Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard

Why watch

Kim Maida demonstrates the security risks of AI agents with excessive credentials (the lethal trifecta: private data, untrusted tickets, external service access). She presents OAuth token exchange as a solution to carry user identity through agents, enabling policy evaluation at a Security Token Service that issues short-lived, scoped credentials. The talk covers Keycard's intent-based authorization approach and task-based policies that can block actions even after human approval if the user's role lacks authorization. Essential viewing for security engineers and platform architects building agentic AI systems.