Summary
Ravi Madabhushi, co-founder of Scalekit, delivers a technical talk at AI Engineer examining how authentication and authorization systems built for human users are fundamentally ill-suited for AI agents. Drawing on ten years of identity platform experience—including building Freshworks’ identity infrastructure serving millions of daily users—Madabhushi walks through a real incident: Scalekit’s system was updating “last seen” timestamps 60 times faster than expected once agents began hitting their APIs, creating unnecessary database write pressure that revealed deeper architectural assumptions worth revisiting.
The core argument is that existing authentication primitives—OAuth, API keys, service accounts, and web session tokens—all assume the authenticating principal and the acting entity are the same, and that program behavior is deterministic. Agents break both assumptions. They act on behalf of users (a different principal), and their behavior is non-deterministic: you cannot inspect agent “code” the way you audit a traditional program. This creates a dangerous default pattern where developers grant agents far broader permissions and scopes than their actual responsibilities require.
Madabhushi calls for rethinking auth architecture from the ground up for agentic systems, advocating for fine-grained, context-aware delegated permissions rather than the static registration-time scopes that underpin current OAuth flows. The talk is essential viewing for platform and infrastructure engineers building identity systems that AI agents will increasingly depend on.
📺 Source: AI Engineer · Published July 19, 2026
🏷️ Format: Deep Dive
