AGNTCon + MCPCon Japan 2026

MCP grants AI agents access to file systems, Git, cloud, and SaaS. Yet permission models — IAM, OAuth scopes, PATs — were built for humans and fall short for AI.

The issue isn’t granularity. Existing permissions assume “human rationality” as a boundary: write access doesn’t mean a human wipes a repo; CI write access doesn’t mean a human exfiltrates secrets. Permissions stay broad because human judgment fills the gap. AI lacks this buffer — through prompt injection or edge cases, it acts destructively where a human would stop. Per-call approval collapses under fatigue.

As an SRE on strong production credentials, my question wasn’t “how to restrict AI” but “how to maximize safe delegation.”

I propose Intent as Code: coding what was left to human rationality. Three OSS tools:
safe-push rejects pushes touching .github/ or others’ commits, preventing CI hijacking
safe-gh wraps gh CLI with conditions like “only own issues” or “only approved PRs to develop” — expressing intent PATs can’t
safe-webfetch uses Claude Code Hooks to auto-allow learned-safe URLs, cutting fatigue decisions

Attendees leave understanding why permissions fall short for AI, with patterns to apply.

Your agent swarm is running. It's browsing the web, calling APIs, reading files, making decisions, all on behalf of your users and your organisation. But ask yourself: do you know which agent did what? Can you revoke access to just one of them? Can you prove to an auditor that your agents only touched what they were supposed to?

Probably not. Because most agentic deployments treat agents as anonymous processes : no identity, no credentials, no audit trail, no way to fire them when something goes wrong. If a human employee operated this way, you'd call security. For agents, we call it production.

This talk proposes a fundamentally different approach: onboard your agents like employees. Every agent in your swarm deserves a verifiable identity, scoped permissions, a centralised audit trail, and an offboarding process. Drawing from experience securing cloud native and AI infrastructure, this session presents a blueprint for an open source "Okta for agents"! composing Identity Providers, API gateways, and policy engines to bring the same governance we give humans to the systems acting on their behalf.

You hired 1000 people. It's time to learn their names.

Every agent system is two things: the model, which you rent, and the mask - the character - which is yours. The industry keeps upgrading the model and expecting the mask to improve. It doesn't work that way.

I'm a LAMDA-trained actor turned agent engineer. This talk is the actor's toolkit applied to shipped systems. Case one: a comms pipeline in production at a major crypto protocol - the generating model does Stanislavski table-work (super-objective, through-action, lining) before writing a word; a separate director model audits it blind; and voice is scored by a Laban Movement Analysis classifier that grades the human-written corpus and the machine's output on the same instrument. Brand voice becomes a falsifiable measurement. Case two: the home lab - eleven agents built with a Stanislavski character method, orchestrated over MCP, running my actual work.

You'll leave with the model/mask distinction, a character pipeline you can copy, and the failure modes: drift, voice collapse, paint-by-numbers slop.

Most "human-in-the-loop" agent systems assume the human can specify success up front: a passing test, green CI, a structured eval. What if the human's taste is the spec?

This talk presents YouAndOrchestra (YaO), an open-source agentic music composition system on Claude Code. YaO orchestrates seven role-based subagents — Producer, Composer, Harmony Theorist, Rhythm Architect, Orchestrator, Mix Engineer, Adversarial Critic — turning natural language into a score evaluated across six dimensions, every note carrying provenance.

https://github.com/shibuiwilliam/YouAndOrchestra

Three collaboration patterns from iteration:
1. Three-tier feedback. Users rewrite the YAML spec, regenerate a section, or pin feedback to a bar, beat, and instrument. Choosing the level is itself a UX problem.
2. Conductor loop with a critic gate. Generate, evaluate, adapt, regenerate runs up to three iterations, with critics gating before notes are placed.
3. Provenance as trust substrate. /explain queries an append-only causal graph — "why did the chorus modulate to the relative minor?"

Attendees leave with patterns and open-source code for agent systems where the human stays in the seat of judgment.

AI coding agents now generate UI from component libraries. Most teams write component markdown files and expect agents to take it from there. The docs were complete. Agents still got it wrong.

Sitting with engineers in code review, the same things kept surfacing: the agent picked a visually similar but wrong component; it invented props; it read "Tag" as a UI primitive when the codebase meant a security concept. One author. No review process. A library too large for any agent to navigate without a map.

Not a component library talk. A talk about what the workflow was missing when the docs were already done.

I'll walk through the workflow that came out of those sessions: why a component file needs more than one author before agents can trust it; how an index changes what agents can find; and the naming decision that was invisible to humans and catastrophic for agents. Including the moment the team realized the problem wasn't the docs.

You'll leave with one reframe: a component library has always had two users. It now has a third. Here is what the workflow looks like when you build for all three.