Authentication was the part the industry solved. Agents break everything downstream of it — what the caller intends, how far its credential reaches, and how much it can destroy before anyone notices.
Read the written version, with its diagrams and tables: https://bradshaw.cloud/writing/api-security-when-the-caller-is-an-ai-agent/
Personal views, not those of my employer.