Episode 202 - GluuFederation/identerati-office-hours GitHub Wiki

Title: When Identity Isn't Enough: Securing AI Agents at Runtime

Channels

Description

AI agents authenticate with valid credentials, pass MFA, and then commit fraud — bulk data exports, cross-tenant queries, unauthorized payments — all with a clean token. The identity layer tells you who the agent is; it doesn't tell you what the agent should be doing. This session covers the emerging runtime enforcement layer for agentic AI: behavioral baselines, real-time fraud scoring, and why the post-2012 identity stack (DPoP, MTLS, device-bound sessions) is necessary but not sufficient when the threat is an authenticated agent acting outside its declared scope.

Homework

Takeaways

Livestream Audio Archive

here