Your AI agents are doing things you didn't ask them to do. The question is: did you give them permission?

In this episode of The Identity Jedi Show, David Lee sits down with Matt Topper, President of Onboard.ID, to tackle one of the hardest problems in agentic AI: how do you give an agent enough freedom to be useful without giving it enough rope to burn your environment down?

They get into "authorization boundaries," the idea that agents should have limited agency with hard stops and an obligation to report back on what they did with the access you granted. Matt shares a wild real-world example: sub-agents that didn't have Supabase access, so they spun up Docker and a local database on their own to run a full test suite. Impressive? Absolutely. Terrifying without boundaries and audit trails? Also yes.

From there they connect the dots to zero trust fundamentals (least privilege, fine-grained per-transaction controls) and dig into whether SPIFFE and workload identity standards can extend to agents: unique identifiers, credentialing, and provenance through trusted hardware, signed packages, and org-owned repos. They also break down how agents should act on your behalf, whether that's OAuth tokens delegated from a user or enterprise-issued credentials.

Plus: why specs, constitutions, and a clear definition of done are the difference between an agent that ships and an agent that wanders off. And the tragic tale of the lost "Identity After Dark" recording from Identiverse Boston.

In this episode:
How authorization boundaries give agents agency without chaos | Why obligations and reporting are the missing piece of agent access | Mapping SPIFFE and workload identity to AI agents | OAuth, delegation, and enterprise tokens for agents | Spec-driven development: constitutions, scope, and definition of done | The real cost of agent tooling and where guardrails pay for themselves

Chapters:
00:00 Season Four Intro
00:29 Authorization Boundaries
02:14 Docker Surprise Demo
04:13 Obligations and Zero Trust
05:01 SPIFFE for Agents
07:54 OAuth and Credentialing
10:15 AI Native Building Specs
11:22 Agent Constitution and Scope
13:36 Tooling Costs and Guardrails
14:51 Identity After Dark Story
17:00 Wrap Up and Farewell

Connect with Matt Topper:
LinkedIn: https://www.linkedin.com/in/matttopper/
Onboard.ID: https://onboard.id/

Join the Identity Jedi community:
Newsletter: www.theidentityjedi.com

#IdentityJedi #AgenticAI #NonHumanIdentity #SPIFFE #ZeroTrust #IAM #AISecurity #Cybersecurity #WorkloadIdentity