Jan Brennenstuhl Principal Engineer, Berlin

Security that makes the secure path the easy one.

Essays, a field guide and research notes on application security, identity, and the agents that now act on our behalf.

Featured essay September 2026

What I Learned Building an Identity Broker With Coding Agents

Magnus Jungsbluth and I built the open-source Agentic Identity Broker with coding agents from the first prototype. Over 10 months, I switched agent harnesses 6 times and used 9 models, and most of my lessons are about specs, tests, and review.

10 min read Read the essay

Now

ProjectAgentic Identity Broker
Open-sourced in September 2026 with Magnus Jungsbluth. Scoped, revocable access to tools for agents acting on behalf of people.
TalkEconomies of Scale for MCP and Agents
AGNTCon + MCPCon Europe, Amsterdam, 18 September 2026.
LectureAppSec in the Age of Agentic Engineering
Guest lecture for the cybersecurity course at HTW Berlin, July 2026.

Recent essays

All writing RSS

Agentic Engineering
Agent Substrate Knows Which Agent Is Calling, but Not for Whom
Agent Substrate 1.0, kagent and agentgateway form a Kubernetes agent platform that keeps credentials out of the sandbox, but every identity in it names only the agent. A proof of concept shows how the Agentic Identity Broker can add the person behind the agent, and that neither the platform nor the broker is ready for it yet.
9 Nov 2026 17 min read

6 Nov 2026 State of the Broker 7 min State of the Broker: October 2026
2 Nov 2026 Identity & Auth 9 min Measuring How MCP Servers Authorize Agents
28 Oct 2026 Agentic Engineering 6 min A Read-Only MCP Server with Bunny Edge Script
3 Jul 2026 AppSec for Agentic Engineering 5 min Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering
14 Jun 2026 AppSec for Agentic Engineering 6 min Shift Down: Why Agentic Engineering Demands Platform-Level Security

Field guide

All entries Glossary

Agent identity
Should an agent use a robot account or delegated access?
When an agent acts for a person, give it delegated access that names both the person and the agent, with narrow scopes, an expiry, and a way to revoke it. A robot account …
Not yet reviewed
Account security
What should a password policy require?
Under NIST SP 800-63B-4, a password used on its own must have at least 15 characters, or 8 when it is one factor of multi-factor authentication, and systems should accept …
Not yet reviewed
OpenID Connect
What is inside a JWT?
A signed JWT is 3 base64url-encoded parts joined by dots: a header that names the algorithm, a payload of claims, and a signature over both. The payload is encoded, not …
Not yet reviewed
Agent identity
How does OAuth 2.0 Token Exchange keep provider tokens away from agents?
OAuth 2.0 Token Exchange (RFC 8693) lets a client trade one token for another token meant for a specific target service. When a gateway runs that exchange on each tool …
Not yet reviewed
Agent identity
How should people grant and revoke an agent's access?
Let people grant each agent access per service, with a permission set they choose and an expiry, and let them revoke that grant at any time. Revoking the grant has to …
Not yet reviewed
Agent identity
How does authorization work for MCP servers?
In the MCP authorization specification (revision 2026-07-28), a protected MCP server over HTTP is an OAuth 2.1 resource server: it publishes Protected Resource Metadata …
Not yet reviewed

Projects

Open-source work at the intersection of security and engineering. All projects

Open source since October 2026
Letsauth Lab
An open lab at letsauth.eu that measures how public MCP servers implement the MCP Authorization specification, for people who build or integrate agent authorization.
Open source since September 2026
Agentic Identity Broker
Scoped, revocable access to tools for agents acting on behalf of people.

Topics

Essays, field-guide entries, talks and projects by subject. All topics Search

Agentic Engineering 17 entries
Building software with coding agents, and giving agents scoped, revocable authority over the tools they use.
Identity & Auth 24 entries
OpenID Connect, OAuth, passkeys and step-up: who is acting, on whose behalf, and how strongly that was proven.
AppSec 16 entries
Secure defaults, platform-level controls and the attacks they have to hold against, from phishing to supply chains.
Passwords 10 entries
Password policies that people can follow, systems that do not punish password managers, and the attacks on reused credentials.
Tokens & JWT 7 entries
JSON Web Tokens and the JOSE family: what tokens are for, how they are signed, encrypted and verified, and where they go wrong.
Engineering Practice 15 entries
Notes from running software: cloud infrastructure, European hosting, tooling and the occasional migration.

For agents

Read this site from your agent

A read-only MCP server lets Claude, ChatGPT or any other MCP client search the essays and the field guide, read entries as Markdown and quote findings with their sources. It needs no sign-in.

https://mcp.janbrennenstuhl.eu/mcp

search_site get_entry get_findings list_topics

How to connect