Zero-Trust Agents: Adding Identity and Access to Multi-Agent Workflows

Major challenge in authn and authz in the agentic workflows isn't authenticating user to the agent; but agent authenticating to tools, data sources, APIs via direct or MCP. Hotel booking is a simple example where user and agent both can have the same access rights to the booking API. That is user and agent both can book a hotel.
This is getting more complex when the booking API has different access levels and agent requires to be aware of the access rights the user entitled for the booking API. User needs to grant consent for the agent to access the booking API with choosen access rights. Then the agent should use the provided access grant to access the API on behalf of the user.