For years, we've designed microservice architectures around a relatively simple assumption:

An authenticated user interacting with an application is generally the person making decisions and initiating business operations.

Our security models reflect this assumption. We authenticate users, issue access tokens, validate permissions, enforce business rules and allow authorised operations to proceed.

But what happens when an AI agent starts interacting with our applications on behalf of users?

This is not a niche concern. Agents integrated through the Model Context Protocol (MCP), agents holding delegated OAuth access, AI tool integrations embedded in platforms like Slack or GitHub, and AI assistants operating through an already authenticated browser session all expose the same architectural weakness.…