AgntID

AgntID provides runtime access control enforcement that scopes permissions dynamically based on both policy and task intent for AI agents

[AgntID @hiagntid]

@hiagntid is teaming up with @devfolio to bring together experienced professionals for a hands-on hackathon in Bengaluru on 10 October.

Build an AI Agent You’d Actually Trust. And there’s a MacBook Neo up for grabs as the grand prize 🏆

Apply now 👇
https://t.co/8JVNobIPqY

[AgntID @hiagntid]

@szzeth The DSN is not the security boundary. The boundary shifts when Sentry events become input to an agent through MCP.

The issue is that untrusted operational data can become instructions inside the agent loop. The control has to sit at runtime

[AgntID @hiagntid]

@RabehArch @elliehuxtable What the terminal has seen and what the agent should be allowed to retrieve are two different things. I’d default-deny older history and grant access only when it’s relevant to the current task.

[AgntID @hiagntid]

@loftyarcher @LesOttolenghi That’s the tricky part. IAM can own the identity lifecycle and revocation, but the workflow owner still needs to define what does valid action looks like

[AgntID @hiagntid]

4/ Most agent security today watches the action. Runtime access control watches the authority behind it, at the moment the call happens.

[AgntID @hiagntid]

3/ A wide credential, alive for the whole session and reusable across tasks, turns the same mistake into a breach.

Action decides what gets attempted. Authority decides how far it reaches.

[AgntID @hiagntid]

2/ What decides whether that mistake stays small is what the agent was allowed to do at the moment it happened.

A scoped credential, built for one task and gone once the task ends, turns a bad tool call into a blocked attempt.

[AgntID @hiagntid]

1/ Everyone debugs the tool call an agent made. Almost nobody audits the credential sitting behind it.

An agent picks the wrong tool. Or the wrong target. Or the wrong parameters. That's a mistake, and any system taking autonomous action makes them eventually.

[AgntID @hiagntid]

That's the shift runtime authorization makes. Access follows the task, not the login.

[AgntID @hiagntid]

Most agent permissions get scoped to the session. Log in once, and the agent walks away with read_customer, read_billing, issue_refund, update_crm, send_email, all live for as long as the session lasts.

[AgntID @hiagntid]

Least privilege was never meant to mean "everything this session was ever granted." It meant access matched to the work being done. Sessions stay static. Tasks change from one call to the next, and the access boundary should change with them.

[AgntID @hiagntid]

Agents don't stop at the door, they authenticate once and then take hundreds of actions with standing privilege, and none of that perimeter enforces least privilege at the one point it actually matters, the tool call.

[AgntID @hiagntid]

Two decades of security spend went into authentication. Identity, MFA, session, SSO, all solving who gets through the door.

[AgntID @hiagntid]

For agents, authorization has to move closer to the action itself.

OAuth secures the connection. Runtime authorization secures what gets executed.

[AgntID @hiagntid]

OAuth can prove an agent has access to an MCP server.

It can’t decide whether every tool call inside that session should be allowed.

That’s where things get tricky. A valid session can still carry the wrong tool, resource, parameters, or too much privilege.

[AgntID @hiagntid]

No injection or no jailbreak is needed for this. Just a tool call that happened to be allowed when it shouldn't have been. Detection guards the input. It never looks at the tool call itself, the arguments, or the resource being touched.

[AgntID @hiagntid]

Prompt injection detection checks if the input looks malicious. Authorization checks if the action is allowed. Those are two different questions

An agent can read a completely clean prompt and still call merge_pull_request or export_customer_data with the wrong scope.

[AgntID @hiagntid]

Access control used to be IAM's job. Now it's done by developer

It happened one agent at a time.

The gap shows up the first time an agent writes somewhere it shouldn't.

IAM owns identity. It doesn't own what an agent does with a tool. That lives in code now, not policy.

[AgntID @hiagntid]

System prompts guide an agent. They don't stop it from calling a tool it shouldn't.

A prompt can't restrict which tools an agent touches, narrow its credentials, or block a bad call before it runs.

Every tool call needs an authorization decision before it executes.