AI Engineer Interview: Kamil Potrec of Keycard Explains Agent Authentication and SDK/Gateway Tradeoffs
In a new video on the AI Engineer channel, Kamil Potrec of Keycard discusses how agents obtain credentials. He analyzes the flaws in current practices like personal tokens, static keys, and over-privileged service accounts, and outlines what proper agent authentication requires: per-agent identity, delegation, short-lived scoped credentials, federation with legacy systems, and policy/audit. He also compares SDKs and gateways for keeping credentials out of an agent's reach, including the tradeoffs involved.
When an agent sends an invoice using your token, who actually made the request? This is the core question posed in the newly published AI Engineer video "Who Is Making This Request? Agent Auth 101." Guest Kamil Potrec from Keycard breaks down how agents get credentials today, including personal tokens, static keys, and over-privileged service accounts, and highlights what's wrong with this picture.
Potrec further elaborates on what proper agent authentication needs: per-agent identity, delegation, short-lived scoped credentials, federation with legacy systems, and comprehensive policy and audit controls. These elements form the foundation of secure agent architecture.
Beyond the theoretical framework, the episode focuses on comparing two technical implementation paths: SDKs and Gateways. Potrec analyzes why SDKs alone may not be enough to keep credentials away from agents and discusses the advantages and tradeoffs of introducing external gateways for credential isolation. For engineering teams building or evaluating agent infrastructure, this perspective offers concrete reference points.