Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard
Source
youtube.com
Author
AI Engineer
Date
Context
Clicking approve should not let an AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → exceed the approver's authority. In Keycard's staged on-call demonstration, a server restart remains blocked after approval because the user's role does not permit it. A scaling request succeeds when the user has the required authority.
The proposed architecture carries the user's identity through the agent's requests. An authorization service checks policy before issuing short-lived access credentials limited to the requested operation. This makes approval one input to an access decision, alongside who is acting and what they may do. The talk separately discusses intent-based authorization as a proposal; the narrated demonstration uses task-based policy.
Key takeaways · AI-distilled
In Maida's staged demo, an on-call agent holding standing API keys and admin database credentials drops a billing database, restarts a production server and scales a service from 4 to 40 pods, adding $420 an hour.
Maida argues a human approval button is not enough on its own: it cannot tell whether the approving user is actually authorized for that action. In her demo a server restart stays blocked after approval because the user's role cannot authorize it.
The fix she shows uses OAuth tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition → exchange: carry the user's identity through the agent and MCPThe Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.Full definition → server, evaluate policy at a security token service, and issue short-lived credentials scoped to the requested access.
Keycard's intent-based authorization is presented by Maida as a proposal, not a finalized standard, and she keeps authorization separate from whether the agent's answer is correct.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.
video1,000 Agent Tasks in a Sandbox: What Breaks When LLMs Run Code — Kevin Orellana, AWS
videoHow Inference Keeps Up with Our Insatiable Need for Tokens — Cerebras & Gimlet Labs
videoAuth for Agents: Let AI Sign Up for Your Product with auth.md — Michael Grinich, WorkOS
videoDecoupling the Brain from the Hands: Claude Managed Agents (Part 1 of 4) — Anthropic
