What happens when AI agents get the keys to your network? In this video, Tomasz Janaszka, Solutions Architect at CodiLime, explains how to prevent AI agents from performing unauthorized actions, a challenge known as the "Confused Deputy" problem.

This is part 1 of our series based on the webinar: "When AI agents get the keys to your network."

In this technical deep dive, we move beyond treating AI agents as simple clients and start treating them as distinct identities. Tomasz demonstrates a robust security architecture that uses:

  • How to authenticate users and issue JWT tokens that carry specific roles and MCP scopes.
  • Hiding unauthorized tools from the agent during initialization so it doesn't even "see" options it can't use.
  • Using Python decorators (@require_scope) to block unauthorized execution at the MCP server level.
  • A demo showing three different levels of access (Read, Probe, and Write) assigned to different users (Alice, Bob, and Mark).