2 posts tagged with "authentication"

Somewhere in your support queue this quarter, a conversation happened with no humans in it. Your customer's procurement agent opened a ticket about an invoice discrepancy, your support agent answered with the refund policy, and the two of them went back and forth eleven times before the thread died — unresolved, unescalated, and invisible to both companies until the customer's CFO asked why the credit never arrived. Neither bot did anything wrong by its own rules. That's the problem.

Everything we've built for AI customer support assumes a human on the other end. Sentiment detection, frustration thresholds, "would you like to speak to a person?" — all of it models a customer who gets tired, gets angry, or gives up. A customer's agent does none of those things. It is infinitely patient, procedurally polite, and relentlessly on-script. When it meets your equally patient, equally on-script support agent, you don't get a resolution or a complaint. You get a stalemate that looks, in every dashboard, like a healthy conversation.

The first time a production agent runs for forty minutes and hits a 401 on step 27 of 40, the incident review is almost always the same. Someone in the room asks why the token wasn't refreshed. Someone else points out that the refresh logic exists, but it lives in the HTTP client the agent's tool wrapper was never wired into. A third person notices that even if the refresh had fired, two of the agent's parallel tool calls would have tried to rotate the same refresh token at the same instant and blown up the session anyway. Everyone nods. Then the team spends the next week retrofitting credential lifecycle into an architecture that assumed requests finish in 800 milliseconds.

OAuth was designed for a world where an access token outlives the request that uses it. Long-running agents inverted that assumption. The request — really, a chain of tens or hundreds of tool calls orchestrated across minutes or hours — now outlives the token. The industry spent a decade building libraries, proxies, and refresh flows around the short-request assumption, and almost none of it transplants cleanly to agent loops.