One year TO THE DAY from last year. Now that I’m looking at last year’s post I think I actually wore the same t-shirt.
Compared to last, this talk was less “security best practice”, more “what if we did this?” And it was heavy on the demo. The demo may have accounted for only 5 min of the talk, but it consumed more like 90% of the prep. Both the more “theoretical” angle of the talk and demo I had a lot of fun with. And huge thanks to my friend Becki, for instigating the whole thing and doing it together.
Demo Code
The code is all here: https://github.com/beckitrue/atproto-agents.
Talk Recording
What’s This All About?
The gist is we’re interested in using ATProto to power authentication for AI Agents, as well as public and verifiable messaging, and OpenFGA for authorization. It allows for the identity to be portable, untethered to any specific authority, and application owner still controls authz on the system they own.
The talk went really well. The live demo failed to launch twice on stage, I could (almost) not believe it, I knew it was ready to rock 
. Third time is the charm, though.
SPIFFE
Three different follow-up convos asked “what about SPIFFE?” And right on, that’s a clear follow-up question I half-anticipated. I felt like this talk was a very packed 30 minutes of tech (with ATProto and FGA being big topics that’d be new to many, and we knew we’d also be explaning Codenames gameplay) so last night I decided to cut SPIFFE from the script. It felt like too much, one too many acronyms. I had notes on paper, like a luddite, and it’s literally struck out.
SPIFFE has stronger workload binding than what we presented today, that process could also get an ATProto identity if it wants to play in that network. There’s no “firehose” concept or publicly verifiable records built into SPIFFE (meaning like PDS records, not like certificate / TLS records). I think there’s a picture where these are complementary technologies, not competing.
If we give this talk again anywhere I’ll include it directly, since clearly there’s interest in how it fits into the discussion. (And we were asked to give this talk again, which felt really nice 
)
The Full Original CFP
For now you can see a description of this talk you can see on the BSidesLV site here (I don’t know if this link will work forever), and the full orginal CFP is this…
Trust No Agent: Cryptographic Identity and Verifiable Messaging for AI
Common Ground, Tuesday 11:00-11:30, Florentine F
Multi-agent AI systems are proliferating fast, but who is the agent? Most deployments rely on TLS, API keys, and bearer tokens, with no portable identity, no message attribution, and no audit trail. When one agent tells another to take an action, the receiver has no additional verification the sender is who it claims to be. This talk demonstrates a practical stack for solving both problems: Auth0 Machine-to-Machine (M2M) applications for scoped API access, paired with ATProto (the protocol underlying Bluesky) for cryptographic, publicly verifiable agent identity and messaging. Each agent gets a DID and a secp256k1 keypair. Its public key lives in Auth0 client_metadata. Every message is a signed ATProto record, verifiable by anyone without trusting a central authority. To make this observable, we built a live demo: two teams of AI agents play Codenames. Audience members watch a real-time feed of agent deliberation records stream over ATProto; each one signed, DID-attributed, and auditable. You’ll watch agents disagree, defer to each other, and guess wrong; all with verifiable authorship.
Leave a Comment