Identity for AI Agents - Patrick Riley & Carlos Galan, Auth0

Key Concepts

• AI Agent Identity & Authorization: Establishing secure and granular access control for AI agents, moving beyond traditional user-centric security models.
• Asynchronous Authorization: Enabling agents to access resources on behalf of users without constant re-authentication through delegated consent.
• Dynamic Client Registration (DCR): Simplifying agent integration and management through automated client registration.
• Token Management: Automating the complexities of token refreshing, secure storage, and scope management.
• Enterprise Security: Addressing both individual user access and company-level control over agent actions.

Introduction: The Need for Agent-Specific Security

Alzero is releasing new features focused on identity and authorization for AI agents, MCP servers, and related technologies. Traditional security models are insufficient for autonomous agents, necessitating a new paradigm that prioritizes agent identity, granular access control, and user oversight. This release, largely architected by Abbyek (“Shrek”), addresses the evolving security landscape highlighted by the updated OWASP LFO Top 10 vulnerabilities. Alzero’s vision is to “free everyone to safely use any technology.”

Core Pillars of AI Agent Security

Alzero’s approach is built on four core pillars: first, the AI needs to know who I am (user identification); second, the AI needs to call APIs on my behalf; third, the AI should request my confirmation for risky actions; and fourth, AI access should be fine-grained. The platform models agents as clients and APIs as traditional OAuth resource servers.

Technical Implementation: Async Off & Token Vault

The release includes key features like Token Vault and Async Off (back channel authentication). Async Off utilizes Client Initiated Backchannel Authentication (CIBA), an IETF specification, where an agent initiates an authorization request, the user receives a structured notification (via Guardian MFA for confirmation of risky actions), the user approves, and an access token with approved details is returned to the agent. Token Vault manages token exchange, persistence of refresh tokens, and token lifetimes, differing based on agent type (short-lived tokens for LangGraph, refresh tokens for web apps). Dynamic Client Registration (DCR) is used to register MCP servers as clients, establishing secure connections.

Asynchronous Authorization & Delegated Consent

A significant focus is on asynchronous authorization, allowing agents to request access to services without constant re-authentication. This is achieved through a delegated consent flow leveraging DCR and an extension of the Reach Authorization Request specification. The system establishes a distinct identity for the agent, separate from the user, to track actions and enforce policies. The access token issued to the agent identifies the authorizing party (the user), not the user themselves. Automated token management, including refreshing and secure storage, reduces developer burden.

Use Cases & Integration

Several use cases illustrate the benefits of the new features. A stock trading application demonstrates the need for granular permissions and user confirmation. LangGraph integration benefits from Token Vault, while MCP servers integrate seamlessly through DCR. A shift from chat-based interfaces to task runner applications (e.g., automated stock purchases) highlights the efficiency of delegated access. Integration with Cloud Code, Inspector, and potentially GPT app SDK showcases broad platform compatibility. The system envisions a “bridge” to integrate with existing identity providers like Okta. A schema has been developed to ensure consistent rendering of authorization requests with arbitrary objects.

Technical Details & Concepts

Key technical terms include OAuth 2.0, OIDC, CIBA, FGA (a separate Alzero product for Fine-Grained Authorization), MCP (Multi-Party Computation), Token Vault, Async Off, DCR, PKCE, JWT, and OASP LFO. The system utilizes access tokens with defined scopes, client ID metadata, and operates within the Alzero MCP.

Conclusion

Alzero’s new features represent a significant step towards securing AI agents and enabling their safe and efficient operation. By prioritizing agent identity, asynchronous authorization, and automated token management, the platform addresses the unique challenges posed by autonomous agents while improving user experience and scalability. The emphasis on delegated consent and granular access control ensures accountability and prevents unauthorized actions, paving the way for broader adoption of AI agents in enterprise environments. The final state branch of the workshop app is available for exploration and feedback.