Oh, your agents need OAuth2, too

Host Ryan Donovan asks Dan Moore whether OAuth2 works the same way in the agentic era. Moore says it is both familiar and different: OAuth2 and related standards are foundational building blocks that can evolve. Model Context Protocol (MCP), released in late 2024 or early 2025 without identity or security, was adopted because it was useful; over roughly the next year and a half, OAuth2, OAuth2.1, resource URL, and metadata standards were integrated into it. These are specifications developers must implement, not turnkey products.

Moore explains that MCP is also driving new standards, including the client ID metadata document. Traditional OAuth assumes the authorization server already knows the application requesting a token, but an MCP client—such as an agent or AI tool—may not know which authorization server it will contact. Ryan asks whether the familiar redirect-to-login flow changes. Moore says the redirect remains useful: surrounding software, rather than necessarily the language model itself, obtains a marker that the user authenticated and exchanges it for a token. He distinguishes this human-delegation case from agents acting autonomously.

For autonomous agents, Moore compares token acquisition to service accounts: the mechanics may still resemble a client-credentials grant, but the critical issue is constraining what the agent can do. His two principles are that an agent should have its own identity, making auditing possible, and that its limits must be enforced by deterministic software—not instructions such as “Claude, don’t break anything.” He cites an OpenClaw experiment in which an agent named Clottery Hepburn received its own accounts and a credit card with limited spending. Sandboxes, gateways, downscoped tokens, time limits, and single-use permissions can enforce least privilege.

Ryan notes that tightly controlled security can create user friction: while running Codex, he repeatedly had to approve Node processes and eventually resorted to “YOLO, approve.” Moore agrees that agents are supposed to remove work, not return it as a stream of approval requests. He suggests layering controls through gateways or intermediaries that downscope tokens, encouraging providers to expose more granular permissions, and automating repeat approvals while preserving a least-privilege starting point. He also recommends protecting refresh tokens and session credentials, preferably by giving agents separate identities and running them in constrained sandboxes.

Asked whether an agent needs another computer or an air gap, Moore says the answer depends on the task and that he is comfortable with some local sandboxes. However, he expects the agent itself to run in the cloud while the user controls the interface from a device. Cloud execution avoids laptop battery and availability problems and makes network access easier to constrain. Ryan jokes that by 2026—or in ten years—people may make memes about carrying around an open laptop, and Moore agrees that today’s limitations may define the medium’s future.

Moore describes a survey conducted with LeadDev of hundreds of engineers, summarized in a roughly 40-page report. The most striking result was that 69% had no plan to measure AI effectiveness in their software development lifecycle. After a discussion at Table Topics, Moore concluded that teams lacked a clear baseline even before AI and now have only directional signals. He argues that a feature is not truly done when deployed: it is done when users discover it, use it, and are happy with it. Teams currently measure tokens, lines of code, and pull requests, while the share tracking AI ROI or infrastructure spend rose from 15% in 2025 to about 30%.

The survey found that roughly 40% of respondents believed their teams had lost debugging ability, and 24% let AI agents reuse human credentials. Moore says code review and pull-request gates make credential reuse somewhat more understandable, but developers still own code written by AI. Ryan and Moore discuss “zombie PRs,” where 400-line or 4,000-line AI-generated changes linger because nobody wants to read them. Moore recommends treating the AI like a colleague: ask it to break work into ten reviewable changes. He says AI makes operational engineering, security, scalability, and production readiness more important, even when it makes MVP development dramatically cheaper.

Moore is hopeful about software development, comparing the moment to systems administrators’ experience around 2010. Engineers focused mainly on programming craft—such as brace placement or tabs versus spaces—may struggle, while those who care about customers, products, and solving business problems can build and learn faster. A solo founder can use Claude or Codex to create an MVP, but shipping that prototype without technical expertise invites trouble once it succeeds. Moore expects identity, security, operations, and scalability to retain value. He also advises against building commodity infrastructure: use established password-hashing systems, databases, and identity products unless those are the company’s actual differentiators; “boring software” and widely trained languages such as Java may work especially well with agents.