OAuth has become the foundation for modern API security. Over more than a decade experts carefully cultivated the framework by adding new standards, best practices and recommendations to improve authorization for APIs. Now AI agents are taking root in that same ecosystem. More than anything, they expose the gaps in implementations and the OAuth framework: How to authorize actions from software that changes its behavior after the user has granted access? How to enable agents to integrate securely with your APIs and business across trust domains?

This talk walks through the challenges in opening APIs to AI agents. It centers around two practical questions: what tools from the existing OAuth toolkit do you actually need to solve them, and what new tools do you need. Attendees will leave with a clearer picture of which emerging specs matter, and how to keep a security posture in “full bloom” as the agentic landscape keeps shifting.