The web has fundamentally changed. In 2020, we had humans interacting with HTML forms and software consuming APIs.
Today, we’re adding a third category: AI agents. These agents sit between humans and traditional software, combining workflows, large language models, and API requests to accomplish tasks autonomously or semi-autonomously.
As agents become more common, authentication and authorization strategies must evolve to handle this new paradigm. In this post, you’ll learn about common agent protocols, authentication patterns, and critical security considerations when building agent-enabled applications.
What Are AI Agents?
An AI agent is more than just a chatbot. It’s a workflow powered by LLMs that can make API requests and take actions on behalf of users or other agents. Think of agents as existing in the overlap between humans and traditional software—they’re non-deterministic like humans but fast like software.
Examples of agents include:
- Conversational interfaces like Claude Desktop or ChatGPT that can access tools and APIs
- AI-powered IDEs like Cursor that write code based on natural language instructions
- Command-line tools like Claude Code that delegate coding tasks
- Semi-autonomous actors that can book travel, schedule meetings, or manage tasks with minimal human oversight
Agents can be simple two step workflows (“Claude, please review this article against this knowledge base for veracity”) or multi-step and complex (“please book a trip to Hawaii, find a good hotel and make some dinner reservations at a BBQ restaurant”).
Agents can act on their own behalf, on behalf of individual users, or on behalf of users and other agents in complex workflows. This flexibility creates new authentication challenges.
Common Agent Protocols
As the agent ecosystem matures, several protocols have emerged to standardize how agents communicate and authenticate.
Agent-to-Agent (A2A) Protocol
The A2A protocol is designed for enterprise-ready agent communication. Importantly, A2A is authentication neutral—it delegates authentication to standard web mechanisms like HTTP headers, OAuth 2.0, and OpenID Connect. Authentication requirements are advertised by the A2A server in its Agent Card, allowing calling agents to understand what credentials they need.
A2A tends to be more enterprise-focused, offering structure needed for business-critical agent workflows.
Model Context Protocol (MCP)
The Model Context Protocol, created by Anthropic, allows AI applications to connect to external data sources and tools. MCP has become popular with SaaS providers—companies like Google, Jira, and GitHub have all launched MCP servers to make their services agent-accessible.
MCP supports multiple deployment models which affect authentication:
- Local deployment uses environment variables for configuration, suitable for single-user scenarios or development environments.
- Remote deployment leverages OAuth 2.1 for user authentication and authorization. This is the recommended approach for production systems where agents need to access user data from external services.
Companies are embracing MCP because it provides a standardized way to expose their functionality to the growing ecosystem of AI agents and LLM-powered applications.
Direct Access
Beyond specialized protocols, agents can also interact with traditional REST APIs, browser automation tools like Playwright, or custom integration methods. With these solutions, the authentication approach depends on the specific tools and technologies used.
The Authorization Challenge
While protocols like A2A and MCP provide authentication mechanisms, authorization remains a critical and often underspecified concern. The core principle: never let an agent be indistinguishable from a user it represents.
The Lethal Trifecta
Security researcher Simon Willison describes the “lethal trifecta” of AI security risks:
- Access to private data - The agent can read sensitive information
- Ability to externally communicate - The agent can make API calls or send data
- Exposure to untrusted content - The agent processes user-provided or web-scraped input
When all three factors combine, you create conditions for data exfiltration, unauthorized actions, and security breaches. This is especially dangerous when agents can act with the full privileges of the user who authorized them.
Applying the Principle of Least Privilege
Traditional software security principles apply to agents, but with additional considerations:
- Scope agent permissions narrowly: an agent that books travel doesn’t need access to financial records
- Make agents identifiable: your audit logs and monitoring should distinguish between user actions and agent actions
- Implement proper authorization models: use role-based access control (RBAC), attribute-based access control (ABAC), policy-based access control (PBAC), or relationship-based access control (ReBAC) as appropriate for your domain
- Never use full user credentials: agents should use separate credentials with limited scope
Security Concerns Beyond Authentication
Authenticating and authorizing agents is just the beginning. Production systems need to address several operational concerns.
You need auditing. Log all agent actions separately from user actions. You need to know when an agent made a decision or called a service versus when a human did.
Don’t sleep on rate limiting. Agents can make requests much faster than humans. Implement rate limits appropriate for automated actors to prevent resource exhaustion and to minimize the blast radius of bugs.
Of course, don’t forget monitoring and observability. Track agent behavior, success rates, and error patterns. Agents that start behaving unexpectedly may indicate security issues or bugs.
Finally, consider resilience. Agents often depend on external APIs and LLM services. Build in retry logic, fallback behaviors, and graceful degradation when dependencies fail.
A Decision Framework
When integrating agents into your application, work through these questions:
- Who is the actor? Is this an agent acting independently, on behalf of a user, or on behalf of another agent?
- What agent protocol is being used? A2A, MCP, direct access, or something else? Each has different authentication patterns.
- What is the authorization model? How do you determine what actions the agent can take? Are permissions scoped appropriately?
- Have operational concerns been handled? Have you implemented auditing, rate limiting, monitoring, and resilience patterns?
Next Steps for Your Organization
If you’re building applications that will interact with agents—or building agents yourself—start by assessing your current state:
- Ask your teams what agents they’re already using
- Identify the tasks agents are accomplishing and what data they access
- Determine if teams are using integration protocols like A2A or MCP
- Document your current authentication model for both SaaS integrations and internal data access
- Verify that agents are distinguishable from users in your logs and monitoring
- Define your authorization strategy for agent access
- Plan how to integrate agent access into your current security model
The shift to an agent-enabled web is already happening. By thinking through authentication, authorization, and operational concerns now, you enable your organization to safely leverage AI agents while maintaining security and compliance.
The future of the web includes humans, traditional software services, and agents all working together.
Make sure your authentication strategy is ready for all three.
