An AI agent should get its own capped token, never the user's

An AI agent that borrows a user's own login token inherits everything that user can do. Isabelle Williams, a product manager at WorkOS, argued on the AI Engineer show that apps should issue agents a separate, narrower token instead.

What was said

Williams used a demo travel app called Waypoint. A user named Jordan manages a team travel budget. She built a fund agent that moves money between team members. Jordan wants it to work freely inside the budget and approval rules, but never to change them.

Her app therefore issues the agent its own token. She said, "it's really important to me that I don't just hand an agent Jordan's user token." She gave three reasons: auditing, revocation and limiting what the agent can do. Revocation means her app can switch off the agent without touching Jordan's session or access.

The limit comes from a blueprint, which she described as a ceiling of access for each kind of agent. The token's scopes, meaning the specific actions it allows, are the overlap of Jordan's permissions and that ceiling. The token also names the agent and records that it acts for Jordan.

In the demo, Alex had a $250 shortfall. The agent moved $70 and stopped, because no budget was left. Jordan raised the budget himself with his own token. Then the agent finished the job. Of the fund agent, Williams said, "It can't change the budget. It can't change the approval rules to make things work." The demo itself showed only the budget limit.

Why it matters

Our reading: when an agent runs on the user's token, its mistakes carry the full reach of that person. A ceiling set in advance limits what the agent can do before it ever runs.

For anyone building or buying software with built-in agents, the talk suggests three questions. Does the agent have its own identity? Do logs show which actions came from the agent and which from the person? Can you switch off one agent without logging the user out?

The other side

This was one speaker's demo of her own small app, built with a WorkOS product she pointed the audience to. It shows the budget limit holding. It did not show an agent going wrong, or how the design holds up in a large company.

The ceiling is only as good as the blueprint. The excerpts did not cover how to choose scopes, or what happens when a blueprint is drawn too wide.

The design also costs some convenience. The agent hit its limit and waited for a human. Williams treated that as the point, but teams that want agents to run unattended will feel it.