Don't give your agent the master key
summary
Demo shows one agent, three tools, four identity patterns implemented with the Vercel AI SDK and eve scaffolding (npx eve@latest). It issues token vault scoped, short‑lived user-bound tokens for routine calls, uses client initiated back channel authorization for high‑risk actions (phone approval), models agents as principals with distinct subject/actor claims, and performs token exchanges for on-behalf authentication so every API call carries a verifiable delegation chain instead of a universal master key.
AI-written summary · about
chapters (11)
- 0:00AI agent identity challenges
- 3:00Identity bottleneck in agents
- 8:59Demo: four identity patterns
- 10:01Dangers of over-scoped API keys
- 11:04Token vault for credentials
- 12:31Back-channel authorization
- 13:33Agents with their own identity
- 14:37On-behalf-of authentication
- 15:39Live demo: secure agent workflow
- 18:05Secure agent identity principles
- 19:08Closing
related talks
17mDon't give your agent the master key
19mSecuring Agents with Open Standards
01h 22mIdentity for AI Agents
24mBuilding Trustworthy AI Authentication & Authorization for AI Agents
25mWho Let the Agents Out? Securing AI Workflows the Right Way
04mYou Don't Need a New Identity Platform for the AI Era
27mGive Agents the Right Keys - Identity Assertion for Enterprise APIs
23mWho is Calling? Identity for Agents with AAuth