Joey Orlando
Co-Founder - Archestra.AI
Actions
Co-founder at Archestra - building an open-source AI platform for enterprises + OpenAPPA, an MIT-licensed, deterministic agentic security framework.
Ex-Grafana. Active member of the MCP contributors community.
In a past life, biochemist at Harvard University and McGill University.
Deterministic Security for AI Agents: Data Flow Control at the Tool Boundary
An agent reads a private ticket, then a prompt-injected page tells it to post the contents to a public issue. A model can follow the instruction; a tool boundary can still prevent the write.
Joey Orlando and Innokentii Konstantinov will show how recoverable information-flow control can secure multi-step agents without making every restriction a dead end. Using the open-source OpenAPPA framework with MCP and a Kubernetes-native kagent example, they trace audience and trust labels through tool results, check actions before dispatch, and validate outputs before those outputs enter agent context. They then show how scoped approval, sanitization, and isolated child trajectories let legitimate work continue after a block.
The speakers will share task-completion and attack results, their limits, and a practical path to add tool contracts to an existing agent stack. Attendees will leave able to design and test explicit data-flow policies for their own tools.
Beyond the First MCP Tool: Identity Continuation Across Agent Workflows
An agent reaches an MCP gateway with a user's authorization, then needs to call another service. The gateway cannot reuse its incoming token, and the user may no longer be present to approve another grant. How can the task continue safely?
After a brief ID-JAG primer, this session follows the new Identity Continuation Assertion Internet-Draft through a gateway-to-service flow. The speakers trace how a resource authorization server records an accepted ID-JAG; how a short-lived, sender-constrained assertion reaches the identity provider through OAuth token exchange; and how current policy governs a new, target-specific ID-JAG. They examine trust, actor identity, revocation, and the work required of gateway and downstream authorization server authors.
Unlike the speakers' 2026 AGNTCon/MCPCon talk about the initial ID-JAG flow, this session focuses on the next authorization hop. Attendees will leave with a model for multi-hop agent access and a checklist for MCP-backed services.
OpenAPPA on kagent: Deterministic Guardrails That Don't Break Agents
AI agents are useful because they can read private data, consume untrusted content, and act on the outside world. That combination also makes prompt injection dangerous. Many guardrails ask a second model to judge each tool call, but a judgment on one call cannot reliably track where data came from across an agent's workflow.
In this 10–15 minute lightning talk, I'll introduce OpenAPPA, an open-source, deterministic approach that tracks data provenance and checks tool calls before they run. I'll show how it works with kagent, where agents are Kubernetes resources, then walk through a live demo on kind: an agent encounters an unsafe public GitHub action, the runtime blocks it and offers a remedy, and the agent still completes the legitimate work.
You'll leave with a concrete pattern for making agent guardrails both safe and useful, without putting another LLM in the approval loop.
ID-JAG: Solving OAuth Sprawl for Enterprise AI Agents
Enterprise AI agents are moving from demos into production, and auth is becoming a blocker. Demo agents can connect to tools with OAuth, but real enterprise agents may need SaaS services for thousands of employees. Per-user, per-service consent does not scale.
This session explains ID-JAG, the Identity Assertion JWT Authorization Grant pattern behind MCP's Enterprise-Managed Authorization extension. ID-JAG turns an existing SSO login into centrally governed, auditable access to approved MCP servers, without repeated OAuth prompts.
We'll cover the production problem, protocol flow, and lessons from implementing ID-JAG support in Archestra, one of the first MCP clients to support it. We'll also discuss what identity provider support enables.
Attendees will leave with a model for production agent auth: one SSO login, centralized policy, scoped MCP-native access tokens, fewer consent screens, and a cleaner security review story.
We'll close with the missing piece: SaaS provider adoption. To unlock enterprise deployments, authorization servers need to support this flow so agents can access approved business systems without key-sharing, manual credentials, or one-off integrations.
AGNTCon + MCPCon Europe 2026 Sessionize Event
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top