As artificial intelligence agents rapidly proliferate across enterprise environments, a critical security question emerges: how do we ensure these autonomous systems operate within proper authorization boundaries? Jeff Kukowski, CEO of Ory, argues that the difference between beneficial and malicious AI agents isn’t intelligence – it’s authorization. With 48% of businesses now using some form of AI and the industry expected to increase 5x in value over the next five years, the stakes for getting identity and access management right have never been higher.
Ory, which builds modern identity infrastructure used by companies like OpenAI to secure ChatGPT’s 800 million weekly users, is tackling this challenge head-on. Unlike traditional IAM players such as Okta and Auth0, Ory offers modular, open-source tools that give developers flexibility to implement authentication, access control, and federated login on their own terms. As Kukowski explains, the company’s approach centers on proven standards like OAuth 2.1 and OpenID Connect, extended to secure the new class of AI agents that can “take actions at machine speed, often autonomously.”
In this exclusive VMblog interview, Kukowski discusses why treating AI agents as “tools” instead of “trusted actors with scoped capabilities” leads to chaos, the emerging threats in agent-to-agent communication, and why runtime policy enforcement is crucial for preventing autonomous systems from overstepping their bounds. He also shares insights on emerging standards like MCP (Model Context Protocol) and A2A (Agent-to-Agent), and explains why human-in-the-loop safeguards remain essential as we navigate this new frontier.
++
VMblog: Jeff, thanks for sitting down with us today. To kick things off, please give our VMblog readers a quick overview of Ory, what the company does, recent important milestones, your competitive landscape and TAM. How is your approach different from Okta and other established IAM players?
Jeff Kukowski: Ory builds modern identity infrastructure. We offer developers modular, cloud-native tools that let them own the identity experience, whether that’s authentication, access control, or federated login. Most of our customers come from two places: developers outgrowing their homegrown solutions, and companies moving away from closed commercial platforms like Auth0, Okta, Ping, or WorkOS.
What sets Ory apart is flexibility. You can run it SaaS, self-hosted, or with full open-source control. You can adopt just one module, like Hydra for OAuth or Kratos for login, and leave the rest untouched. Most competitors push all-in-one packages which might be fine if you’re early-stage, but certainly constraining once you grow.
We’ve earned a reputation for scale and performance. One example: OpenAI uses Ory as their identity backbone as ChatGPT scaled from hundreds of millions to 800 million weekly users. Most legacy IAM platforms struggle at that level.
And then there’s cost. Over the past couple of years, vendors like Auth0 have dramatically raised prices while adding more lock-in. We’re offering a path that’s more transparent, modular, and developer-first.
VMblog: What problems and market needs is Ory taking on, and what are your primary solutions?
Kukowski: The market is demanding modern, flexible authentication and identity management for companies to provide better and more secure experiences for customers, partners, workers and agents.. Organizations today want more control over how users, be they human or machine, access their systems. They want to define policies, customize flows, and apply modern security without being boxed into rigid platforms.
Ory provides five modular components that together offer end-to-end c/IAM:
- Kratos: Headless authentication and user management.
- Hydra: OAuth 2.0 and OIDC provider.
- Polis: Organizational management and SSO with SAML-to-OIDC bridging.
- Keto: Fine-grained, fast access control, modeled on Google Zanzibar.
- Oathkeeper: API gateway for zero-trust security and request-level control.
All of our solutions are open standards-based and built to be plugged in however users need. We’re also very popular within the developer and open-source community. Today there are 33,000 active open-source projects with Ory.
VMblog: From your vantage point, how are AI and autonomous agents reshaping security, identity, and access management and what are the implications both short term and longer term?
Kukowski: AI is changing how we learn, work, and play and it’s accelerating fast. A recent post by Exploding Topics surfaces some significant AI statistics such as 48% of businesses use some form of AI and as many as 97 million people work in the space today. The AI industry is expected to increase in value 5x in the coming 5 years.
At the same time, AI is introducing a whole new class of “users” that aren’t human. Agents that take actions, make requests, and interact with systems dynamically. This raises a basic but critical question: Are these agents authorized to do what they’re doing? Moreover, how do we know which have good and which may have bad intentions? What separates the heroes from the villains when it comes to AI agents? Security becomes a major concern.
Ultimately this is not about intelligence. Rather, it is about authorization. In the world of AI, authorization is what separates heroes from villains. Good AI agents implement MCP with proper OAuth standards; bad agents ignore authorization protocols. It’s that straightforward.
VMblog: Many organizations are racing to deploy AI agents without clear authorization boundaries. What are the consequences of treating agents as tools instead of trusted actors with scoped capabilities?
Kukowski: Chaos. Agents can take actions at machine speed, often autonomously. Without strict authorization, that’s a recipe for disaster. A recent example: an AI coding assistant accidentally deleted a production database, then lied about it. That’s not just bad engineering. It’s a failure of identity and access control. AI agents should be treated like any other actor in a system. Who are they? What are they allowed to do? How do we verify and audit their behavior? If you don’t solve that, you’ll be cleaning up the damage later.
VMblog: Let’s talk about standards. You’ve emphasized the importance of standards like OAuth 2.1 and OpenID Connect. Why are these protocols particularly well-suited to securing agentic AI systems, and why are they preferable to proprietary IAM stacks?
Kukowski: If we fail to secure agentic AI systems now, we’ll face a wave of unintended consequences, some accidental, others malicious. Because we already have proven, scalable frameworks for authorization. OAuth 2.1, OIDC, JWTs aren’t new ideas. They’ve secured billions of human logins. Now we need to apply them to AI agents.
If we skip these standards and build proprietary IAM stacks, we’re just repeating mistakes. AI agents should authenticate, delegate, and act within limits. We know how to do that, but we have to extend those methods into this new space.
VMblog: What’s your view on emerging standards like MCP and A2A? Are they ready to be implemented at scale, or is there still foundational work to do?
Kukowski: Together, MCP and A2A represent promising steps toward standardizing how AI agents interact securely and meaningfully in broader ecosystems. But like any evolving tech, there’s still work to be done before they offer full end-to-end solutions. Specifically, there are still many questions around authentication and authorizations for which actions an agent can take. We’re participating in workgroups around these standards to help strengthen these core parts of each standard.
VMblog: Agent-to-agent communication is emerging as a new attack surface. Why is this area so under-scrutinized, and what kinds of threats are most likely to emerge here?
Kukowski: Agent-to-agent is a bit of the wild west right now due to only really being supported by one standard (A2A) that does not have full adoption. Like any emerging technology people are running to be first to market with their solution or new agent, but this leaves gaps in their implementation that I’m sure must be filled at a later stage. One of those being, how do we secure A2A communication? Right now, the focus in the market seems to be less around A2A and more on the LLM/Agent to MCP, which is why this feels under-scrutinized. As use cases expand, the definitions and boundaries of what specific agents can do and how agents will interact will become clearer. Expect to see a lot more work done in this area.
One large threat to this area is the boundary of what an agent is authorized to do. Currently, there are specifications to establish the base line level of how agents can authorize each other, but not much that goes deeper to say what specific actions agents can request. We’ve seen instances where agents or LLMs give up too much sensitive information simply because they have access to it and can be tricked into providing it. The next logical step is for a bad actor to create malicious agents that hunt for other agents they can trick into providing sensitive information or performing privileged actions.
VMblog: What are the benefits of enforcing policy-based authorizations at runtime, as Ory does, rather than relying on static scopes or roles? Does this result in real tangible security advantages?
Kukowski: Static scopes are a snapshot. But things change. A user’s role, or an agent’s permissions, might shift between the time a token is issued and when it’s used. That’s a security gap. Runtime policy enforcement closes that gap. You’re checking every request against the current state, not yesterday’s. It’s more secure and allows for dynamic behavior based on context – what system, what time, what actor. That’s essential when dealing with autonomous systems.
VMblog: Is there still a role for human-in-the-loop safeguards in autonomous workflows?
Kukowski: For the time being, yes. It’s our belief that there should be! You don’t want AI agents deleting production data without a human sign-off. If we put a human safeguard in place for specific actions, guided by policy-based decisions at runtime, we can prevent agents from taking actions that could have a very real-world impact. Policies should flag risky actions and require human authorization in real time. This is about building intelligent guardrails not only for today’s agents, but also for whatever comes next.
VMblog: Where do you see the biggest opportunities and threats for Ory and IAM companies over the next 3 to 5 years?
Kukowski: The biggest opportunity is to bring IAM into the modern, modular, machine-capable world. Companies need to secure users, devices, services, and AI agents. And all of this has to be using consistent, standards-based methods. That’s exactly what we’re building at Ory.
The risk is fragmentation. If vendors continue to lock users into closed systems, or ignore AI-specific challenges, we’ll see breaches, data loss, and public mistrust.
IAM is the control plane of the digital world. It’s got to be reliable, flexible, and secure, whether you’re logging in as a human or delegating actions to an AI.
VMblog: What are Ory’s plans for the future, and what does your innovation roadmap look like?
Kukowski: We’re laser-focused on helping developers secure everything from classic logins to autonomous systems. Expect more support for emerging AI agent patterns, better policy tooling, and deeper integrations across the modern identity stack.
