Your Agent Shouldn't Log in as You: Identity for MCP in Backstage

Abstract

Backstage 1.43 recently shipped scoped, short-lived MCP tokens. But a lot of teams still ignore them and wire the actions backend to a static admin token. The agent can now do anything you can, which is exactly the wrong default the moment an agent starts acting on its own. This talk goes deep on agent identity inside Backstage, on the primitives that already exist to fix this: - Token exchange (RFC 8693), so an agent acts with a derived, scoped credential, not yours. - OAuth 2.1 as the trust boundary between agent, actions backend, and Backstage. - The permission framework, where the real constraint lives, so an agent can't exceed its task. The through-line: you should not be able to ask an agent to delete a production database, and that guarantee lives in the permission model, not the agent's judgment. Scheduled for Monday, 9 November 2026, 2:40 PM to 3:05 PM Mountain Standard Time at the CNCF-hosted co-located events. Attendees leave knowing how to give agents their own scoped identity and enforce limits in the permission framework, rather than hoping the agent behaves.