How not to manage agent permissions

[Alan Karp]

and what I'm up against.

https://www.dock.io/post/know-your-agent-solving-identity-for-ai-agents-video-and-takeaways

There's a demo around 19:30 that implements something he earlier said was untenable.

--------------
Alan Karp

[William ML Leslie]

What's the plan?

Offhand: iwbni all this talk finally gets the airline booking websites to remove page after page of upselling. it sounds like the use case people are talking about for Agentic Spicy Autocomplete is dealing with adversarial UX.

--
You received this message because you are subscribed to the Google Groups "friam" group.
To unsubscribe from this group and stop receiving emails from it, send an email to friam+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/friam/CANpA1Z2kK9pYhHrg3mg-gsdJ1CWQpmmK9fR2sSJjx8yt0kbfow%40mail.gmail.com.

--

William ML Leslie

[Alan Karp]

On Thu, Dec 4, 2025 at 6:25 PM William ML Leslie <william.l...@gmail.com> wrote:

What's the plan?

I'm currently participating in a working group that is defining an access control model for AI agents.  The leading candidate is zcaps.  That would let you control which MCP tools your agent can use by giving it the right zcap.  

The competition is OAuth 2.1, which is running into all kinds of trouble as people find out all the ways it's not the right solution for this problem.

--------------
Alan Karp

To view this discussion visit https://groups.google.com/d/msgid/friam/CAHgd1hGiGary3yXGgyuyWADkfTQUYJbqq_kbr8z9%2B04GxX_7_g%40mail.gmail.com.