Securing Agents with Open Standards — Bobby Tiernay and Kam Sween, Auth0

Shipping AI agents that are safe for production means solving some tough identity and authorization challenges that are not always obvious at the prototype stage. In practice, this comes down to a handful of deeply technical questions: - How do you make sure agents are only acting for the right user? - How do you prevent over-broad API access or data leaks? - How do you handle user approvals when there is no UI, or you need a human in the loop? - And how do you avoid the usual pain points like manual credential sharing, stale keys, or unpredictable scopes without writing a lot of brittle, custom code? This talk digs into the real technical trade-offs behind building secure, user-aware AI agents. We will go beyond what to do and explain why, sharing the architectural decisions, open standards, and hard lessons learned from integrating OAuth, OIDC, RAR, and async authorization into agent-driven workflows. You will see a hands-on demo using an open-source Node.js agent and open protocols, with a focus on practical integration and no magic. The session will show how these solutions have shaped our approach to identity in GenAI and where we see the field heading next. If you are an engineer building AI apps that need real guardrails, not just a happy-path demo, we hope to leave you with some practical patterns, design rationale, and a clear view of the trade-offs for making your own agents production ready. About Bobby Tiernay Bobby has spent eight years at Okta as an architect working on Auth0 and Okta Platform products. He's passionate about generative AI and loves experimenting with new tech in his free time. At work, he helps teams develop AI solutions that improve both internal tools and customer products. With a background in data security and AI governance, Bobby connects research ideas to real-world applications. He's driven by a simple goal: making identity security easier and more secure for the people who use Auth0. When tackling complex challenges, he kee