Policy-Checked, Attributable, Revocable, Provable AI Agent Authorization

AI agents are entering production with long-lived API keys in their environment, broader access than any task needs, and no answer to the questions: Which agent performed this action? Under whose authority?

A single prompt injection, leaked credential, or runaway agent can quickly become a security incident. Security reviews delay deployments, and auditors are often left without sufficient evidence to understand what happened.

Existing security infrastructure was not designed for autonomous AI agents. Identity providers register agents but do not authorize every action, secret managers distribute credentials to workloads, and API gateways route requests without making authorization decisions.

This talk introduces Caracal, an open source AI authorization system currently being developed through the LFDT LFX Mentorship program and supported by GitHub, Microsoft, and Vercel. We'll discuss what authority means for AI agents, why authorization must move beyond credentials, and how we designed Caracal's architecture to provide policy-based authorization, attribution, revocation, and auditability for agent actions.

The session will cover:

• Why traditional API key and identity models are insufficient for AI agents
• What authority means in autonomous AI systems
• The architectural design behind Caracal
• Practical approaches to securing AI agents in production

The meetup will be presented by the Caracal team, Ryan Madhuwala and Shubham Sharma.

Our LFX mentees, Mohammad Ali Haider and Ashutosh Singh, will also present their work on the project. If you're interested in AI security and secure agent infrastructure, we'd be happy to have you join us.

Zoom Meeting Link: https://zoom.us/my/hyperledger.community.3?pwd=UE90WHhEaHRqOGEyMkV3cldKa2d2dz09

Please note: This event is being shared with our entire global community. If you're interested in this content but can't attend the event live, feel free to sign up and we will send you a link to the recording after the meetup is over.