# Open agent ecosystems and strong security can coexist

Markdown copy of https://realalpha.app/s/open-agent-ecosystems-and-strong-security-can-coexist/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Kevin Scott](https://realalpha.app/builders/kevin-scott/) · Kevin Scott is CTO of Microsoft. · Chief technology officer at Microsoft, previously SVP of engineering and operations at LinkedIn and VP at AdMob.
- Host: [Dan Shipper](https://realalpha.app/people/dan-shipper/) · Co-founder & CEO, Every · Sold his first startup, Firefly, to Pegasystems; writes Every's Chain of Thought.
- Show: AI & I
- Episode: [Microsoft’s Vision for an Internet Made for Agents With CTO Kevin Scott (Best of the Pod)](https://realalpha.app/v/jBGo33Jkids/), Aug 12, 2026
- Moment: 9:38 to 15:42 of the episode (6 min), playing on https://realalpha.app/s/open-agent-ecosystems-and-strong-security-can-coexist/; the episode from there: https://realalpha.app/v/jBGo33Jkids/?t=578

## Quote

> “I think it might be a **false dichotomy**. There is, you know, like a thing that you have in these open systems where they are permissionless.”
> — [Kevin Scott](https://realalpha.app/builders/kevin-scott/) at [12:43](https://realalpha.app/v/jBGo33Jkids/?t=763) · AI & I

## Takeaways

1. MCP’s simplicity gives the community room to define security.
2. Agents need identities and permissions tied to the user.
3. Agents could use context to spot suspicious activity.

## About this segment

Kevin Scott argues that permissionless innovation need not conflict with robust security. Agent identities, scoped permissions and context-aware risk checks could protect users without making the system proprietary.

From “Microsoft’s Vision for an Internet Made for Agents With CTO Kevin Scott (Best of the Pod)”, Aug 12, 2026. [Watch the full episode](https://realalpha.app/v/jBGo33Jkids/)

## Transcript

From the transcript AI & I publishes with the episode.

[9:42](https://realalpha.app/v/jBGo33Jkids/?t=582) And it brings up for me, I've been starting to hear rumblings from people who are thinking a lot about MCP that the security model needs a lot of work. Yeah. And I'm curious, like, for your take on that, because you're making a lot of comparisons between this stack and the Internet stack. And the Internet has a bunch of, like, things in its security model, like the same origin policy that makes sure that, like, if a website is serving you code, like, it's only able to execute on its own data.

[10:10](https://realalpha.app/v/jBGo33Jkids/?t=610) And MCP doesn't really have that. So, like, how do you what do you think the right security model is for this? Well, look, I don't know that I know what exactly the right security model is. But, like, the interesting thing about MCP is, like, it is so coherently simple that it's going to be relatively easy for the community to decide what the security model is. Like, we have a bunch of, like, enterprise things that we care a lot about and that, like, we're doing really good work with the MCP team.

[10:42](https://realalpha.app/v/jBGo33Jkids/?t=642) team to get done so like we need agents to have identities so that you can build entitlement systems so you can say this agent is acting on behalf of this person and like they are entitled to see these resources in this system and like even having a way for an agent to sort of go query a bunch of systems and say like These here's the thing that I would like to do. These are the systems I need to touch in order to do the thing.

[11:11](https://realalpha.app/v/jBGo33Jkids/?t=671) Like what entitlements do I need to ask for in order to do this? And so I can request permission like from the user, like the person who's delegated this task to me, like, can I present to them like anything? can I have permission to these things in order to do this thing you asked me to do? Yes or no. And then for the administrators of all of these systems, you know, like, hey, is it OK for all of this to be happening?

[11:36](https://realalpha.app/v/jBGo33Jkids/?t=696) And so like there's All of that's going to be like relatively straightforward to do, like not easy, but like relatively straightforward to do on top of MCP. And like the important thing is like, let's do it in an open way. Like we don't need it to be proprietary to like our agents or our systems. Like we've just got to figure out how to get this dime where... things kind of work like the web works.

[12:01](https://realalpha.app/v/jBGo33Jkids/?t=721) Yeah. Well, it's an interesting question for me because I feel like there's maybe two potential models or potential go-to-markets for AI stuff that you guys have been talking about. One is this sort of like verticalized model where you own the model and you own the UI layer. You do all the applications and everything in between. Yeah. The thing about that model, which maybe it's sort of you could say that the App Store or Apple iPhone model is a good example of that, is you can guarantee security in a lot of ways.

[12:30](https://realalpha.app/v/jBGo33Jkids/?t=750) And an open model, it's harder to do security stuff, but you get much more like innovation, basically, because there's no central authority. So how did you guys think about making that decision? Yeah. So, look, I know that that's the argument that a lot of people make. I think it might be a false dichotomy. There is, you know, like a thing that you have in these open systems where they are permissionless.

[13:01](https://realalpha.app/v/jBGo33Jkids/?t=781) And like there's a real advantage in having permissionless innovation. So like the thing that... as an individual that excites me most about what's happening right now is the extent to which you can go innovate and build things without having to seek someone's permission, like where you have to have them grant you permission for distributing your things to other people. And, you know, like having all of these like complicated gatekeeping things that are sitting in between you who are the person who had the idea and like the people who might benefit from it.

[13:34](https://realalpha.app/v/jBGo33Jkids/?t=814) Like I think some of these like middle layers that we have that have emerged over the past handful of years, like just aren't contributing much value, honestly, to the two parties in the transaction that matter, which is the person who did the hard work to make a thing and then the people who are going to either spend their attention or their money or some other currency that's valuable to, like, access the thing.

[13:55](https://realalpha.app/v/jBGo33Jkids/?t=835) Yeah. So, like, I get kind of excited about that. And so, like, that's one of the reasons why we've made the decisions that we want to. But, like, I also think that there are ways that you can get real robust security in these systems, like leveraging some of the AI capability that you have now. That, you know, where you may be able to have better security. Like, if you have an agent that you... are running that is attending to your personal security requirements.

[14:28](https://realalpha.app/v/jBGo33Jkids/?t=868) Like these are things I'm willing to share. These are things I'm not willing to share. Like, you know, and it has some kind of knowledge of risk assessments. And like, yeah, like for instance, like my wife this morning while I was, uh, While I was getting ready to jump on stage, like I got this flurry of emails that because I'm the like backup security account for my wife where like somebody was like fiddling around with two factor authentication on her account.

[14:57](https://realalpha.app/v/jBGo33Jkids/?t=897) And like the first thing I did was I. texted her like I didn't want to email her because somebody might have gained unauthorized access to her email account I texted her I was like hey are you screwing around with the configuration and she's like yes and so like you could imagine like having an agent that is like privy to like a whole bunch of your communication modalities like being able to like notice that something funky is going on and then like you know using a bunch of resources to triangulate like whether that's So, like, I think there's just a bunch of stuff like that that, like, you can have both, right?

[15:34](https://realalpha.app/v/jBGo33Jkids/?t=934) Like, I don't think it needs to be, like, you know, one or the other as you framed it. Yeah, that makes sense.