You Don't Need a New Identity Platform for the AI Era
summary
An implementation for a UK and a Philippine tier-one bank proves agentic identity without a new platform, using Keycloak token delegation and exchange, fine-grained policy-based scopes, short-lived credentials and just-in-time least privilege to chain humans → agents → tools, require human approvals for high‑risk actions, and produce context-rich audit trails. It integrates DPoP under FAPI 2.0 and SPIFFE/SPIRE so agents need no hardcoded secrets, and audits map machine actions back to human authorization.
AI-written summary · about
related talks
16mIdentity-Centric Security for AI Systems
35mIdentity and Access Management for the Decade Ahead
17mDon't give your agent the master key
40mIn AI We Trust? Securing the Future, One Agent at a Time
32mBrave New World: Welcoming New AI Identity Challenges
25mIdentities and Authentication for Your Agents With Keycloak
09mNavigating the Identity Abyss in the AI‑Native Era
25mAgents Are Not Users or Services: Securing AI Traffic with a New Identity Model