Our Speaking Sessions
Identity for AI is hard... Fortunately Authorization doesn't have to be - Practical access control for MCP & AI Agents
Date: Monday, October 19 at 10 AM PT
Figuring out identity and authentication for AI processes, agents, and other non-human identities is hard. One might ask what kind of token should we issue an agent. What scopes should they be given, etc? Fortunately authorization for AI, be it MCP or agents, is relatively straightforward. In this masterclass, we will cover the challenges AI brings with regards to access control such as:
- overcoming the limitations of role-based access control
- solving the static claims problem
- introducing constrained access delegation, and
- implementing policy as consent.
Runtime access control, as embodied by NIST ABAC 800-162 and its Zero Trust sibling, 800-207, enables enterprises to roll out AI in a controlled and secure way leveraging defense-in-depth principles:
- MCP servers and gateways act as natural enforcement points that can reach out at runtime to policy decision points over OpenID AuthZEN.
- Agents' access can be constrained through dynamically-generated claims and consent-as-policy constructs
- RAG can be dynamically filtered to achieve the right levels of control.
This masterclass will propose a multi-faceted architecture that provides a comprehensive approach to securing AI within the enterprise. We will tackle:
- functional access control: can a user or agent even access a given tool
- transactional access control: can a user or agent act on a given record?
- data-centric access control: which records can an agent or user retrieve?
Attendees will walk away with a clear, standards-based blueprint they will be able to apply in their enterprise.
