An agent that acts on your behalf needs your access. That harmless-sounding sentence hides a real security problem: the GitHub token that ends up in plain text on a runner, the API key copied into three projects, the agent with far more rights than the task requires. At ai-PULSE 2026, it was Raffi Krikorian, CTO of Mozilla, who put it on the table in the opening keynote. He splits an agentic system into three layers: think, show, act. The last one, permissions, is in his view wide open: “The standards don’t exist yet, and the infrastructure doesn’t exist yet.” His slide: “Act — identity and permission. Essentially unclaimed.” Nobody owns the ground. He quoted a figure: 93% of agent actions are approved with a single click, the way you accept a cookie banner.
A few hours later, Zalando showed its answer.
The scale of the problem
Bartosz Ocytko came to present “Scaling Agentic Engineering in an Enterprise Environment”. The scale sets the tone: 250+ teams, 300+ AWS accounts, 250+ Kubernetes clusters, 2,700+ microservices in Java, Kotlin, Scala, Go and Python.
In a setting like that, “we’ll put the token in an environment variable” does not last thirty seconds.
The Agentic Identity Broker
Their building block is called the Agentic Identity Broker, it is open source, and the idea is clean.
The user consents once, per agent. The agent receives delegated access. The broker holds the encrypted tokens and issues scoped, exchangeable access to third-party services — GitHub, Google, internal APIs. It all rests on RFC 8693, OAuth 2.0 Token Exchange, applied at the edge.
The key point: the agent never sees the user’s token. It gets a limited, revocable right for a specific target. That is the difference between delegating access and handing out a secret.
What AI does to code reviews
Before getting there, Zalando measured the effect of agents on its own repositories, quarter by quarter since 2023.
Pull requests are getting bigger: the 100–500 and 500–1,000 changed-lines buckets are gaining ground, the very small ones are shrinking. Commit messages have grown by one to two orders of magnitude, from 10–1,000 characters to 100–10,000 and more.
Code produced faster does not vanish into thin air: it lands on someone who has to review it. Hence their bot that assesses the risk of each PR. The load shifts, it does not evaporate.
The guardrails
This was the part that interested me most. At Zalando, AI is not a separate topic: it is built into the way they make software, with explicit governance. The Tech Radar says which tools and which models are allowed. The legal review follows European regulation: the notion of “high-risk” use cases comes from the AI Act.
The framework they presented fits in three columns, and it is the part most directly reusable elsewhere.
Govern: a Tech Radar, which also sets the allowed models, an open source licensing guide, and an inventory of AI systems and models in the developer portal. Support: production readiness reviews, self-assessment legal scorecards, a legal review for high-risk use cases. Verify: detection of AI model usage by scanning Docker images, offline and online evaluations, end-to-end probes in production.
Detection by image scanning deserves a closer look. Knowing which models actually run across your estate, without relying on what teams have declared, is a simple and measurable compliance control. Most organisations do not have it.
The rest of the ecosystem
Around all this, a platform and inner source between teams.
An agent platform, MCP servers for access to internal and external systems, a self-extending LLM wiki per business unit, skills marketplaces at three levels — company, domain, team — and shared tool configurations.
A single point of passage is also worth noting: all model calls go through a LiteLLM proxy. Prompt caching is enabled there through hooks, so transparently for the applications. And since the proxy sees consumption per team, the cost discussion happens in the same place as the bill.
What I take away
Raffi Krikorian was right. Models are moving fast, chips are moving fast, and agent identity remains an open problem. Zalando published its answer rather than keeping it, which says a lot about the state of the market: at this stage, nobody benefits from everyone reinventing their own token vault in a corner.
For anyone building products where an agent acts on customer systems, this is the building block to look at before writing your own.