Inside the Protocol Securing AI Agents at Work - 🎙️ Making Software

Every time you tell an AI agent to do something and it pops open a browser asking for your permission, you're probably clicking yes without reading it. Miguel Pedregosa is a Senior Software Engineer on the Protocols team at Auth0 (Okta). His team owns the implementation of identity standards inside Auth0 — OAuth, OIDC, SAML, WS-Federation — the infrastructure every developer integrating with Auth0 relies on without thinking about it. Before Auth0, Miguel worked on malvertising detection, tracing malware hidden inside ad traffic. The through line in his career: security-intensive environments where getting it wrong has real consequences. In this episode we talk about what it's like to build infrastructure that millions of developers depend on without knowing it, how Cross-App Access and Enterprise-Managed Auth for MCP came to exist, and what it takes to implement an IETF standard that's still being drafted while industry adoption is already happening. We also get into the difference between what enterprises and startups actually need from identity — and why Miguel thinks basic threat modeling matters even if you never want to touch an RFC. What You'll Learn: - Why AI agent auth popups are a security flaw, not just a UX annoyance - How Cross-App Access uses an existing enterprise identity provider to let agents authenticate without opening a browser - What the IDJAG (Identity JWT Assertion Grant) is and why it's the central artifact of the protocol - What it's like to implement an IETF standard while it's still being drafted — and how Auth0's team fed back into the spec - The difference between what enterprises and startups need from identity: legacy system integration at scale - Why basic threat modeling is the minimum for anyone shipping AI agents, and the three questions to start with Resources: - Miguel on LinkedIn: https://www.linkedin.com/in/miguel-pedregosa/ - Cross-App Access blog post: https://auth0.com/blog/setting-up-testing-cross-app-access-auth0/ - Cross-App Access protocol: https://oauth.net/cross-app-access/ - IDJAG (Identity JWT Assertion Grant) spec: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-identity-assertion-authz-grant - Identity and Authorization Chaining Across Domains: https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-chaining/ Timestamps: 0:00 - Introduction: Meeting Miguel Pedregosa 2:40 - From healthcare to malvertising detection to Auth0 6:48 - When "invisible" is a compliment: identity as transparent infrastructure 7:45 - "If they don't notice, we're doing our job" 9:26 - Auth0's security-first culture: what "extremely paranoid" looks like day to day 11:26 - The problem Cross-App Access solves: agents, MCP, and enterprise identity 15:36 - The friction: why agents trigger five browser popups and why it matters 17:23 - How Cross-App Access fixes it: the identity provider as the authority 18:58 - The IDJAG: Identity JWT Assertion Grant explained 20:31 - Back-channel authentication: why no browser is needed 20:53 - Identity Chaining Across Trust Domains: the underlying IETF standard 21:37 - Non-interactive token chaining: how the initial auth state carries through 24:04 - Implementing a protocol that's still being written 25:03 - Industry adoption: Anthropic, Okta, Auth0, and the chicken-and-egg problem 25:52 - Shooting at a moving target: how the spec shifted during implementation 26:48 - Interacting with the people writing the IETF standard 28:01 - Developer DX vs. enterprise requirements: are they really opposites? 32:00 - What enterprises ask for that startups don't think about 33:21 - The 40-year-old system problem: where legacy meets modern identity 35:15 - Closing advice: basic threat modeling for anyone shipping AI agents If you enjoy this content and want to learn more about identity, security, and access management, subscribe to our channel! Have a topic you'd like to see covered? Let us know if the comments below 👀 ___________________________________________ 🔵Try Auth0 for free - https://a0.to/auth0 🔵The Auth0 blog - https://a0.to/blog 🔵Ask questions on the Community Forum - https://a0.to/community ___________________________________________ Follow Us on Social 🔵 X / Twitter - https://a0.to/twitter 🔵LinkedIn - https://a0.to/linkedin