Kim Maida of Keycard and Mason Egger of Temporal build an expense agent with delegated access and crash recovery in this 53-minute AI Engineer workshop.

Give each actor a verifiable identity

  • Replace a shared API key with separate identities for the user, agent application, and downstream services.
  • Use OAuth token exchange to request short-lived, resource-specific access when a tool runs.
  • Carry the user’s delegated authority through both hops: agent → MCP server → ledger API.
  • Keep the model proposing actions while application code requests and validates credentials.

Separate the agent’s authority from the user’s

  • The demo first gives the agent its own identity, then adds signed-in users without impersonating them.
  • A memo saying “on behalf of Kim” carries no verified identity by itself.
  • A $30 expense gets filed under the user’s identity and approved separately by the agent.
  • A $75 expense waits for human review; the signed-in submitter’s attempt to approve it is rejected.
  • Audit records connect each service hop and distinguish who filed an expense from who approved it.

Recover work without repeating completed calls

  • Temporal stores workflow progress and runs external operations as activities with failure handling.
  • Egger kills the worker after the ledger-debit activity, then restarts it to complete settlement from recorded progress.
  • The demonstrated recovery reuses completed results instead of repeating the previous model calls and activities.
  • Runtime credential injection keeps tokens out of the demo’s workflow history; payload encryption addresses other stored data separately.

Keep the security and reliability claims scoped

  • The workshop uses a shared sandbox and a client secret in a local environment file; workload identity is the suggested production direction.
  • The speakers describe tool-scoped tokens, but do not show cryptographic binding to every proposed argument.
  • Crash recovery covers the demonstrated completed-activity boundary; interrupted external writes still need a safe retry design.

Caveat: this is a vendor-led sandbox demonstration. Its checks do not establish complete prompt-injection protection or recovery from every production outage.

“We want it to say this agent did this thing on behalf of Kim with Kim’s permissions.”