The growing adoption of chat-style interfaces means users now interact with software by typing natural-language requests that AI agents translate into tool calls. When an agent is given direct access to a database, any successful prompt injection can turn it into a confused deputy that executes actions on behalf of the user while obeying attacker instructions.
Security experts have long known how to handle untrusted actors inside a perimeter. The principle of least privilege, capability-based attenuation, and just-in-time access were formalized decades ago. The same mechanisms now apply to probabilistic language models: instead of issuing a full user token to the agent, the system performs an OAuth 2.0 Token Exchange that narrows audience and scope to a single tool and a single resource.
Additional protection comes from DPoP, which cryptographically binds the token to the agent’s private key, rendering any stolen token useless without that key. For high-risk operations such as refunds, OpenID CIBA brings the human back into the loop by sending an approval request directly to the user’s existing chat session, after which a short-lived, narrowly scoped token is issued.
At the storage layer, PostgreSQL Row-Level Security policies check the authenticated user identifier on every query, ensuring that even a fully compromised agent cannot read rows belonging to other users. The demo stack published by issuerd shows the complete pipeline running in Docker and includes automated verification of login, order retrieval, prompt-injection attempts, and token-replay attacks.
The approach demonstrates that established identity and access-management standards already provide the controls needed for safe AI-agent deployments, without requiring new cryptographic primitives or user-experience changes.
