Your AI Agent Has Too Much Access | Fixing Agent Identity

AI agents can do far more than answer questions — they can call tools, access data, execute actions, and act on behalf of users. But once agents start taking actions, an important question emerges: who is the agent actually acting as, and what should it be allowed to do?

In this episode of Kubernetes Bytes, Bhavin sits down with Maia Iyer, Research Software Engineer at IBM Research, to explore identity, authentication, authorization, and zero trust for AI agents.

They discuss why static API keys and simply passing user credentials to agents can create security problems, and how existing standards such as OAuth 2.0, SPIFFE, SPIRE, and Keycloak can help establish verifiable user and workload identities.

Maia also explains the work her team is doing around Rosso CTL and Cortex, including using a runtime layer around agents to handle identity, observe inbound and outbound interactions, apply guardrails, and explore intent-based access control.

Topics covered include:

• The building blocks of agentic applications

• Security anti-patterns for AI agents

• Static credentials and over-permissioned agents

• User identity vs. workload identity

• OAuth 2.0 and delegated identity

• SPIFFE and SPIRE

• Keycloak