Build AI Agents with Auth0 at Okta explored agent security during SF Tech Week. It connected with the conversations I was having about context, memory and scaling agents.
The advertised program included Token Vault, asynchronous authorization, fine grained permissions and MCP authentication.
What stood out
Signals and founder implications
| Signal | What founders can carry forward |
|---|---|
| Ask what the agent is allowed to do | The event put agent security alongside the work of building agents. The design question I want to take forward is what an agent should be able to access or change in a real workflow. |
| Consider connected tools explicitly | The program’s identity and authorization topics point to questions about how an agent connects to other systems. My follow up questions are whose identity is being used, which permissions apply and how access can be removed. |
| Connect permissions with context and memory | Across the week, I learned about what AI should remember and carry between tools. Those conversations make the permission question more concrete: being able to retrieve context is different from being authorized to use it for every action. |
Thank you to Auth0, Okta and the organizers for the session.
Can your team explain which identity and permissions each agent uses when it reaches a tool?
Quick answers
Questions founders may ask
What topics were advertised for the Auth0 event?
Token Vault, asynchronous authorization, fine grained permissions and MCP authentication were listed in the program.
What questions am I taking forward about agent permissions?
Whose identity does the agent use, what can it access or change, and how can access be removed? These are questions to work through for the actual workflow.