- Kim Maida argued that asking a human to approve an agent's action does not replace access control. The approver's own rights must be checked by policy.
- In her staged demo, an approved server restart was still blocked because her role lacked permission. A scale-up her role allowed went through.
Kim Maida of Keycard made a plain point on the AI Engineer show: an approval button is not access control. Asking a person to click approve only helps if policy first decides what that person may approve. Without that, an agent's broad access becomes the human's problem.
What was said
Maida ran a staged on-call triage demo. The agent held long-lived API keys and database credentials. The audit log could not show who used those keys. She said these incidents happen because people give agents far more access than the work needs.
Her objection to approval prompts was direct. She said, "Forcing a human-in-the-loop approval just kind of passes the access control on to a consent fatigue user." The security problem moves up to the person clicking.
Her fix was token exchange, a standard from 2020 that extends OAuth 2. OAuth is the common system for granting apps access. The user logs in and hands over only some of their permissions. The agent then gets short-lived access scoped to one task.
In the demo, the agent asked to restart the main server. Maida clicked approve. Policy blocked it, because her user lacked the needed role. She put it this way: "So the agent can't do it, but I can't do it either and the agent is acting on my behalf." A request to add servers, which her role allowed, went through.
Why it matters
Our reading: an approval step is only as strong as the rules behind it. If the prompt is the only gate, the person who clicked carries the blame. They may never have been entitled to make that call. Buyers of agent tools can ask three questions. Is the agent's credential tied to a named user? Does the system check the approver's own rights? Can the audit log show who did what?
The other side
Maida works at Keycard, which sells in this area, so her fix is also her employer's pitch. The demo was staged. The excerpts do not show how much work it takes to set up roles and policies. She also named limits. Many agents run on their own with no human at all. And she said policies are ceilings, so agents can still do unintended things within what policy allows. Token exchange narrows access, but the excerpts do not claim it makes the agent behave.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: Your Agent Is a Lethal Trifecta (And What to Do About It) — Kim Maida, Keycard (2026-10-12)
