Agent Identity and Access: Building Secure Agentic Systems

Every enterprise is working out how to deploy AI agents. The hard part is deciding what those agents can reach, who they act as, and how you will know what they did.

Date
Wednesday, November 18, 2026
Time
12 PM Central / 1 PM Eastern Time
Length
1 hour

Agents that automate internal work or power product features need real access to APIs, databases, and MCP servers. Handing them long-lived credentials and hoping for the best does not survive a security review.

In this session, Jake Hulberg walks through a practical architecture for securing agents in systems you build and run yourself: giving agents access without exposing secrets, scoping exactly what they can do, reasoning about agent identity, and tracing every action back to a person and a session. We will close with a live demo using Infisical Agent Vault.

What you will learn

  • Credential exfiltration: Why agents should not hold secrets, and how credential brokering through a proxy lets them call services without ever seeing a key.
  • Permissions: Granting access by intent, filtering endpoints and MCP tools, and having agents act on behalf of the human who invoked them.
  • Agent identity: How agent identities relate to machine identities, and a pattern where an orchestrator assumes a machine identity and mints short-lived session tokens for each agent.
  • Telemetry: Seeing which orchestrator started which agent, on whose behalf, and every HTTP request and MCP tool call it made.

Who this is for

Platform, security, and AI engineers building in-house agents or agentic product features, and anyone working on agent harnesses or AI infrastructure their company owns and runs.

Speakers

  • Jake Hulberg
    Jake HulbergDeveloper Relations, Infisical (presenter)
  • Kate Neuens
    Kate NeuensMarketing Lead, Infisical (moderator)