Identity for AI Agents and MCP Authorization

Make your product safe for AI agents to use and your own agents safe to run: an OAuth resource server and MCP authorization that follow the current spec, on-behalf-of tokens from a vault, human approval for consequential actions, and an audit trail that names both the person and the agent.

Overview

AI agents now call products on behalf of their users, and products now run agents of their own. Both break assumptions that identity systems were built on: that the caller is a person, that consent happens in a browser, and that one session means one actor. We design and build the identity layer for both directions on AWS — with Cognito, Auth0, Okta or your own authorization server — following the MCP authorization specification as it stands after the July 2026 revision.

What we do

Agents calling your product

• OAuth 2.1 resource server for your API and MCP server: Protected Resource Metadata (RFC 9728), audience validation, scopes per tool

• Client ID Metadata Document support, with Dynamic Client Registration only for older clients

• Cross App Access for enterprise customers whose IT wants to govern agent access centrally

Your agents calling other services

• On-behalf-of tokens from a vault — Amazon Bedrock AgentCore Identity or Auth0 Token Vault — scoped to the user and the task

• Human approval for consequential actions through CIBA or in-app confirmation

• Deterministic policy checks on every tool call (AgentCore Policy or your own)

Around it

• Signed-agent and bot policy for your public site, and Turnstile or WAF Bot Control on sign-up and login

• Audit logging with both identities, and alerts on unusual agent behaviour

Deliverables

• The authorization server configuration, resource-server middleware and policies, in your repositories

• A threat model for agent access, and a runbook for revoking an agent's access in minutes