--- title: "Agentic Engineering" canonical_url: https://www.janbrennenstuhl.eu/topics/agentic-engineering/ author: Jan Brennenstuhl --- # Agentic Engineering Building software with coding agents, and giving agents scoped, revocable authority over the tools they use. Coding agents now write a large share of the code I review, and agents increasingly act on behalf of people. Both raise the same question: what is this agent allowed to do, and who answers for it? Start with the identity broker retrospective for the engineering side, and the AppSec essays for what security teams should build. ## Entries - [How does authorization work for MCP servers?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/) (2026-10-13, guide): In MCP revision 2026-07-28, a protected MCP server over HTTP is an OAuth 2.1 resource server that accepts only tokens issued for itself. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/index.md - [How should people grant and revoke an agent's access?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/) (2026-10-13, guide): People should grant an agent access per service with chosen permissions and an expiry, and be able to revoke that grant at any time. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/index.md - [How does OAuth 2.0 Token Exchange keep provider tokens away from agents?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/) (2026-10-13, guide): OAuth 2.0 Token Exchange (RFC 8693) lets a gateway trade an agent's token for a provider token, so the provider token never has to reach the agent. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/index.md - [Should an agent use a robot account or delegated access?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/) (2026-10-13, guide): An agent that acts for a person should use delegated access that names both the person and the agent. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/index.md - [What I Learned Building an Identity Broker With Coding Agents](https://www.janbrennenstuhl.eu/agentic-identity-broker/) (2026-09-24, essay): Coding agents can build security-critical software when people own the specs, the constitution and specs live in the repository, tests must fail first, and more agents review than write. Markdown: https://www.janbrennenstuhl.eu/agentic-identity-broker/index.md - [Economies of Scale for MCP and Agents](https://www.janbrennenstuhl.eu/talks/economies-of-scale-for-mcp/) (2026-09-18, talk): Agents should not hold shared, long-lived provider credentials; an identity broker ties delegated access to both person and agent, and a gateway keeps provider tokens out of the agent. Markdown: https://www.janbrennenstuhl.eu/talks/economies-of-scale-for-mcp/index.md - [Agentic Identity Broker](https://www.janbrennenstuhl.eu/projects/agentic-identity-broker/) (2026-09-15, project): Agentic Identity Broker gives agents scoped, revocable access to tools on behalf of people, keeping both user and agent in authorization decisions and provider tokens out of the agent's context. Markdown: https://www.janbrennenstuhl.eu/projects/agentic-identity-broker/index.md - [AppSec in the Age of Agentic Engineering](https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/) (2026-07-03, talk): AppSec teams should shape the harness, platform and risk model that coding agents work inside, because finding problems after the code is written cannot keep up with agents. Markdown: https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/index.md - [Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering](https://www.janbrennenstuhl.eu/new-appsec-operating-model/) (2026-07-03, essay): AppSec teams should shape the harness, platform and risk model that coding agents work inside, because finding problems after the code is written cannot keep up with agents. Markdown: https://www.janbrennenstuhl.eu/new-appsec-operating-model/index.md - [Shift Down: Why Agentic Engineering Demands Platform-Level Security](https://www.janbrennenstuhl.eu/shift-down-appsec/) (2026-06-14, essay): Coding agents multiply whatever patterns exist, so AppSec should build security into platform defaults that remove risky decisions, and keep scanning as the fallback. Markdown: https://www.janbrennenstuhl.eu/shift-down-appsec/index.md - [AppSec in the Age of Agentic Engineering](https://www.janbrennenstuhl.eu/appsec-agentic-engineering/) (2026-05-14, essay): AppSec teams keep up with coding agents by fixing findings inside the agent loop, shipping security tooling to agents, and managing risk budgets together with SRE and platform teams. Markdown: https://www.janbrennenstuhl.eu/appsec-agentic-engineering/index.md - [About Jan Brennenstuhl](https://www.janbrennenstuhl.eu/about/) (2021-04-08, profile): Jan Brennenstuhl is a principal engineer focused on application security, agentic engineering, and the intersection of security, usability, and automation. Markdown: https://www.janbrennenstuhl.eu/about/index.md