Paola Estefania presents a draft Agent Auth protocol that separates an agent's authority from the user's credentials. She describes three linked problems: discovering services, authorizing specific capabilities and identifying which agent acted for which user and host. A directory exposes operations through OpenAPI descriptions without proxying the underlying data.
The workshop connects a server plugin, SDK and MCP integration in a Gmail demonstration. Reading and sending are separate capabilities, with additional approval required to send. Agent keys, user-linked grants and activity logs make actions attributable rather than indistinguishable from ordinary account use.
Revocation is demonstrated at the individual-agent level. A replacement identity can still register with default reading capabilities, so the example is not a blanket guarantee that revoking one agent eliminates every access route. Estefania discusses time limits and host policies, emphasizing usable controls that avoid unnecessary prompts for low-risk actions. Further enterprise controls remain planned work for the evolving protocol.
Watch on YouTube
