The question I'm bringing to Ai4

Attending Ai4 in Vegas this week — 12,000 people, and I'd bet 11,000 conversations about agents.

Here's the question I'm bringing to every one of them: when an AI agent calls a tool, how do you prove it was allowed to?

We solved this for humans years ago — OIDC, PKI, mTLS. Most agent stacks today still run on vibes and API keys.

After 20 years architecting systems where one bad transaction means someone's retirement check is wrong, I think agent identity and permissions are about to become the whole conversation in enterprise AI.

If you're working on agent governance, identity, or getting agentic systems past a compliance team — find me at the show. I'll be the one asking about certificates.