Moving AI Agents Beyond OAuth Tokens with Hardware-Bound Identity

AI agents are getting real access to APIs, tools, and sensitive data, often taking actions without a human in the loop. As that access grows, so does a fundamental identity problem: how do you prove what’s actually executing the request?

Authorization tells you what an agent can do, but Oauth Tokens and API keys can be stolen, copied, or replayed. They don't necessarily prove that a request is coming from the trusted agent or workload you intended.

In this live demo, we'll show how Smallstep uses hardware-bound device identity to establish stronger trust for AI agents, MCP servers, and autonomous workloads by binding credentials to the system actually executing the request.

We'll cover:

• Why authorization alone isn't enough for autonomous agents and workloads
• How hardware-bound credentials prevent identities from being copied or replayed
• Using device identity to secure MCP and agent-to-agent communication
• A live demo of hardware-bound identity in an AI workflow

We'll also share what we've learned dogfooding this approach with Tsunami, Smallstep's internal AI fleet that turns our meetings, documents, and knowledge into a live, queryable, but secure RAG system.

Join us Tuesday, September 29 at 9 AM PT / 12 PM ET to see what it takes to move beyond simply authorizing AI agents to proving what's actually executing.