AI Agent Security · Secure AI Agents
Every AI agent gets an identity and clear limits
Agents call APIs, read data and act for people. We give each one its own Keycloak identity, issue tokens scoped to the task and valid for minutes, and make delegation explicit — so you always know which agent did what, and for whom.
- An identity per agent
- Scoped, short-lived tokens
- Delegation you can audit
Standards & integrations
- OAuth 2.1
- Client Credentials
- Token Exchange (RFC 8693)
- OpenID CIBA
- JWT
- Mutual TLS
Overview
Treat agents as first-class identities
The quickest way to wire an agent to an API is to hand it a user's token or a long-lived key. Both make agents invisible: you can't tell agent actions from human ones, and you can't limit or revoke one agent without breaking something else. On Keycloak, each agent is a client with its own credentials. It gets narrow scopes and short token lifetimes, and when it acts for a person it uses token exchange to get a token that carries the user as subject and the agent as the requesting client.
What we deliver
- Agent inventory and access model
- Keycloak clients and credentials per agent
- Scope and audience design per API
- Token exchange configuration for delegated access
- CIBA approval flow with a notification channel
- Monitoring and revocation runbook
Capabilities
What Secure AI Agents covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
One client per agent
Each agent has its own Keycloak client and credentials — a secret, a signed JWT or a certificate — so it can be limited, rotated or disabled on its own.
Least-privilege scopes
Client scopes and audiences restrict each token to the APIs and actions the agent actually needs, not everything the user could do.
Short-lived tokens
Access tokens valid for minutes, with Keycloak's revocation and introspection endpoints available to APIs that need a live check.
Delegation through token exchange
When an agent acts for a signed-in user, it exchanges the user's token for a narrower one aimed at a single API, using Keycloak's standard token exchange.
Human approval for risky actions
With OpenID CIBA, an agent asks for a token and the user approves on their own device first. Keycloak runs the protocol; we build the channel that reaches the user.
Every call attributable
Keycloak events record which agent obtained which token and for which user, and the same identifiers appear in your API logs.
Compatibility
Agent access patterns
How common agent designs map onto Keycloak features.
| Platform | Integration | Notes |
|---|---|---|
| Autonomous agent, no user | Client credentials with a service account | Roles are assigned to the agent itself; rotate secrets or use signed JWTs. |
| Agent acting for a signed-in user | Standard token exchange (RFC 8693) | Downscoped token for one audience, with the user as subject and the agent as client. |
| Agent needing human sign-off | OpenID CIBA | Keycloak runs the protocol; delivering the approval request needs a channel we build. |
| Agent calling MCP servers | OAuth 2.1 authorization code with PKCE | Covered in detail on the MCP Authorization page. |
| Agent-to-agent calls | Token exchange per hop | Multi-hop delegation needs careful audience design; we confirm requirements before building. |
How it works
From first call to production
Inventory agents and what they touch
We list each agent, its owner, the APIs and data it reaches, and whether it acts on its own or for a user.
Design identities, scopes and delegation
Clients, scopes, audiences, token lifetimes and approval rules are designed per agent and defined as code.
Wire agents and APIs, then monitor
Agents switch to their own credentials, APIs validate audience and scope, and events flow to your monitoring.
Use cases
Where teams put it to work
Internal copilots over company data
Copilots act for employees with a subset of their permissions, never more, and every request is traceable to both.
Autonomous back-office agents
Scheduled or event-driven agents run on service accounts with narrow scopes instead of borrowed human credentials.
Customer-facing agents
Agents that act for your customers get consent-based, downscoped access, with approval before anything consequential.
FAQ
Secure AI Agents questions, answered
Should an agent just use the user's own token?
No. Passing the user's token lets the agent do anything the user can, anywhere that token is accepted. Token exchange gives the agent a narrower token for one API, and your logs show the agent was involved.
How do we stop a misbehaving agent?
Disable its client or rotate its credentials in Keycloak and revoke its tokens. Short token lifetimes mean anything already issued stops working within minutes.
Can a person approve an agent's action before it happens?
Yes, with OpenID CIBA: the agent asks Keycloak for a token, Keycloak asks the user to approve on their device, and only then issues it. We build the channel that delivers the approval request.
Ready to roll out Secure AI Agents?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.