Your Auth is Broken for Agents. Fix It Now.

A routine latency spike—from agents hammering a 'last seen' update 60x faster than humans—exposed a deeper fracture: authentication and authorization architectures built for deterministic human actors collapse under non-deterministic agent traffic. The assumption that the authenticating principal equals the acting identity no longer holds.

Existing OAuth scopes are intentionally broad because they were designed for deterministic programs that could be code-reviewed. Agents lack that predictability, yet they often inherit the same sweeping permissions—threatening to delete databases, leak data, or exceed their remit. The default pattern of giving agents whatever they need is dangerous.

Engineering teams must adopt attribute-level, context-aware, and just-in-time permissions that bind an agent’s identity to a specific user contract. Visibility into every agent action—who authorized it, for how long, with which scopes—becomes non-negotiable. The ref.tools example shows this is already in production.

The fix is architectural, not incremental. Leaders who treat agent auth as a mere extension of human API keys will learn the hard way: praying is not a strategy.