tag / agents

Browser-resident AI agents inherit the human's authenticated session by design. The threat model that follows is not prompt injection. It's session theft with consent, against an identity stack that assumes the browser is the user. A short note on what DPoP, CAEP, and the still-unfinished sender-constraint story actually fix.

Passwordless authentication is finally landing across enterprise IAM programs. The same orgs are simultaneously onboarding AI agents that hold long-lived credentials and run inside the human's session. The two projects are colliding, and most identity programs aren't ready.

Token exchange is the cleanest pattern for delegating identity to an AI agent, and every major IdP implements it differently. Field notes from wiring it into Entra, Okta, and Auth0 — what the spec leaves to interpretation, what breaks first, and what to standardize before the second agent ships.

AI agents are the next vulnerability vector and we are not tackling it fast enough. A look at why the gap between AI adoption and AI governance is widening, what it looks like inside real orgs, and where identity programs should be aiming.