Course Objective & Scope
When an AI agent sends emails, queries ERP systems and connects to MCP servers on behalf of multiple users, relying on a static service account or shared API key invites confused deputy and lateral privilege escalation attacks. This course covers propagating user identity safely through agents to downstream services, OAuth 2.0 On-Behalf-Of (OBO) and token exchange flows, workload identity with SPIFFE/SPIRE, and per-task dynamic scope attenuation.
In hands-on labs participants write context-aware authorization rules with Open Policy Agent (OPA) and Cedar, finishing with an end-to-end identity, delegation and agent permission matrix tailored to their organisation's agent architecture.
Who Should Attend?
- AI and software engineers building agent and MCP integrations
- Identity and access management (IAM) and platform security teams
- Enterprise security architects and AppSec specialists
- Prerequisite: familiarity with OAuth 2.0 / OIDC fundamentals and API security
Key Takeaways
- Analyse confused deputy risks caused by shared service identities in agent architectures
- Implement user-scoped delegation with OAuth 2.0 On-Behalf-Of and RFC 8693 Token Exchange
- Attenuate token scopes dynamically based on task and intent context
- Enforce fine-grained pre-execution policy checks on tool calls using OPA or Cedar
- Maintain authentication and audit trail integrity across multi-agent call chains
Curriculum
Agent Identity Models and the Confused Deputy Risk
- Separating human identity, agent workload identity and service accounts
- Lateral and vertical privilege escalation with shared API keys
OAuth 2.0 Delegation and Token Exchange
- On-Behalf-Of (OBO) and RFC 8693 Token Exchange flows
- Issuing short-lived, task-attenuated (downscoped) tokens
Fine-Grained Policy Engines (OPA and Cedar)
- Evaluating ABAC and ReBAC rules prior to tool execution
- Dynamic permission checks based on parameters, target resources and risk level
Permission Propagation in Multi-Agent and MCP Chains
- Passing verified identity context between orchestrators and sub-agents
- Session isolation and privilege boundary checks in MCP servers
Identity Auditing, Revocation and Incident Response
- Designing immutable audit logs capturing the user, agent and tool tuple
- Instant token revocation and kill-switch patterns upon anomalous privilege use
Other Courses in This Category
-
Combines STRIDE with MITRE ATLAS and the OWASP Top 10 for LLM and Agentic AI to produce end-to-end AI threat models, trust boundary diagrams and control matrices for LLM, RAG and agent architectures.
- Live Course
- 5 modules
-
Teaches how to plan and execute scenario-driven red team campaigns against LLM, RAG and agent systems using PyRIT, garak and promptfoo, build multi-turn exploit chains and deliver reproducible findings.
- Live Course
- 5 modules
-
Teaches how to design and operate low-latency guardrails across input, retrieval, tool calling and output stages using NeMo Guardrails, Guardrails AI, Llama Guard and deterministic policy engines.
- Live Course
- 5 modules
-
Teaches how to build automated security evaluation suites for LLM and agent applications using promptfoo, garak and Inspect AI, enforce regression gates in CI/CD pipelines and continuously test model and prompt changes.
- Live Course
- 5 modules
-
Teaches how to design enterprise LLM, RAG and agent platforms on Zero Trust principles using a central AI gateway, network and tenant isolation, KMS key management, secure MCP integration and auditable telemetry.
- Live Course
- 5 modules
-
Comprehensive training on PII masking, reversible pseudonymisation, anonymisation and data residency architectures to adopt LLMs without exposing personal or confidential corporate data.
- Live Course
- 5 modules
Get in touch
