Agents changed the shape of the problem. A human signing in is a single decision made once; an agent acting on someone's behalf is a decision that has to hold for every call it makes afterwards, often hours later, often without anyone watching.
This piece walks through how we think about it at Paycux, what we have changed our minds about, and where the sharp edges are.
Why LLMs need their own Top 10
Why LLMs need their own Top 10 is where this gets concrete. The audit trail matters more here than in any human flow. When something goes wrong, the question is never "did the user intend this" in the abstract — it is which agent, acting under whose authority, made which call, and whether the record can prove it.
An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
LLM01: Prompt injection
Consider llm01: prompt injection. Consent is the part most implementations get wrong. Asking once at install time and then acting indefinitely is not consent; it is a standing grant with no expiry and no visibility.
The audit trail matters more here than in any human flow. When something goes wrong, the question is never "did the user intend this" in the abstract — it is which agent, acting under whose authority, made which call, and whether the record can prove it.
- Scope every agent credential to one principal and one task
- Give tokens minutes of life, not days
- Record which agent acted, under whose authority, on what
- Make revocation a single call that takes effect immediately
LLM02: Sensitive information disclosure
LLM02: Sensitive information disclosure is where this gets concrete. An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
LLM03: Supply chain
LLM03: Supply chain is where this gets concrete. An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
An agent's credential should describe what it may do, not who owns it.
LLM04: Data and model poisoning
LLM04: Data and model poisoning is where this gets concrete. An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
LLM05: Improper output handling
LLM05: Improper output handling is where this gets concrete. The audit trail matters more here than in any human flow. When something goes wrong, the question is never "did the user intend this" in the abstract — it is which agent, acting under whose authority, made which call, and whether the record can prove it.
An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
LLM06: Excessive agency
LLM06: Excessive agency deserves its own treatment. An agent's credential should describe what it may do, not who owns it. Scope it to the narrowest set of operations that make the task possible, bind it to a single principal, and give it a lifetime measured in minutes rather than days.
The audit trail matters more here than in any human flow. When something goes wrong, the question is never "did the user intend this" in the abstract — it is which agent, acting under whose authority, made which call, and whether the record can prove it.
Where this leaves us
If there is one thing worth taking away, it is that the expensive decisions are the ones made implicitly. Making them on purpose costs an afternoon.
If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.