an email. By default, what we are proposing is, like, all the hosts, like, for example, Claude, has reading capabilities by default. So then it wouldn't mess up your agent with your inbox,right? So let's see. Uh, let's send an email. Who has, like, a really short email that I can put in there? **Guest** [27:14] Hello world. **Paola Estefania** [27:15] Hello really? But no, but a, a actual one. **Guest** [27:20] Oh. **Paola Estefania** [27:24] Who has, like, a good email? If not, I can put, like, my own. But if you once want to show okay. So I'm going to put mine. Uh, oh, you see? I made it to myself, saying I'm going to use hello world. I thought that your email was hello world. It was so cool. Okay. So the idea here is if you as you just saw, like, the agent just have, like, the reading capabilities. Ideally, it will never could send the email without me granting it. So for example, we can see it here,right? The only capabilities it has is two these two. So it will try to see it here. We can also we also did, like, this extension for us to actually watch it better, what the agent was doing. Okay. Okay. Authorize eSIM in dispatch with security verification. Okay. So you see? This, um, the agent now is using SIVA, like, async auth. Like, it's client-by-channel authorization. Instead of, like, just showing me, like, a redirect and see a device that I'm approving, I could approve from here. So for the demo, I'm just going to approve. And now that the agent has approved, I approve it. It will be actually sending the email. So you will see in the capabilities here that now you can send the capabilities of, uh, send emails. And actually, we can see here, he just it just sent the email,right? So what do we want to try this? We're going to see if it's no, no. Okay. Here is the email. Okay. So what we want to try now let's say there's something went wrong with the agent. Somebody is trying to access my Gmail, trying to browse your sector, whatever. So the idea of this whole thing is to have the traceability we just saw. It's on the logs,right? And what if we want to revoke it? Let's try let's try to revoke it and try to, for example, read my emails. So I'm going to revoke it first so it cannot see a thing. Uh, oh, I lost the page. Here. So in agents, we can revoke the agent. So bye-bye. And now we can say, "Read that last email you just sent." Okay. You see? The connection got revoked. So what happened now? Why it can't read it anyway? Because what we did is, like, he created another agent, another identity, because I revoked the one before. But this is just happening because the GET, the list, is a default capability in our host, because for us, it's safe. What if now I wanted to say, um, send an email saying hello to myself? It will do the same. It will ask for it. So actually, it's working,right? I can actually revoke it. I can see the logs. I can say what the agent can do or not. Don't you think it's a it's, it's kind of nice to have this kind of workflow? It's more controlled. Yeah? Do you have any questions about this? How something that pops into your mind? Yeah. **Guest** [31:23] Is it supported with time periods? **Paola Estefania** [31:25] Yes. Yes. It's fine. Yeah. Every constraint that you want to be careful about, you can put in the capabilities. So it's good. **Guest** [31:37] Can you put that in the spec, like, alternate encoders? So like, say, your transcribers? **Paola Estefania** [31:41] Mm-hmm. **Guest** [31:42] Your encoder? **Paola Estefania** [31:43] Yeah. **Guest** [31:44] You know certain things that are dangerous for you? **Paola Estefania** [31:46] Yes. **Guest** [31:46] By default, put maximum time. **Paola Estefania** [31:48] Yes. **Guest** [31:49] For multiple times? **Paola Estefania** [31:50] Yes. Exactly. You can say maximum time of executing. You can say the time. You can say everything. Yeah, it is. Uh, thanks. There. **Guest** [32:01] So from understanding,right, instead of, you know, kind of normally happens about AI launch where the harness itself forces human in the loop. **Paola Estefania** [32:11] Mm-hmm. **Guest** [32:12] You're kind of shifting that to the proxy layer or to the MCP server, and that's what's forcing human in the loop. **Paola Estefania** [32:19] Well, you can have both. Our idea is, like, to be safe but not to be annoying. Imagine every time you had to read something out, I had to approve every time. You're going to hate us, you know? So the idea is, like, a host, for example, or incluso sorry, I'm speaking Spanish. Include um, or, like, maybe a host or, like, someone specific you want. Like, for example, let's say a CEO can't do everything, and then, like, our recently joined just have, like, this specific access. So you can do it, like, by user policies, as I was talking about, or you can do it, like, host policies. So you have to be, like, in the middle, I think, of, like, good UX, uh, in the good user experience, but also secure enough. **Guest** [33:01] But ultimately, that centralizes that because. **Paola Estefania** [33:05] Yeah. It's the yeah. Yeah. Yeah. Because, uh, Agent Auth, what we're doing, like, as I said, you can try it out. Uh, with the server part, it's the one's going to verify the agents, like, back with the user. It's going to verify the policies. We're going to verify it has access or not. So yeah, all the time verifying. So yeah. Great. Um, so the whole idea was to show you this. Uh, I was trying to ask the agent to send. Uh, I need to confirm. So you see? So I here, I have the request. I didn't accept it. So let's say I deny it. It will be, like, the same. I just did. So ideally, he wouldn't. You see? That's red. Okay. So it's working good. So he wants me to allow it. And I'm going to I'm going to so can you tell me agent status? So you can have all the time, like, track down what agent is doing, if it's revoked or not. It has yeah. **Guest** [34:09] So one of the parts that we need is, like, MCP server. Uh, the control in the MCP server, if I have, uh, skills that, uh, you know, if I have a local MCP server office with all the skills, can I still control them? **Paola Estefania** [34:25] Oh, I was saying if you have, for example, a skill that is saying to use the MCP server differently. **Guest** [34:31] Using OpenAPI, uh. **Paola Estefania** [34:33] Directly. **Guest** [34:34] Directly. **Paola Estefania** [34:35] Yeah. Well, actually, what we are doing is we are in for and this is just an example for you to see how the protocol is doing. It's just, like, a demo. But you can enforce, for example, that the agent the only thing that can use, um, is the MCP tools in this case. That's what we did with the plugin. But yeah, you have, like for our next protocol, it's going to be, like, more, uh, more caped down. So the only way the agent can go out and ask for services is through the Agent Auth protocol. So it's a good really good question. Yeah. **Guest** [35:08] The other UI. **Paola Estefania** [35:08] The what? Sorry. **Guest** [35:11] The other UI. **Paola Estefania** [35:12] The proxy? **Guest** [35:13] Yeah. **Paola Estefania** [35:17] Here. **Guest** [35:19] Is this this is part of the auth that you have? **Paola Estefania** [35:25] Yes. Uh, you have this in the directory. Now you can use it. Like, when you log into, for example, you are connecting a lot of services in the directory. So the agent when connects to the MCP can know the capabilities that it can do. So inside of the MC the proxy, you can see, for example, the Gmail. You can see all the capabilities that the agent can do. You can see, like, the agent's doing stuff, the logs, and everything. So every log is, like, capped down by provider. Okay? Okay. Um, and about that, um, our actually, proxy is just a directory. It's not a real proxy. For us, like, proxy is a really bad idea. It's not scalable because proxy uses data. So in this case, it's just, like, a directory matching intent with capabilities. Okay. Um, so okay. So back again. If you want to try it, you can. Like, it's it's there live. You can use, like, the Agent Auth plugin, the SDK. It's really nice because we started, like, from the problems, and now actually the solutions,right? Like, the discovery, authorization, and identity. Um, this is kind of, uh, what I will show you guys, like, MCP how to connect it. Um, the SDK side with MCP is the one that is creating the, the, the keys and assigning it to the to the agents. And the server side is, like, verifying, authorizing, grant um, giving the grants that are authorized by the user and, and so on. So ### Wrap-up **Paola Estefania** [37:05] for me, the most interesting thing of all is we need to stop giving credentials, our credentials, to our agents. We need to give them authority. That's should we stop saying, like, "Pretend to be me," instead of saying, like, "Act for me within these limits." So we are almost in the end. If you have any questions, something that pops into your mind, or it could be also an addition of what I'm saying. I don't know if you ever thought of this. Do you think it's a good idea that we implement something like this? I'm not saying this one, but maybe. Yeah? Okay. The idea is that this is open for everyone. So I would love you guys to join us on Discord, or you can send me a message, send me an email, be in the channel. Like, be active because if we improve this for all, it's going to be good for all of us. Yes. **Guest** [38:01] I see, uh, on the website, this is the Python Rust and Go SDKs are still in the building. **Paola Estefania** [38:07] Yes. **Guest** [38:07] If I go on, like, GitHub, or the GitHub posts up there, can I actively start contributing to the development? **Paola Estefania** [38:13] Yes. Yes, please. And please do. Yes. Please do. Sure. **Guest** [38:19] Uh, yeah. I'll just say, um, as far as, like, adoption, like, do we have to be on, like, Better Auth kind of stack? **Paola Estefania** [38:26] No. It's totally agnostic. **Guest** [38:27] Okay. So you can be. **Paola Estefania** [38:28] Yes. **Guest** [38:28] Like, we can use whatever we're onright now and try it. **Paola Estefania** [38:32] Yeah. Exactly. That's the idea. **Guest** [38:34] I'll also second what the gentleman was saying over there. Like, we're in large enterprise. **Paola Estefania** [38:37] Mm-hmm. **Guest** [38:38] Having something like IAM rules so that you don't have to define, like, each claim. **Paola Estefania** [38:43] Yes. **Guest** [38:44] Like, if you could just assume all of what you do in AWS, that would be great. **Paola Estefania** [38:47] Yeah. That's on our B2, and that's our prime focus now. So yeah, that's a great idea. Great. Any anyone else? Yes. **Guest** [38:56] There's an AAuth protocol on the IAM track. Is that the same? **Paola Estefania** [39:01] No. It's different. **Guest** [39:02] Okay. **Paola Estefania** [39:03] Yeah. **Guest** [39:03] There's no relation. **Paola Estefania** [39:04] No. We also I mean, we have, like, as an inspiration, like, everything that's out there, but it's not the same. It's different. Yeah. Because they are not still treating agent as a principal. **Guest** [39:15] Okay. **Paola Estefania** [39:15] We are treating agent as a principal. They have their own identity. So from that, it's different in that way. **Guest** [39:20] And not you there's no intent to go and contribute to that idea? What are you doing? **Paola Estefania** [39:26] I don't know. We don't I don't have that information. Yes. **Guest** [39:31] How do you distinguish this between AID versus MCP? **Paola Estefania** [39:35] Uh, sorry. What? **Guest** [39:36] How do you distinguish this specific solution versus the AID? **Paola Estefania** [39:41] Oh. Yeah. The you see, I it's connected because of the discovery. But it's still the same. Like, for me, the most important part is, like, the agent be principals. Have their own identity. AI gateway doesn't have doesn't do that yet. I hope it does. But the whole idea is to have, like, traceability, have the whole life cycle, and to be able to track down and hunt, if you want, an agent. So that's the only gap you have if you have identity on each agent. And AI gateway is not providing that. Okay. Sure. Is there any more questions? Okay. Well, you can reach me in the that's my email. If you want to email, if you want to contribute together, it would be nice. Uh, that's my LinkedIn too and the Discord channel from the whole Agent Auth protocol. Okay. Thank you so much. It's been a nice one. --- This library is powered by PodHood (https://podhood.com), the podcast website platform.