LONDON – April 9, 2024 – Okta, Inc. (NASDAQ: OKTA), the leading independent Identity partner, today announced the availability of Auth for GenAI in Developer Preview, as part of the Auth0 Platform, a suite of features that enable developers to integrate secure identity into GenAI applications, helping ensure AI agents have built-in authentication, fine-grained authorization, async workflows, and secure API access. Through other new capabilities, developers can better meet enterprise app requirements and deliver seamless experiences that address the expectations of today’s end users.
Why it Matters:
As LLMs become increasingly commoditized, with more widely available, cost-effective models and open-source AI frameworks emerge to rival proprietary systems, AI agents will become commonplace quicker than expected. This is in addition to LLMs making it possible for anyone to program in natural language.
Despite AI agents' ability to connect with more layers of data than LLMs alone, security remains an afterthought. To keep up with the pace of innovation, developers are wholly focused on functionality, often moving forward with insecure implementations or defaulting to postponing or canceling their AI agent projects altogether.
Authorization is being frequently overlooked. Agents are connecting to APIs with integrations that aren’t optimized for AI-driven access, and email or push notifications triggered to approve sensitive actions are being implemented with minimal security controls.
Regardless of what frameworks developers choose to build on top of, without a purpose-built security approach, these gaps leave AI agents vulnerable to unauthorized access, data exposure, and other prevalent LLM risks¹.
Outside of securely building GenAI applications, developers are also being tasked with ensuring their B2B SaaS applications meet the more stringent requirements of enterprise buyers, while also delivering seamless and contextualized experiences for end users.
“This explosion of AI-powered assistants that can answer complex questions, automate workflows, and take actions on behalf of users is undoubtedly exciting. However, it can be challenging to add security effectively once deployed,” said Shiven Ramji, President of Auth0, at Okta. “With Auth for GenAI, developers can help ensure that AI agents are built with secure authentication and authorization from their inception, granting access only to what’s necessary and preventing misuse.”
Secure Identity in GenAI Applications with a Seamless Developer Experience
AI agents are being granted access to systems without the right identity controls, creating security blind spots and risk. Traditional authentication methods weren’t built for AI-driven applications, leaving gaps in control and accountability. Developers need to ensure AI agents authenticate users, interact with other apps on the user’s behalf, use asynchronous interactions, and consider user permissions when accessing data.
What’s the Latest – Auth for GenAI
Now available in Developer Preview, Auth for GenAI enables developers to meet the identity requirements to build secure agentic apps and seamlessly integrate with the broader GenAI ecosystem. Auth for GenAI also integrates with popular AI frameworks like Langchain, Llamaindex, Google GenKit, and Vercel.ai, giving developers greater flexibility and efficiency in building and deploying AI-powered applications. Features include:
User Authentication: To operate securely, AI agents must authenticate users, just like any other application, ensuring they confirm the user's identity before granting access or taking specific actions. With Auth for GenAI, developers can build a secure and seamless experience for AI agents to authenticate users.
Token Vault: AI Agents interact with applications on behalf of users through APIs, not user interfaces. Without strong identity controls, AI agents could access APIs they shouldn’t, leak sensitive data to unauthorized sources, or be unable to perform tasks. With the Token Vault, AI agents can securely connect to tools like Gmail and Slack using OAuth 2.0 for token management while also automatically handling token refreshes and exchanges.
Asynchronous Authorization: AI agents don’t always complete tasks instantly, with some actions—like data processing, transaction approvals, or decision-making—taking minutes, hours, or even days. Async authorization triggers human-in-the-loop approval, allowing humans to supervise and approve or reject sensitive actions when away from the chatbot.
Fine Grained Authorization for RAG: Not every AI agent should have the same permissions. Some should only retrieve data, others should execute commands, and some should make high-risk decisions—like approving a loan or processing a refund. With Auth0 Fine Grained Authorization for retrieval augmented generation (RAG), agents will only retrieve documents that users have access to, dynamically updating to reflect changing business rules, compliance requirements, and risk levels.
