AI Agents Can Do a Lot. But Should They?

Short summary

The author built Vouch, a permission layer for AI agents that delegates credentials via Auth0. The key challenge wasn't authentication but designing the right scope—too broad breaks security, too narrow breaks usability. Insight: while agent capabilities get focus, the constraint layer is equally critical infrastructure.

• •Vouch adds permission delegation between AI agents and external services
• •Permission schema design proved harder than the authentication implementation
• •Agent builders overlook constraints as much as capabilities—both matter

Generated with AI, which can make mistakes.