📅 Book a 30-min Demo📞 Call/text (571) 293-0242

Identity and Delegated Access for AI Agents: OAuth, Scoped Tokens and Human Approval

Give agents their own identities, delegate narrowly with OAuth and token exchange, gate consequential actions on a person, and revoke and audit every grant

A cybersecurity course from ibl.ai (self-paced, 10 to 12 hours, free). A hands-on, self-paced course for security, identity and platform teams on giving AI agents access safely: why agents must never hold users' passwords or standing admin keys, OAuth 2.0 under RFC 9700, token exchange, scoped and short-lived tokens, the MCP authorization specification, human approval and revocation, with labs on a local authorization broker.

Last updated:

Course description

Identity and Delegated Access for AI Agents teaches security engineers, identity and platform teams, ML engineers and security leaders how to give agents the access they need and no more. You will learn why an agent must never hold a user's password or a standing administrative credential, how delegation differs from impersonation, and how identity threats map to the OWASP Top 10 for LLM Applications 2025, OWASP's agentic guidance, MITRE ATLAS and NIST. You will apply OAuth 2.0 under its current best practice (RFC 9700), machine identity with client credentials and private key JWT, scoped, short-lived and audience-restricted tokens, and token exchange (RFC 8693). In four labs you build a local authorization broker that issues a narrow delegated token for a synthetic user, rejects out-of-scope and wrong-audience calls, requires human approval for a write action and logs and revokes every grant. The course then covers the MCP authorization specification and security best practices, approval gates that hold, agent-to-agent trust boundaries, and revocation, monitoring and audit, and ends with an identity and access design for an agent in your organization. Last verified 2026-11-03.

About this course

An AI agent that reads a calendar, opens a ticket or sends a payment needs access to do it. The questions that decide whether it is safe are whose access it uses, how much, for how long, and who can take it back. This course teaches security, identity and platform teams to answer them with standards rather than shortcuts: agents with their own identities, OAuth 2.0 delegation under the current best practice in RFC 9700, token exchange (RFC 8693), scoped, short-lived and audience-restricted tokens, the MCP authorization specification, human approval for consequential actions, agent-to-agent trust boundaries, and revocation and audit. Threats are mapped to the OWASP Top 10 for LLM Applications 2025, OWASP's agentic guidance, MITRE ATLAS and NIST. In four hands-on labs you build a small local authorization broker with synthetic users and prove that its tokens stop an agent from doing more than it should. The principles are vendor-neutral; where the course shows a control on ibl.ai, it links the live documentation.

What you will be able to do

  1. Explain why an agent must never hold a user's password or a standing administrative credential, and map credential and identity threats to the OWASP Top 10 for LLM Applications 2025, OWASP's agentic guidance, MITRE ATLAS and NIST.
  2. Choose the right OAuth 2.0 grant for user-delegated and service agents and apply RFC 9700: no password grant, PKCE, asymmetric client authentication and privilege-restricted tokens.
  3. Design scoped, short-lived, audience-restricted tokens and use token exchange (RFC 8693) so that every delegated call records both the user and the acting agent.
  4. Build and test a local authorization broker that issues narrow delegated tokens, rejects out-of-scope and wrong-audience calls, requires human approval for a write action and logs every grant.
  5. Apply the MCP authorization specification and its security best practices, design approval gates that hold, and set trust boundaries for agent-to-agent delegation.
  6. Plan revocation, monitoring and audit for delegated access, and write an identity and access design for an agent in your organization.

Who this course is for

Roles: security engineers, identity and access management teams, platform and AppSec engineers, ML engineers and security leaders who build, buy or run LLM applications and agents.

Organizations: any sector deploying agents that act on behalf of people or on their own authority against internal systems, SaaS APIs or MCP servers.

Before you start: comfort reading HTTP requests and JSON, and basic Python for the labs (Python 3.10 or later on your own machine). Leaders who review designs rather than build them can follow the worked examples and templates. All lab identities and keys are synthetic and generated locally.

Format

Time: about 10 to 12 hours, self-paced. Level: intermediate to advanced. Hands-on: four labs on a local authorization broker, with an AI tutor that coaches each step from the output you paste.

Structure: a Start here section, four content sections of readings, worked examples, templates and hands-on defensive labs, each ending in an AI assessment, and a capstone in which you write an identity and access design for an agent in your organization, followed by a reading list.

Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.

Currency

Last verified 2026-11-03 against RFC 9700, RFC 8693 and the other IETF standards cited, the MCP authorization specification and security best practices (revision 2026-07-28), the OWASP Top 10 for LLM Applications 2025, OWASP Agentic AI: Threats and Mitigations (version 1.1, December 2025), the OWASP Top 10 for Agentic Applications for 2026, MITRE ATLAS release 2026.10, NIST AI 600-1, NIST AI 100-2e2025, NIST IR 8587 (September 2026), the joint guidance Careful adoption of agentic AI services (May 2026), PyJWT 2.15.1, cryptography 50.0.2 and the ibl.ai documentation.

The guidance and tools are still changing. The IETF, the MCP project, OWASP, NIST and MITRE revise this material often, and libraries ship new versions. Check the current versions before relying on any page or template, and test only systems you own or are authorized to test. This course is training, not a security assessment of your systems.

Outline

  1. Section 0 · Start here

    • 0.1 Welcome and orientation

  2. Section 1 · Name the identity threats agents add

    • 1.1 Borrowed credentials and the confused deputy
    • 1.2 The guidance you will map to
    • 1.3 Section 1 assessment

  3. Section 2 · Delegate narrowly with OAuth

    • 2.1 OAuth 2.0 and its current best practice
    • 2.2 Narrow tokens: scope, audience, lifetime and exchange
    • 2.3 Section 2 assessment

  4. Section 3 · Build and test a local authorization broker

    • 3.1 Lab setup and the broker
    • 3.2 Approval, revocation and evidence
    • 3.3 Section 3 assessment

  5. Section 4 · MCP, approvals, agent-to-agent trust and operations

    • 4.1 Authorization for MCP servers
    • 4.2 Approval gates, agent-to-agent trust and operations
    • 4.3 Section 4 assessment

  6. Section 5 · Capstone and wrap-up

    • 5.1 Capstone: an identity and access design for an agent in your organization
    • 5.2 Capstone assessment
    • 5.3 Reading list and next steps