Build AI Agents with Auth0 at Okta explored agent security during SF Tech Week. It connected with the conversations I was having about context, memory and scaling agents.
The advertised program included Token Vault, asynchronous authorization, fine grained permissions and MCP authentication.
Ask what the agent is allowed to do
The event put agent security alongside the work of building agents. The design question I want to take forward is what an agent should be able to access or change in a real workflow.
Consider connected tools explicitly
The program’s identity and authorization topics point to questions about how an agent connects to other systems. My follow up questions are whose identity is being used, which permissions apply and how access can be removed.
Connect permissions with context and memory
Across the week, I learned about what AI should remember and carry between tools. Those conversations make the permission question more concrete: being able to retrieve context is different from being authorized to use it for every action.
My takeaway
Include identity and permissions in the early conversation about an agent. A useful demonstration should lead to more precise questions about the workflow it may eventually support.
Thank you to Auth0, Okta and the organizers for the session.
Questions from this recap
What topics were advertised for the Auth0 event?
Token Vault, asynchronous authorization, fine grained permissions and MCP authentication were listed in the program.
What questions am I taking forward about agent permissions?
Whose identity does the agent use, what can it access or change, and how can access be removed? These are questions to work through for the actual workflow.
Explore further
Can your team explain which identity and permissions each agent uses when it reaches a tool?