The T&C Gatekeeper: Simplifying GDPR Compliance in Keycloak

In the era of data protection regulations, GDPR compliance isn't just a legal requirement—it's a trust-building imperative for businesses. While Keycloak offers robust features for user authentication and authorization, many organizations struggle with the intricate dance of ongoing compliance throughout the user lifecycle. This talk unveils a different than usual approach: a composition of custom Keycloak authenticators that seamlessly integrate policy acceptance into your login flows.

Imagine a world where users effortlessly review and accept client-specific policies before gaining access, all within the familiar Keycloak IDP context. We'll dive deep into the code, demonstrating how to retrieve policies dynamically, present them to users, and gracefully handle acceptance or rejection. This isn't just about ticking compliance boxes; it's about creating a user-friendly, legally sound, and auditable process that respects both your users and regulators.

Discover how this custom solution not only ensures GDPR compliance but also enhances user trust and streamlines your data protection strategy. Whether you're a developer, architect, or compliance officer, you'll walk away with practical insights to elevate your Keycloak implementation and turn GDPR challenges into opportunities for excellence.

Crafting your Agentic Harness: Hands-On Harness Engineering for AI Coding Agents

AI agents promise to write your code, ship your features, and close your tickets before standup. In practice? They hallucinate files that don't exist, refactor things you never asked them to touch, and confidently break your build while telling you everything looks great.

It's time for an intervention.

In this workshop, we'll explore the full spectrum of agentic software development. From overly cautious agents that won't act without hand-holding to reckless ones that rewrite your entire architecture on a whim.
You'll learn where the levers are and how to pull them without everything catching fire. We start at the foundation: context engineering. What an agent knows determines what it does, and what it forgets (context rot) determines what it destroys. Get this wrong and nothing else matters.

Once the agent sees clearly, you need it to behave. That's where skills, instructions, and hooks come in. Repeatable workflows, hard boundaries, and audit points that let you intercept before damage is done.

Then we go structural. The Agent OS workflow introduces spec-driven development: structured feature specs that turn vague intent into verifiable, shippable work. No more hoping the agent guesses right.

By the end, you'll be crafting custom commands and skills tailored to your codebase, your conventions, your way of working, until the agent does exactly what you tell it. Every time. You'll leave with working code, battle-tested configurations, and the confidence that when you say "ship it," it actually ships what you meant.

Who should attend: Developers and technical leads who've used AI coding agents in real projects and are tired of babysitting them. Bring a laptop.

Your Agents Are in Production. Who Are They, and What Are They Doing?

AI agents are moving into production fast. They call APIs, read databases, send mail and trigger workflows. In most setups they do this with a service account, a long-lived API key or a token copied from the developer who built them. There is no clear answer to who the agent is acting for, what it is allowed to do, or what it actually did.

This is an identity problem, and the IAM world has already started working on it. This talk walks through the building blocks: agent identity and workload identity, OAuth token exchange for delegation, ID-JAG (Identity Assertion Authorization Grant) for cross-domain access, the AAuth proposal for agent-specific authorization, and agent gateways as the place where policy is enforced and every call is logged.

We look at how these pieces fit together in a Java stack, where they overlap, and where the standards are still moving. Along the way we cover the questions to ask before an agent gets access to anything: which user or system it represents, how its permissions are scoped and expire, and how you trace an action back to a decision.

You leave with an overview of the concepts and specifications in use today. Some are still experimental at the time of writing; some may be finished RFCs by the time this talk is given. Either way, you will know what to look for and what to ask your vendors.

Participants understand why AI agents are a new class of identity and why service accounts and API keys are not enough. They know the main building blocks for agent access: workload identity, OAuth token exchange, ID-JAG, the AAuth proposal and agent gateways, and how these fit into a Java stack. They can judge which parts are stable and which are still experimental, and know which questions to ask before an agent gets access to a system: who it acts for, what it may do, and how to trace it.