Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard

An on call agent drops a billing database, restarts a production server and scales a service from four pods to 40, adding $420 an hour to the bill. Kim Maida's staged triage demo shows what happens when an agent receives standing API keys and an administrator's database credentials. Private data, untrusted tickets and access to external services combine into the lethal trifecta. The agent can do useful work, but its credentials give it far more authority than any one ticket requires. A human approval button alone cannot tell it which actions the user is actually authorized to approve. Maida walks through delegated authorization using OAuth token exchange: carry the user's identity through the agent and MCP server, evaluate policy at a security token service and issue short lived credentials scoped to the requested access. She also explains Keycard's approach to intent based authorization, which she identifies as a proposal rather than a finalized standard. The second demo uses task based policy instead. Customer data access and database deletion are denied, certificate renewal is allowed, and a server restart stays blocked even after approval because the user's role cannot authorize it. Scaling proceeds when the user has the required authority. The demos make identity, delegation and policy decisions visible throughout the request chain, while keeping authorization distinct from whether an agent's answer is correct. Speaker info: - https://www.linkedin.com/in/kimmaida/ - https://github.com/kmaida - https://maida.kim/ Timestamps: 00:00 - An overprivileged on call agent 2:32 - Database deletion, restart and scaling 4:16 - The lethal trifecta 6:21 - Access control and standing credentials 8:43 - Missing identities and token exchange 10:25 - Following the agent and MCP execution path 12:18 - Subject tokens and the security token service 14:11 - Intent based authorization as a proposal 16:05 - Ephemeral credentials and delegation chains 17:37 - Repeating the demo with task based policy 20:01 - Data access, renewal and deletion decisions 22:28 - Approval constrained by the user's authority