# Agents, Access, and the Future of Machine Identity

Nick Nisi, WorkOS & Lizzie Siegle, Cloudflare | AI Engineer World's Fair 2025 | 14:17

Source: https://www.youtube.com/watch?v=px2e2OOS2Sk
Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks.
Page: https://aietalks.com/talks/agents-access-and-the-future-of-machine-identity
Published: 2025-06-30
Tags: agents, mcp, security, tool-use

## TL;DR
- Agents need credentials and authorization patterns that let them act on behalf of people while remaining auditable.
- An MCP server can use OAuth, user information, and per-user durable storage to control what an agent can do.
- Authorization will need to become more fine-grained as agents perform more tasks, with records of who acted, why, and what happened.

## Summary
Lizzie Siegle and Nick Nisi demonstrate an MCP server built with Cloudflare and WorkOS. The example lets Claude authenticate through GitHub, act on Lizzie's behalf, inspect a shirt inventory, and place an order. The system stores order data in Cloudflare KV and combines identity information from a JWT with per-user state in a Durable Object. A mode stored in that object can block a later order, while a separate "pretty please" tool allows one after the agent asks politely. The demo supports the speakers' larger point that OAuth and authorization should apply to agents as they act for users, rather than treating them as anonymous automation. They describe future authorization at the level of individual tools, line changes, and connections between systems. Audit records should show whose behalf the agent acted on, why it interacted with a system, the result, and where it failed.

## Key ideas
### Agents need ordinary identity and authorization controls
[01:57](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=117s)
Nick argues that agents should receive the same kind of credentials and authorization used in user-facing applications. His GitHub MCP example can read reviews and diffs, but configuring MCP tools through a JSON file is difficult for non-developers. WorkOS focuses on authorization and user management so an agent can act on a person's behalf through a more familiar setup. He describes OAuth as applying to agents as well as humans, with more detailed controls added later.

### Cloudflare provides storage and bindings for agent systems
[02:16](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=136s)
Lizzie explains that Cloudflare's agent setup can combine Workers, hosted AI models, vector and SQL databases, and Durable Objects. Durable Objects are used in their agents framework to maintain memory. Bindings let an agent or web application interact with Cloudflare products and other services. The Cloudflare agents framework also includes an OAuth framework that helps identify the worker or agent and the person it is acting for.

### The demo connects Claude to an authenticated MCP server
[04:30](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=270s)
The speakers deploy a basic MCP server built with Cloudflare and WorkOS. Lizzie copies the deployed Worker URL into Claude as an integration and signs in with GitHub. After authentication, Claude discovers the available tools. The agent lists the inventory at MCP Shop, collects a shirt size, company name, and mailing address, and places an order. The flow shows an agent using a user's identity rather than operating as an unaccountable anonymous process.

### Agent actions can write application data and read identity claims
[07:57](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=477s)
The order is saved in Cloudflare KV storage after Claude submits it. Lizzie then asks Claude what it knows about her. A get-user-info tool returns information from her JWT, including her name, email address, favorite song, and admin permissions. This gives the agent both identity claims and access to application tools. The example makes the permission boundary visible because the agent can use the information attached to the authenticated user.

### Per-user Durable Object state can change what an agent is allowed to do
[09:40](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=580s)
Lizzie describes Durable Objects as fast storage that can be created per user and kept close to that user. She asks the MCP server to change the demo mode to "ban". That tool updates the context associated with the worker object. When she asks for another shirt, the server rejects the request. The server can combine information from the user's JWT with state stored specifically for that user, so a later action depends on both identity and current application state.

### Simple authorization rules can still produce unexpected agent behavior
[10:59](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=659s)
The demo includes a separate "pretty please" tool. After Lizzie asks nicely, Claude uses it and places another order. She calls this prompt engineering, while the example shows that an agent may have several tools with different conditions. The speakers also warn that a one-click Cloudflare MCP deployment can be created without authorization. It is fast to deploy, but they explicitly say that version should probably not be used for a real protected system.

### Future authorization will need finer-grained decisions and audit trails
[12:23](https://www.youtube.com/watch?v=px2e2OOS2Sk&t=743s)
Nick expects authorization to move beyond broad access to an MCP server. Possible decisions include approval for individual tools, line changes, or connections between systems. He also says agents may eventually perform thousands of tasks on a user's behalf, which makes audit data necessary. Operators should be able to see why an interaction happened, whose behalf the agent acted on, its result, and where it failed. He suggests thinking of users as deputies with access to tools that they can also misuse.

## Notable quotes
- "We need the same kind of credentials and authorization that we do with user-facing projects." (01:57)
- "Think of your users not as users but as deputies they have access to tools and they can use and also misuse them as well." (13:02)
- "This auth piece is going to be very important, and especially the audit trail as well." (12:43)
- "It knows my name. It knows my email address." (08:47)

## Tools & references mentioned
- WorkOS
- Cloudflare
- GitHub MCP
- MCP
- Cloudflare Workers
- Cloudflare Agents framework
- Durable Objects
- Cloudflare KV
- Claude
- Wrangler
- OAuth
- JWT
- MCP Shop

## Who should watch
- You are building MCP servers or agents that call APIs on behalf of signed-in users and need a concrete authentication flow.
- Your agent needs memory, user-specific state, or permissions that can change after deployment.
- You need to plan audit records for agent actions and decide whether broad tool access is too permissive.

## Related talks

- [Better Auth](https://aietalks.com/talks/better-auth) (Bereket Habtemeskel & Paola Estefania, Better Auth, 40:56)
- [The Rise of the Agentic Economy on the Shoulders of MCP](https://aietalks.com/talks/the-rise-of-the-agentic-economy-on-the-shoulders-of-mcp) (Jan Curn, Apify, 18:08)
- [IT Admin for the AI Workforce](https://aietalks.com/talks/it-admin-for-the-ai-workforce) (Sarthak Aggarwal, Decawork, 16:17)
- [CIAM for AI: Authn/Authz for Agents](https://aietalks.com/talks/ciam-for-ai-authn-authz-for-agents) (Michael Grinich, WorkOS, 20:13)
- [Building Agents (the hard parts!)](https://aietalks.com/talks/building-agents-the-hard-parts) (Rita Kozlov, Cloudflare, 21:12)