Software that acts on someone's behalf is not new — integrations have done it for years — but the shape has changed. An agent makes many small decisions quickly, in an order nobody specified in advance, and the blast radius of a wrong one is larger than a webhook getting confused.
The temptation is to hand it the user's session. It works immediately, and it means the agent can do everything the person can do, forever, with no record distinguishing the two.
Three properties worth insisting on
Scope: the token names what the agent may do, and it is a subset of what the person may do — usually a much smaller one. Lifetime: it expires in minutes, not months, because an agent's task is short even when its deployment is long. Attribution: every action records both the person and the tool, so an audit trail can tell them apart.
With those three, revoking one tool does not sign the person out of everything, and answering 'what did this agent do last Tuesday' is a query rather than an investigation.
- Scope down: a subset of the user's permissions, chosen per task
- Expire fast: minutes, and renewed only while the task is live
- Attribute both: the person and the tool, on every event
Revoking one tool should not sign the person out of everything.
Consent has to be legible
A consent screen that says an application would like access to your account teaches people to click yes. If the grant is scoped, say what the scope is in words the person can evaluate: read your invoices, not manage your billing.
And make revocation visible and cheap. A list of what currently has access, with a button, is worth more than a paragraph in your security page.
The same primitives, applied honestly
None of this is a new discipline. It is the authorisation model you already need for multi-tenant software, applied to a caller that is not a browser and does not get tired.
The products that get this right will be the ones that let a security reviewer look at agent access the same way they look at employee access — a list, a scope, an expiry, and a log.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.