Episode 210: Attenuating Agentic Delegation Tokens
AI agents increasingly delegate work across chains of agents and tools—but today’s OAuth tokens often carry more authority than each step actually needs. This episode explores Attenuating…
Identerati Office Hours
Identerati Office Hours episodes
A livestream about identity standards and the people who write them. Every episode is archived here.
Episode 209: The 7 Laws of AIdentity
AI agents do more than present identity—they generate intent, delegate authority, invoke tools, and create real-world consequences. In this episode, Patrick Parker joins us to discuss his proposed…
Episode 208: Proof of Continuity: From Capabilities to Continuous Authority
In distributed systems and AI agent workflows, the next executor may not yet exist—so identity-based delegation cannot fully explain why a later action remains authorized. Proof of Continuity…
Episode 207: Book Club: The Proof in the Code
Can a computer prove something is unquestionably true? In this episode, we discuss Kevin Hartnett’s The Proof in the Code and the rise of Lean from a Microsoft Research project to a powerful tool for…
Episode 206: Non Fungible Bitcoin
Most money is fungible--in the past, one would say this was true by definition. But what happens when digital money like Bitcoin starts carrying identity, reputation, provenance, and policy with it?…
Episode 205: The Authentic Identity Challenge
Deepfakes are getting better. Are our identity defenses keeping up? In this episode, we explore the split between identity matching and liveness detection, why certifications don't tell the whole…
Episode 204: OAuth Client Challenge Protocol
OAuth assumes a client presents the right grant and gets a token. But what happens when the authorization server needs more proof mid-flight—an attestation, a verifiable presentation, or evidence…
Episode 203: We Solved Identity. Then We Hired Agents
For years we told ourselves identity was solved. We know who you are, we know what you're allowed to do, ship it. Then we hired agents that act on their own, and the tidy story started to fray.…
Episode 202: When Identity Isn't Enough: Securing AI Agents at Runtime
AI agents authenticate with valid credentials, pass MFA, and then commit fraud — bulk data exports, cross-tenant queries, unauthorized payments — all with a clean token. The identity layer tells you…
Episode 200: Why Agentic AI Forces a Rethink of Least Privilege
AI agents don’t follow static workflows, which means traditional “least privilege” models quickly collapse into overpermissioned chaos. This IOH will explore why task-scoped authorization is…
Episode 199: What is the GovOps ACC (Authorization Capability Catalog)
This episode explores the Authorization Capability Catalog (ACC), a GovOps YAML model that maps enterprise capabilities to risk, controls, and compliance objectives. Instead of centering governance…
Episode 198: Mix-Up Attacks in MCP: Multi-Issuer Confusion and Mitigations
MCP deployments increasingly involve multiple authorization servers / identity providers across tools, registries, gateways, and enterprise environments. That flexibility introduces a classic but…