Thank you everyone, it's good to be back. Good to see a lot of familiar faces again. It's always a great time of the year to come back here. Continue the discussion, see what people are thinking, argue a lot. I think I already had a great argument with Mike from Glue this morning. I'm sure he's out there somewhere. So looking forward to keeping that going. So my talk is about AI, LLM Agents, and AuthZen. And of course, AuthZen is the new OpenID specification for authorization.
We've all been waiting for one for a long time to where the policy decision points or the authorization engines can have a standard to which any application can call to get an authorization decision. And in a standard format, they can make the call, and in a standard format, they can receive a decision. So you have interoperability, you don't get locked into any vendors. So how does that play with AI, LLM Agents, and all these challenges that we're dealing with?
Well, if you think of an agent, an agent is not just similar to a secret agent in name. They're very similar in concepts, because when you talk to an agent, you're giving it a mission. The agent has a mission, it has the user asking it to do something. It has to use a variety of tools or gadgets or different things to try to accomplish the mission. The mission hopefully has mission parameters or guardrails, which define what is allowed to be done and not done within the mission.
And at the end of the mission, you hope that if anything's compromised, anything that is risky or top secret just automatically blows up. So you have the same types of things with an agent. An agent has tools, it has access to top secret materials, it's trying to complete a mission. And of course, just like a human top secret agent, an LLM agent has to use its brain to try to get this all done. So last year, we were talking about agents and AI, and it was a relatively new concept for all of us about LLM agents and what's an agent versus what's a chatbot.
Everyone's thinking chatbot, they know AI, but they know what a chatbot is. An agent's a completely different thing. An agent is something that can not only talk with you and has a brain, but actually has access to tools and can do work. We definitely define that we need guardrails to try to control what they can do and what they should not do. And that the whole idea of delegation, controlling the authorization for agents was really, really messy, and that we were gonna have to do some deep thinking on it to try to solve that problem.
And I know a lot of people here working on the same thing, we've been talking about that. So the main thing about an agent is that it has tools, just like an agent on a mission, they have all kinds of cool gadgets or tools that they need to accomplish their mission. And of course, in an authorization, you might have lots of different agents. You have the travel agent, you have the JIRA agent that book your JIRAs, and you're gonna have lots of tools out there.
Of course, you don't want every agent to have access to every tool. It wouldn't make any sense that there'd be no constraints as to which tools are available to which agents. So you really have to add some guardrails or else your agent could drive you over a cliff where your travel agent all of a sudden gets access to things and it's booking a $50,000 first class flight, or it's deleting data off your OneDrive, and you end up with something, the enemy of us all, identity chaos.
Which is, we've all experienced identity chaos, different rounds of chaos. I think SharePoint, we all might remember that SharePoint was kind of data and security chaos because it could spring up everywhere. Agents are springing up everywhere and they're another form of identity chaos because agents have to act on your behalf, they have to do sensitive actions, and they need to be able to have controlled authorization to act on your behalf.
And that's really where it gets sticky because you can do some of the early lazy approaches that we're doing right now, which are not secure, which we'll talk about, but we'll get into that. So that's kind of what we were talking about last year, which was AI is not a chatbot, tools are really what make agents do work and make them really cool, a whole new concept. They have a brain, they have tools, they can get stuff done.
I kind of did a review of what are people talking about in the last 24 months, last 12 months, sorry, last 12 months since the last EIC, and the hot topics out there on LinkedIn, at the conferences, are really these technologies. So one we're gonna talk about a lot, which is AuthZen, which is the standard for authorization. I think we're gonna be having a little maybe meetup here, but we're doing a big one at Identiverse for to implement draft three or draft four, I'm not sure which they're gonna call it.
I saw a four, but okay, draft three specs, which extends it with some additional capabilities. And again, that's great because then it's the idea of Martin's identity fabric, that you can have an authorization engine that you're not locked into any one vendor. As long as everybody adheres to the spec, then how that vendor adds their own unique value to it, it doesn't lock you in, because they're all gonna be standards-based plug and play. MCP is probably the hottest thing in the last six months.
I'm surprised that we know, I think at RSA somebody made fun of, used to be zero trust at every vendor's booth, and this year it's agents and MCP. It hasn't hit EIC yet, but I'm sure it will. So MCP solves a big phony problem, which I'll talk about in a moment. And then some other ones, OAuth RAR, the ability to use OAuth and send more fine-grained access requests about what you're trying to do. It's big in FAPI and the financial API specification you don't need all the access, you don't want all the user's access to generic requests, you need to do these types of transactions.
And this is important because if I'm an agent, like a travel agent, I don't need all the user's access, I need the ability to put to the actions that will get done a travel booking and nothing more. So this is the ability to pass JSON through and request a token with very fine-grained access permissions.
And then of course out of OBO or on behalf of OAuth tokens, so the idea that you're not gonna use the user's token, you're gonna get that we know that this is the agent acting on behalf of the user and this token's trackable, so it doesn't look like the user and it gets obscured who did what, you know that it's on behalf of the agent acting as the user. And then of course, just like in the spy films, when things go wrong, you've got, you know, you spot danger, you don't want them to get the top-secret blueprints or the top-secret weapons, everything needs to blow up when things look bad.
So cape and risk from the shared signals group, the ability for account-level or session-level detection that things don't look safe anymore, let's just blow it all up. So the big one to talk about is MCP, because that's really, so before you had AI agents and we knew that they could use tools. And anything could be a tool, anything that has an API could be used by an agent to perform a task. But where we really lost a lot of time was that every agent had to wire up how to use each tool. How do I call this API? What are the parameters? How do I call this API?
So you spend all your time on non-value-added tasks like just plumbing to try to use tools. Basically what Anthropic released MCP, it's not perfect, but at least it's a standard, so it's getting adopted like crazy, is it provides like a USB-C for AI to talk to tools.
So if I have an MCP server, I can expose my APIs, like let's say I'm Salesforce, I can expose my APIs that I want to, where the MCP server knows which APIs it wants to expose, how to talk to those APIs, what are the parameters, how to get it done for those, and it exposes this universal thing to AI agents so they can talk to the MCP server, they can discover what's available, they can discover how to talk to it. And if these APIs change, it's dynamic, they don't have to change any agent code because they're just talking to the MCP server which knows how things have changed.
So it allows agents to seamlessly use tools because they can plug in an MCP server, discover them, and instantly know how to use these tools. So of course, that sounds great, but then of course now you've given these eight, this dynamic model where I'm an agent, I plug in and I can talk to all these tools. Someone has to control, does it make sense which tools you can use? Who are you when you're using the tools? What access is gonna be applied to you?
So really, it really needs control. Now, in our secret agent model, Q, the quartermaster, MCP's really the quartermaster. He's not gonna let you have the tools that you shouldn't have. He's not gonna, he makes it easy for you to get the right tools for the job, and he's gonna be the one that controls it. So it's super simple to get them, but you have to go through some type of gateway. So MCP's really gonna be a nice gateway layer for us to implement some authorization controls because everything's gonna plug in.
Basically, everything's going MCP at, I mean everything, in the next 12 months.
