From Pets To Cattle To Agents: Identity for AI Agents and Workloads | mcdwayne | BSides312 2026

"Treat servers like cattle, not pets" captured one of the biggest shifts in how we run infrastructure. Now, AI agents are forcing another mental shift, as we anthropomorphize these nondeterministic autonomous processes. How do we handle delegation, security, and identity for these agentic systems? This talk will look at the state of authentication and authorization across services today and how we got here. We will look to answer why human and non-human identity management diverged and what that means to various parts of our organizations. --- About mcdwayne: Developer Advocate at GitGuardian and huge fan of open source Dwayne has been working as a Developer Relations professional since 2015 and has been involved in tech communities since 2005. He loves sharing his knowledge, and he has done so by giving talks at over a hundred events worldwide. Dwayne currently lives in Chicago. Outside of tech, he loves karaoke, live music, and performing improv. Recorded live at BSides312 2026. --- Chapters: 0:00 Welcome and Why BSides312 Matters to Me 1:10 This Is a Mouse 2:20 Anthropomorphism: We Can't Help Ourselves 2:50 The Golden Moment 3:30 Wendy Nather and Toxic Anthropomorphism 4:40 The Mythos Briefing Mentions Identity Once 5:00 About Dwayne 5:50 GitGuardian and the CrowdStrike Report 6:30 89% AI-Enabled, 82% Malware-Free 7:00 Steal the Credentials and Log In 8:10 TJ-Actions, Shai-Hulud, TanStack 9:00 Why I'm Still in This Fight 9:20 What About the Pets? 10:00 A Sidetrack Into History: One Computer 10:30 Security Was a Guy With a Gun at the Door 11:00 ARPANET and the First Email 11:20 Passwords Were Never a Security Feature 12:00 The Era of Pets: Keeping the Sick Dog Alive 12:50 The Machines Got Smaller 13:30 Waterfall, Agile, and the Birth of DevOps 14:30 DevOps Is Not Tooling 15:10 Virtualization: Pets That Became Working Animals 16:00 Cloud Is Just Someone Else's Machine 16:30 98% of Deployed Code Is Not Yours 17:00 Long Passwords, Now Called API Keys 17:40 ClickOps Sucks, So We Wrote the Config File 18:40 Containers, Jails, and Kubernetes 19:50 Finally, Cattle: What Do You Do With a Sick Cow? 20:40 Ablative, Not Resilient 21:00 2022: A Random Number Generator You Trust 21:40 Summations, Netflix, and Why It's Just Math 23:40 What "Agent" Actually Means 24:30 Walking People Back From the Nightmare Scenario 25:20 OpenClaw Is Just Web Architecture 26:00 From Zeus and Olympus to Process IDs 27:00 And Then We Gave It a Name Again 27:40 Why Humans Get Keys: Accountability 28:40 A Machine Can Never Be Held Accountable 29:10 Why "Non-Human Identity" Is a Bad Term 29:40 Delegated Human Identity 30:50 The Light Bulb Moment Before KubeCon 31:30 Standing Privilege and Leaked Keys 32:00 28.6 Million Hardcoded Credentials 33:00 The Good Samaritan Program 34:00 70% Still Valid Three Years Later 35:00 Does AI Make It Worse? 36:10 What Happened in September 37:00 So What Do We Do? Vaults and Their Limits 38:30 The Secret Is Identity 39:00 What Identity Actually Means 39:40 Give Everything an ID 40:50 SPIFFE and SPIRE 42:00 Authentication vs. Authorization 43:10 Kubernetes Already Does This Out of the Box 44:20 Istio, Envoy, and Intercepting Everything 45:30 WIMSE and the IETF 47:00 The Future Is Already Here 47:50 AWS STS and Federation 49:00 What the Argument Actually Is 50:10 Stop Them Before They Hand Over the API Key 51:20 How Uber Is Doing It 51:40 Local Agents and Vaulting 52:30 AI Hooks and Sanitizing Output 53:00 Prompt Injection Is Just SQL Injection 53:40 What Good Security Looks Like 54:50 Q&A: Authorization and Allow-All --- Mentioned in this talk: - SPIFFE and SPIRE - "Solving the Bottom Turtle" (free SPIFFE book) - Istio and Envoy - WIMSE (IETF working group) - AWS Security Token Service - GitGuardian State of Secrets Sprawl - "The Phoenix Project" - "The DevOps Handbook" Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw