Paola Estefania de Campos De Franco Is Building a Safer Identity Layer for AI Agents

An AI assistant can now help book a flight, draft an email, manage a task, or touch parts of a person’s digital life that used to belong only to the account holder. The convenience is obvious. The security question is less comfortable. If an action happens inside a user’s account, who actually did it? Paola Estefania de Campos De Franco, a staff software engineer and AI agent identity expert, believes the answer cannot remain vague.

“An AI agent should not need your password to help you,” de Campos says. “If it is acting for you, the system should know that. It should not have to pretend to be you.”

That distinction sits at the center of her work. de Campos co-created the Agent Auth Protocol, a proposed open standard designed to give each AI agent its own verifiable identity, specific user-approved permissions, full traceability, and the ability to revoke access when needed. The goal is simple to state and difficult to build: let an agent act on behalf of a person without borrowing the person’s identity.

Today, many AI agents still operate through user tokens, API keys, passwords, or broad account access. That may be convenient, but it creates a dangerous blur. If an agent reads an email, sends a message, deletes a file, or updates a production system, the audit log may only show that the human user performed the action.

To de Campos, that is not a small technical inconvenience. It is an accountability problem.

“The audit trail has to tell the truth,” she says. “If an agent took the action, the system should say which agent acted, for whom, under what grant, and within which limits.”

The stakes are rising because agents are moving from novelty into production. The industry is filling with products that promise autonomous action: agents that book, buy, code, retrieve information, move data, and manage accounts. Yet the identity layer has not caught up with the behavior layer. Platforms can increasingly ask agents to do real work, but they may not have a clean way to distinguish the user from the software acting under the user’s authority.

That gap is the problem de Campos is trying to close.

“Most identity systems were built around humans logging in,” she says. “The harder question now is delegation. How does a person safely give a piece of software the power to act for them?”

Her framing is deliberately practical. A person would not hire a human assistant and give that assistant an unrestricted password to every account. The safer model is role-based. The assistant receives a defined identity, a clear job, limited authority, records of what was done, and access that can be removed when the work ends.

AI agents, de Campos argues, need the same kind of structure.

“Do not give agents your credentials,” she says. “Give them authority, with boundaries.”

The Agent Auth Protocol is her technical answer to that principle. It gives agents cryptographic identities, user-approved scopes, revocable grants, and traceable actions. Instead of a log that says only that Paola accessed an account, the system could show that a specific agent accessed a specific resource on Paola’s behalf, under a specific delegation, within approved constraints.

That difference matters because a mistake by an AI agent is no longer just a bad answer on a screen. It can become an operational or security event. An agent with excessive access could send the wrong email, expose sensitive data, misuse credentials, delete information, or change a live system. Without honest identity and revocation, the user may have no clean way to shut down the agent without locking themselves out too.

“The kill switch matters,” de Campos says. “A person should be able to revoke the agent, not destroy their own access.”

de Campos' authority on the issue comes from a career in identity systems. At Auth0, now part of Okta, she worked on financial-grade identity for regulated industries and on authentication for AI agents. At Auth0 she contributed to the async authorization features (CIBA) and to auth for agents, work that involved async auth and token exchange as a whole, including DPoP and another spec. That experience exposed both the strength of existing identity standards and their limits when applied to agentic software.

“I do not think the answer is to throw away what identity already knows,” she says. “OAuth, CIBA, DPoP, JWTs and other standards give us important building blocks. But agents need another layer because the question is different.”

That question is not only who is the user. It is also who is the agent, who is the agent acting for, what was granted, what was done, and how quickly that authority can be withdrawn.

de Campos now works as a Staff Software Engineer at Better Auth, an open-source authentication framework downloaded more than 2 million times a week. Better Auth places her work inside a developer ecosystem where agent identity is not merely theoretical. As more companies experiment with AI agents, they need ways to deploy them without handing them broad credentials or pretending they are human users.

The timing, in de Campos' view, is critical. She sees a familiar pattern forming. New technology arrives. The industry celebrates capability. Security and privacy come later, after bad habits are already entrenched.

“We have seen this movie before,” she says. “The internet gave us extraordinary capability, and then the industry had to pay the security debt. With AI agents, we have a chance to build trust infrastructure earlier.”

Her own path into this work was not conventional. de Campos is a self-taught engineer from Montevideo, Uruguay. She studied computer science, left technology for several years, became a chef, founded a vegan food business, ran a restaurant, taught courses across multiple countries, and later returned to software by building her own online-course platform. During the pandemic, she built hospital registration software for Doctors Without Borders, then moved into senior and lead engineering roles before specializing deeply in identity.

That non-linear background informs how she sees systems. Running a restaurant, she says, taught her that pressure exposes weak processes. Identity engineering taught her that invisible systems carry enormous trust.

“People do not think about identity when it works,” de Campos says. “But every important digital action depends on it.”

Agent identity may become one of the next invisible systems people depend on. If the industry gets it right, AI agents can take on real responsibility with clearer boundaries. Users can delegate without surrendering their accounts. Companies can deploy agents with traceable behavior. Platforms can stop treating every automated action as if the human personally performed it. For more information, visit the Agent Auth Protocol website.

If the industry gets it wrong, de Campos believes the damage will move faster than earlier waves of the internet because agents can act at machine speed.

“Agent identity is not a future problem,” she says. “It arrives the moment people let agents touch real accounts.”

For de Campos, the principle is clear: agents should act for users, not impersonate them. That shift may sound subtle, but it changes the foundation of trust. It means an AI assistant can have its own name, its own permissions, its own record, and its own off switch.

“The future I want is simple,” she says. “Every agent has a verifiable identity. Every user has control. Every action can be traced. That is how we let agents become useful without giving them the keys to everything.”