Brennenstuhl on Security
Search

Topic 12 entries

Agentic Engineering

Building software with coding agents, and giving agents scoped, revocable authority over the tools they use.

Coding agents now write a large share of the code I review, and agents increasingly act on behalf of people. Both raise the same question: what is this agent allowed to do, and who answers for it? Start with the identity broker retrospective for the engineering side, and the AppSec essays for what security teams should build.

Follow this topic: RSS JSON Feed Markdown

Essays

  1. What I Learned Building an Identity Broker With Coding Agents
  2. Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering AppSec for Agentic Engineering
  3. Shift Down: Why Agentic Engineering Demands Platform-Level Security AppSec for Agentic Engineering
  4. AppSec in the Age of Agentic Engineering AppSec for Agentic Engineering

Field guide

  1. How does authorization work for MCP servers? Field Guide
  2. How should people grant and revoke an agent's access? Field Guide
  3. How does OAuth 2.0 Token Exchange keep provider tokens away from agents? Field Guide
  4. Should an agent use a robot account or delegated access? Field Guide

Talks and projects

  1. Economies of Scale for MCP and Agents Talk
  2. Agentic Identity Broker Project
  3. AppSec in the Age of Agentic Engineering Talk