Announcer Please welcome your moderator, Allie Howe.

Allie Howe Thank you so much, everyone, for having me, especially Browserbase, this amazing conference. Super excited to be here at Navigate Today, where the theme is shipping agents into production. Right now, we're in the middle of a very transformative shift from agents as pets to agents as cattle. Identity is at the heart of this shift. Identity is what allows you to move beyond artisanal personal agents like OpenClaw to agents that serve the entire enterprise. Identity allows the agent to respect the permissions of whoever's calling it. It creates a record of which agent did what and gives teams the ability to immediately revoke a misaligned agent's access if needed.

Identity is also what will help agents navigate the web safely and will un-unlock the future of agentic commerce. Today, we have three agent identity leaders with us here today to help us explore this shift. We have Ian Livingstone, CEO of Keycard, Peyton Casper, Identity Product Lead at Browserbase, and Ivy Lee, VP of Product CMS Agentic Commerce at Visa. With that, please join me in welcoming our panelists on stage. And to open up our panel, I would love to set the stage with the pets to cattle reference that I mentioned. There is a new reference architecture out there right now called Agent Baseline, which provides a reference architecture for building, shipping, and operating agents in production.

It outlines six different outcomes that teams should work towards to be able to confidently ship agents into production. One of those outcomes is the ability to respond. I know we've seen a lot of different headlines recently in the news with agents escaping sandboxes, getting into other companies' production infrastructure. So it sounds like the a- having the ability to respond to a... The ability to immediately revoke an agent's access, which is one thing the Agent Baseline calls out as something that teams need today, is super important. Ian, if we want to treat agents as cattle, why is the ability to respond and immediately revoke access so important?

Ian Livingstone Yeah, this is a great question. So I mean, most of this crowd would be developers, and I'm sure we've all gone and artistically managed our OpenClaw or our Claude Code or, you know, our, our ChatGPT sessions or Codex, and we've copied some long-lived API key into that thing. And we don't control what that agent does once it has it, right? We don't control it at all. And so the, the fundamental issue when doing... And that's-- if we wanna get to at scale one of the most important things at scale is we have some level of containment, but also we have some some ability to like react and respond to something, an, a maligned agent or maligned agent performing action we don't want it to, or to enable to continue to do those things.

But in order to do that, we have to be able to identify what access that agent has, but also then subsequently revoke that access. And today, with the existing ecosystem of tooling and the copy of these long-lived API keys around, there's just no capacity to identify who the, who the actor is or what they're doing, or ensure that they no longer have access to that. And so that's fundamentally like the most important part of getting us to a world where agents are prolific is solving some of these infrastructure issues that enable you to do something very simple like revoke an agent's access.

Allie Howe For sure. Absolutely. And another recent incident that I wanted to mention and call out was, well, one that happened with Resy very recently, where a user was using Instinct, which is this platform that provides a personal agent that can do things on your behalf, such as book a restaurant reservation on Resy's platform. Some user tried to have an agent do that for them. The agent went and made about 200 API calls per hour on this website, and the end-all result of that was that the agent's or the person's Resy account was ended up banned. So, their, their agent actually got their entire account banned for them, unfortunately.

This is a two-part problem, what happened with Resy. First is that the web wasn't built for agents, and the second is the agent didn't restrain itself and respect the limits of the API that it was consuming. For the first part of the web not being built for agents, I know there are new protocols, like Web Bot Auth is something that you've championed, championed Peyton, at Browserbase, that gives agents a cryptographic identity at the browser level. Peyton, what is Web Bot Auth, and how does this help agents interact with the web safely?

Peyton Casper Yeah, I mean, so the biggest problem, right, is when these agents are going out, they don't actually represent anyone. They're effectively just random traffic that they see show up on their, you know, internal systems. So the point of Web Bot Auth is basically to give out a form of identity that travels with that traffic. So when an agent goes out to Resy or goes out to Walmart or, you know, whatever task it has, it actually is tied back to an individual or tied back to an organization. So that way you have some form of tracking on what is this agent doing, and then, like, who are they acting on behalf of?

And I think that's, like, one step along the way of enabling agents to kind of get access to these systems that historically, you know, automated traffic hasn't been allowed because it's largely been fraudulent. Well, the way that we build that trust and we build that reputation is by starting with that, like, base level protocol. Web Bot Auth is a protocol that came out from Cloudflare maybe about three, four years ago. And you know, I think it's seen the most adoption on this side. Will it be the final protocol that we see? You know, I, I don't know. But at the end of the day, like, you still need that form of kind of guarantee that whoever this agent says they are, you can actually validate that they are who they say they are.

Allie Howe And it's something that Browserbase is using today?

Peyton Casper It is. You know, for our larger enterprise customers, we try to push them down this path of signing traffic with Web Bot Auth because it allows us to go to our partners like Cloudflare and reCAPTCHA and say, "Hey, you know, w- this is large enterprise," right? They're coming to you. They wanna automate some portion of your application that doesn't have good API support yet. And so this is a way that they can sort of whitelist certain agents into their platform in a secure way. And because they get that visibility, they can add those controls on top today and then as we start to build out better protocols and better systems, you know, obviously they can hopefully migrate as well.

Allie Howe Ian, I know you focus a lot on the controls for agents as well at Keycard. How are you seeing this problem?

Ian Livingstone I mean, the Re- the Resy problem is, is so interesting, right? So like, you know, you have to step back and kinda ask, well, why doesn't Resy want this, I think is, like, really the first question. Like, why would Resy not want that to happen? The reality is, is that, like, restaurants pay Resy to ensure that the seats inside the restaurant are filled. And unfortunately, like, the instant traffic is actually quite abusive. Like, Resy can't determine whether that's, like, good intention traffic or bad intention traffic, which is finally an issue on the web today. It's why Cloudflare first and foremost, like, started developing Web Bot Auth, is like, how do we separate, is this a bad bot?

Is it a good bot? Is it a good agent? Is it a bad agent? How do we know who it's acting on behalf of? Is it truly acting on behalf of one of our customers, or is it someone that has, like, abused one of our customers', like, credentials to perform some negative action? And ultimately, their incentive, their job, what they're paid to do first and foremost, is to fill seats in restaurants with real people. And that's really ultimately at the end of the day, the incentive for Resy. It's, you know, in some ways bad PR, in some ways it's good PR for them, depending on how you look at it, but that's the real issue.

And independent of how we as consumers may wanna consume, you know, different websites, we have to remember what, what those are bought for. And ultimately, the web is built in a federated manner, right? And so we all want these open protocols and how things interact, ensure anyone can create anything, but at the same time, independent participants in that federated web are gonna have different incentives on what they consider to be acceptable. And part of federation in an open web is also realizing that certain people are going to be incentivized to, to disavow certain types of traffic. And we're... And this is fundamental to sort of like the pets as cattle analogy, is because we're so early in terms of, like, our infrastructure for understanding and adopting enabling agentic workflows, this is a great example of how, like, a, a vendor like a Resy, who's most importantly trying to protect its brand and its restaurants say, "Hey, this is incredibly abusive.

Please don't do this," and, and, and block you from doing it, and why they have a terms of service in the first place.

Allie Howe Web Bot Auth kind of sounds very directionally similar to Visa's Trusted Agent Protocol. Ivy, how are you all helping merchants deal with this problem, and what is Visa's Trusted Agent Protocol?

Ivy Lee Yeah, sure. So Visa's mission is super simple. It's just be the best way to pay and, and be paid. And so from an agentic commerce perspective, we're really focused on payment agents or agents with the intention to pay. And we work, of course, with our, our millions and billions of, of merchants, and they've spent decades working with CDNs like Cloudflare and Akamai, as well as, you know, their gateway providers to block bad bots, right? And so now we're saying, "Open up the doors for commerce agents that are good bots," because you don't wanna miss out on a sale, you don't wanna miss out on a transaction.

And so the question being, who do I trust and how do I trust it? And so Visa being the network, we think that we do have a role to play here, and that's why we publish Trusted Agent Protocol, which aligns with Web Bot Auth from a co- protocol perspective. And so essentially, it's pretty simple how it works. An agent, a payment-related agent, is heading to a, a website with an HTTP request, and there it has signed with its private agent control key. And, it gets resolved with a public key that is through our Visa agent registry, so that agent has been prior onboarded and able to be recognized by the merchant with safe trust signals.

And then the agent is able to-- And then the merchant is able to say, "Ah, this agent has been verified in some essence by Visa and is a payment intention bot or agent as opposed to a bad bot." So what we're doing is we're trying to connect the two sides of the ecosystem. We have tons of agents coming up, but the merchants are worried. They're like, "How do I know what is good versus bad?" And it's not just good versus bad, but what's the intention? We-- Some of the merchants don't want agents coming through just a screen scrape, for example, and what Visa's helping to do is verify that there is a payment intention here as well.

Allie Howe Amazing. Yeah, intent is a super interesting concept, and I think we're all moving towards this world of intent based off. And I've talked to several different people. One interesting person I've had on the podcast recently in Insecure Agents is the s- chief or sorry, the, one of the chief security officers for Visa. Not for Visa, for MasterCard, sorry. And she was super interested in this concept of, like, you can have really good intent but still take the wrong action. So measuring the intent is very important, but then what does the control layer look like to be able to stop an agent that might be taking a wrong turn or still be making a bad action even with good intent?

And that's for anyone on the panel.

Ian Livingstone I mean, this is, like, a fundamental question of our age, right? Like, and if we take a... On-one thing I'll point out is, like, the, the fundamental issue we have to deal with on the web is about the question of liability. So we've gone from this world where everything was either initiated by a human or written by a human or approved by a human, right? The code was written by a human, it was deployed by a human, it was run by a human. The person who pressed the button on the website was a human. And that, that changed sort of the, the, the fundamentals of, of what we need to do.

Now we have these non-deterministic actors that we give some intent to, "Hey, go buy me the best pair of jeans." And ultimately, the, the ch- the challenge we have as on a friction problem is, well, we don't really wanna give this non-deterministic thing this, like, broad-based access to everything. Because that means it, in pursuit of its goal, it could take a very weird direction. A, a common example many of our customers have run into, usually precipitated by some type of incident, is, "Well, I tried to optimize a database, and it deleted the database," right? Like, that's clearly not, like, the optimal outcome the human intended but the agent thought, "Well, the optimal way to optimize the database was to get rid of the database," right?

Like, that you can see how a goal-seeking thing that is not truly intelligent but just is an averaging machine will get to that outcome. And so ultimately, at the end of the day, what we have to do is look at, like, what has this agent been assigned to in the context of this task? I've been like, "Hey, optimize this database." Optimize does not mean delete, so we shouldn't have the delete permission, right? And so how do we get there when we have so many different tasks that could be done? That's the reason where intent comes in. So can we extrapolate from what we've assigned the agent to do exactly what permissions it should have, and that be scoped to the task that's been assigned That's the, the fundamental question we have to solve on the web today, and then also know that it's associated with that task, it's that agent that's acting, and oh, by the way, it, it was in fact Ian that told this agent to do this thing.

So we deal with the liability problem of knowing, like, well, ultimately, who do we yell at for why this went off the road, right? Like, that's still the fundamental issue we have to tackle. And today, none of that stuff actually works on the web. Like, none of that exists. We don't have any of those things. They exist potentially in small pockets in some areas, but not in a, an open and federated manner that actually enables all these things to work.

Peyton Casper It's interesting, like I just had this conversation with someone earlier. If you used Terraform, you know, eight, six, eight years ago there was this problem that popped up in the CI/CD world where we were giving Terraform credentials basically admin permission to the entire enterprise cloud. Like, one Terraform credential could basically take everything down. And where we eventually solved that was, like, at the policy layer in the deployment step, right? Like, basically, individuals had to approve, like, what code could go out, and we segmented out our code bases and things like that. Really, like, what you're solving for is, like, granularity of permissions. And I think, like, this is why there's such a strong case for agent identity as a whole, which is all of these existing parts of the web have existing auth layers and systems built out with RBAC.

And so if we can kind of, you know, translate that identity and build out kind of those granular permissions on an account-by-account basis and allow individual agents to use those granular per- permissions, then that does solve, to your point, a lot of the control problems. Yeah. Because it doesn't matter if an agent gets, you know, injected, it actually didn't have the permission that it needed to anyways, right? So yeah.

Ivy Lee I can speak about it from a payment context. You're absolutely right that with intention also needs permissions and controls, and one of the ways that we solve it at Visa alongside trusted agent protocol is our use of payment tokens. And so just as we as Visa can't control the actions of the humans holding a Visa card we can't control the agents that are built in many different harnesses, many different platforms, but we can control what payment credential that agent is granted and then the permissions and the controls that go along with it. And some of the tools we have at our disposal is doing an authentication, right, to make sure that that cardholder you, have given permission to that agent to use your very valuable credit card, right, as an example.

And then, you know, the token masks the credit card number. So your, you know, your digits are not floating out in, and an agent won't have access to it. So we do really think that trust and controls at the agent level is very important, but it's even at the use case by use case, transaction by transaction level, and we need that level of granularity as well.

Allie Howe Absolutely. I think that touches on the second half of the problem that I mentioned in the beginning of the, the agent itself that was communicating with Resy's platform needed-- had to have the ability to restrain itself in some way from calling that API 200 times an hour. So there's this concept of, you know, limiting the amount of, like, tokens or credentials or something that, like, prevents the agent from making that request for a 200th time. I think that's another part of the problem. How do developers build that into agents today?

Peyton Casper Yeah. I mean, soapbox for a second, I guess. But like, I, I think like there's like a fundamental aspect of respect here, right? Like most reasonable humans don't actually want to abuse Resy's website to do things, right? Like, obviously there are like reservation bots that try to like make online reservations and then sell them. Like, I'm gonna separate those for a second, right? Those are like bad use of commons. Most reasonable people that are using Instinct just want a reservation for their date night on Friday. The challenge is we're in this in-between, you know, spot where Resy doesn't know how to handle this automated traffic, for example.

And so, you know, to some degree, it's on infrastructure providers like Browserbase and like Keycard and, and Visa, to kind of help bring along these website owners and merchants and everyone else while we build out the protocols and the infrastructure that does need to exist to add these controls. And so like that's a big focus that we have at Browserbase is like, how do we be respectful with the access that we're enabling agents with on our platform? And like, you know, I think at the end of the day, it's, it's, it does come down to like personal respect of like- We all have like an internet.

Like we all rely on it. If, if we destroy it, like that's kind of on us, right? And I think some people would probably argue with me and say that doesn't scale, but you know, if you look around at society, it does kind of scale, right? I don't- Yeah. Being philosophical.

Ian Livingstone No, I think that, I think that's right. Right? Like the internet and computers, like this thing works. It's based on trust. Like I trust TLS certificate if it comes from some issuer, I trust that thing. Like it, trust is at the fundamental component of all of this. I would say like the biggest challenge, I think we're going through this transition and like in truth, the number of people that use agents in the way that this, this individual does with Resy is like less than zero point one percent of the population. Like most people who are doing this stuff today were like going to ChatGPT or might be using a little Claude code, but we're like asking some questions about should I buy a new car, right?

Like we're really like super early in this. At the same time, we're agentifying very quickly, right? We're moving from this like world of like very human driven computing to very agent driven computing, where agents are the primary actors, the primary consumers, the primary builders of software. And that's changing our role, but also changes what we need from our infrastructure and what we actually need, what the look and shape and formulation of software is. And so part of that, of what we're doing at Keycard, is enabling companies to like, you know, drop in those pieces that actually enable you to agentify. But what we've learned in that process is like most people are waking up and realizing that things that they assumed were like safe assumptions like three or four years ago aren't assumptions you can make anymore.

And a lot of like, whether it's at the largest of the big, you know, like a JPMorgan Chase who is, you know, a one point five billion dollar capital expenditure on technology or budget, what they're recognizing is like what you need to enable agents to operate safely is both all of the best practices that you heard about the cloud era, but all this net new stuff. And so I think the net, what I would look at is as a developer or a builder or someone that's thinking about how we look at software, the way that we built software and the pieces of software you leaned on and what they had to be true about that software for the last, you know, thirty years is gonna be very different and the types of infrastructure you need is very different in the next thirty years.

And that's the fundamental what we're, we're recognizing and most people are waking up and realizing, "Hey, I'm actually like missing some core pieces." Now the question is what do I actually need to enable these things? And of course, for Keycard, that's the deny access layer. Of course, I had to plug myself.

Ivy Lee Yeah. I think it can be, sound a bit boring, but I think the alignment on protocols and standard bodies is really important. So like Visa, for example, is part of like the X Pro2 Foundation, and we work actually together with, for example, MasterCard and, and Amex on the proper and like secure way that we can support agents in payments use cases at least. So that's all very important because this is a whole ecosystem alignment and enablement, the way that we talk about it. It's not about like any one of us winning in this space, but in order to like securely support, we all have to sort of work together, and we all recognize that.

And, just in terms of... Oh, yeah, I'll leave it.

Allie Howe No, you're fine. Yeah. It's okay. No, that's a very, really, really interesting, and one of the things I heard from the panel on that question was, yeah, it's super important to, you know, be respectful of websites and to, sort of like limit the agent's ability to, you know, make a hundred, two hundred API calls an hour. But okay, how do we limit an agent without using, without losing both the capability and power of the agent also? Because it is really cool. If you're trying to, you know, book your date night at Friday night, and you don't have the time, and there's like a hundred other people also trying to get that table, if you have an agent that's able to, you know, work overtime way faster than you could to get that table you don't just wanna like dial back and turn off the agent so that you lose its capability and its autonomy to behave such that it's actually able to achieve that outcome for you.

But of course, you also wanna be respectful. So it's like it's a, it's a trade-off there. I know, Ian, you talk about this a lot at Keycard of like, we wanna build agents with not only autonomy and capability, but also security. So how does this all fit together so you don't lose the power of the agentic experience as well?

Ian Livingstone Yeah, I think this goes back to a lot of what I was just talking about. Like, at the, at the core of it, like we're gonna sit back, like what do we actually need? I mean, Ivy hit on it. It's like the truth of the resi situation is like this standard open protocol stuff that we built the web on is just like out of date for what we need. Like OAuth doesn't work, wasn't designed for this stuff. Like, like the low-level HTTP stuff up wasn't designed for this stuff. It's just not in the core model, and so there's, there's a moment in time where like all the protocols and software are out of date.

We're trying to figure out what they need to look like. But at, at a primitive level, it's like we need to be able to understand all the actors in an action, right? So we need to be, it's like it's an agent, it's this other agent, this other agent, it's Ian at some point in the chain performing some action. We need to know... So that's, that's one part of it. Two is we have to understand, like be able to scope what that action is very, to a very fine-grained level. We need to be able to say, "Hey, it's trying to buy a pair of jeans. It's this pair of jeans.

It's been authorized to spend up to fifty dollars on this pair of jeans by this, you know, authenticated and signed by the person upstream, the buyer." And most importantly, then we need to have a capacity to capture all of that information. So that deals with the auditing, the attestation, the liability problem. And then of course, minimally, we also then to solve the permissioning problem, in order to scope something so narrowly, we have to have something that helps us like generate what that permission scoping should be. So if you go and use any app today or I'm sure many of us have used some type of enterprise app, you go and use implement RBAC, right?

Role-based access controls. Well, role-based access controls rely on the idea that I know it's Peyton and I, I trust him, and so he can always like go and delete repositories in GitHub. But that doesn't work in agentic world. We need adaptive access controls, we need adaptive permissions, we need adaptive policy based on the thing. And so that's the big next unlock is how do we create, you know, Claude has this thing that they call Auto Mode. What we need is Auto Mode for the web, right? Is anytime we go to do something, we're gonna do a pa-- a scan, we're gonna determine exactly what permission that thing is.

Some human has said that's good, and then it can go off and run on its task until at some point it brings a human back in the loop. And so that's not the traditional way that web, the web has worked. It's not the traditional way software has worked, but that's the world we need to l-- that those are the pieces we need so that we can actually realize what most people want, which is a version of autonomy, autonomous agents, right? Like what we all are dreaming of is this world where like everything feels like a self-driving car, and it only bothers me when I have to be in a loop, and I can defer a whole bunch of things to these computers to go and do it.

But I, what I don't want it to do is to do the thing that is bad, which is like delete the repository, drop the database, spend ten thousand dollars instead of fifty, or what have it. And I want it to work across all of the things of, that I use every day.

Peyton Casper Yeah, I mean, plug Visa's mandate model for a second. Like I think like it's a very good example of a problem that exists across every single agent, like no matter what it's doing, which is you have this prompt, and you hinted at this earlier, which is like, "Go out and buy two Lakers tickets." Where are you gonna buy Lakers tickets from? What website are you gonna go to? How much should you spend? Like, who is a valid reseller? How do I know this isn't like a scam, right? It's, it's really an intelligence problem at the end of the day. And, and the web repr-- ef-effectively represents sort of this like unbounded, you know, scope of, of websites that were indexed by Google, like as in like we could find them, but weren't indexed to the level of like what permissions should be here?

Who actually owns this? What action is gonna take? I think like, you know, I-- it's probably like a two-sided problem, like as in both sides will, will help solve it, but you kind of sort of have to start indexing the web and, and I think Visa's done a good job with TAP, where, you know, you don't just generate a tokenized card that can be used anywhere on the web. You generate a tokenized card that can be used on Ticketmaster when you go to buy those tickets, because they're one of the two like legitimate vendors for Lakers tickets. And I think like- It's, in the long run, it's probably a better world than where we are today, which is like a human could stumble upon a random website that says that somebody's selling Lakers tickets and get scammed, right?

And we sort of just accept that because we say, "Oh, well, you know, it's up to the human. They should have understood that." but you know, we're getting to a world where, like, the level of kind of intelligence we have on individual transactions and actions continues to go up because we have to, to, to enable these agents to, to exist. And, I think that also kind of helps add, you know, those controls and, and trust.

Ian Livingstone Yeah. One thing I'll add, there are actually two thoughts. The mandate model is very similar to, there's another protocol that's being pushed around called Agent Auth or AAuth. It has this concept of mission. Like, minimally, there's gonna be this idea of, like, some entitlement thing that's scoped that defines, like, a assignment of, like, here's what you can do, and at any point that changes, that's when you have to come back to the human and, like, talk, talk to the human and ask for more permission. The other thing I'll say is there's a very famous hack in Coinbase from several years ago. Coinbase got hacked because they didn't solve a, the same problem that we're encountering today with agents.

They didn't solve the delegation issue, which is I log in, I go to do something, I delegate some access. Instead, they had the full, like that API key carried all the entitlements and everything associated with it, and as a subsequent result of that, and the, the hack, I can't remember all of the details, but it was basically a delegate access problem. And that is one of the fundamental things that we have to solve with agents. It's still a problem we actually had in the human-driven era. It just wasn't as prolific, and the reason it wasn't prolific is because we didn't have as many people, like, doing it unintentionally, right?

Agents are causing problems not through good, bad intention, but just through not having any notion of what is good intent or bad intent one way or the other, and they do it at a volume and speed at which is unprecedented.

Peyton Casper I'd just add, like, one thing. I mean, I think it's easy to get lost in the size of the problem especially like at Browserbase, we talk about the web and, like, sort of this long tail of the internet. If you go back fifteen years, Okta didn't exist. Yep. OAuth didn't exist. Like, it was just people hand-rolling auth for the most part, right? And like in the span of ten years, you know, billions of identities through kind of federated login now exist, and like every enterprise in the world uses some form of IdP, right? So, you know, I, I don't think we're dealing with a problem that, like, doesn't get solved.

The, the thing is, like- Economic incentive is what drives protocols, right? Like, if, if you put out a protocol, anyone can in this room people are only gonna use it because it enables use cases, right? And I think, like, we're finally starting to see with Instinct and, and these other personal assistants, real people are doing real things on websites now through these agents. Like, I just booked a plumber the other day through Instinct, right? Using a browser under the hood. And when that happens, when you have 100,000 consumers that now are using an agent every other day or every day things become real very quickly.

And I think you start to see alignment on protocols and stuff, so we can get an answer out the door which, you know, I think we're starting to see in, in a lot of layers of the stack, yeah.

Allie Howe Amazing. Well, yeah, thank you to all of our panelists for all your insights today. Super excited to continue this conversation and see how agentic identity and agentic commerce evolves. But with that, that's the end of our panel. Thank you so much. Thank you.