It's 10pm. Do You Know Where Your Agents Are? — Kim Maida, Keycard
Source: YouTube · AI Engineer · published Jul 20, 2026 · 22:46
BLUF: The speaker highlights the security risks of granting AI agents broad API keys and demonstrates how RFC 8693 token exchange provides granular, policy-driven access control to secure agentic workflows 4:52.
Key Takeaways:
• Agents with static API keys are often overprivileged, leading to potential data loss or unauthorized actions like dropping production databases 3:23.
• Traditional "human-in-the-loop" approval is insufficient because exhausted humans may suffer from consent fatigue or lack proper authorization roles 5:35.
• RFC 8693 enables token exchange, allowing agents to request short-lived, ephemeral tokens scoped to specific tasks rather than using permanent credentials 7:36.
• A Security Token Service (STS) evaluates governance policies before issuing tokens, ensuring agents only access resources they are explicitly permitted to touch 10:33.
• This approach maintains an identity chain, clarifying both the user and agent identities while preventing credential leakage or replay attacks 10:22.
By implementing standards-based token exchange, organizations can securely empower AI agents with precise, auditable access without relying on brittle human oversight.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] Okay. So, when I was a kid growing up in the '9s, we'd be out late all summer riding our bikes off in the neighborhood, playing with friends. And from the 60s to the 80s, there were these public service announcements on TV where celebrities would come on and they would say, "It's 10 p.m. Do you know where your children are?" Because apparently our parents at that time needed to be reminded that they had offspring they were responsible for. And I feel like in this phase of AI where we are right now, um, we're entrusting agents with more and more responsibility, but we still kind of need that public service announcement that says it's 10 p.m. Do you know where your agents are? So, say you as a user want agent to use an MCP server or API to accomplish tasks. Now, we know agents withou…