Production Ready AI Agents
Sam Partee, CTO of Arcade, explains the critical gap between AI agents that gather context and those that take secure, real-world actions. He introduces Arcade as a middleware platform that solves complex challenges like user authorization, fine-grained permissions, and token management, enabling developers to build scalable, enterprise-ready agents.
The Evolution from Context-Gathering to Action-Taking Agents
The AI agent ecosystem has rapidly evolved, moving from simple prompt management in frameworks like LangChain to more sophisticated function-calling APIs and structured outputs (e.g., JSON mode). This progression enabled agents to interact with external tools. A key development in this area is the Model Context Protocol (MCP), a standard designed for agents to call external resources.
However, there is a fundamental limitation in how these tools have been implemented. Most early tools focused on context gathering—actions like performing a Google search or querying a vector database to retrieve text. These tools don’t mutate or change the state of external systems. The initial MCP specification was primarily about getting context to and from a model, not about taking meaningful, state-changing actions on a user’s behalf.
Core Challenges in Building Action-Oriented Agents
Building agents that can securely and reliably take real-world actions (e.g., sending an email, creating a GitHub issue, modifying a Salesforce record) introduces significant challenges that go beyond simple context retrieval.
1. User Authorization and Security
The most critical hurdle is securely managing user credentials. For an agent to act on behalf of a user, it needs that user’s token for the target service (e.g., Google, GitHub). The central problem is how to get this token from the client (like a browser) all the way to the tool’s execution environment without compromising security.
A common but dangerous anti-pattern is passing tokens directly through the model’s context. This practice is highly insecure, as anyone with access to the context could potentially steal and refresh the token to impersonate the user.
2. Fine-Grained, Least-Scoped Permissions
Enterprises require strict security controls. An agent should never be granted overly broad permissions. If a tool’s purpose is to read emails, it should only have read privileges, not the ability to compose or delete.
“An enterprise won’t deploy your product if you accidentally give it elevated privileges. Some CISO is just going to go ’nope,’ right? They’re going to walk you out of the door.”
Achieving this “least-scoped privilege” requires a system that can request, manage, and apply permissions that are finely grained to the specific action the agent needs to perform at that exact moment.
3. Scalability and Runtime Separation
Tying tool execution to the client application’s compute environment creates a scalability bottleneck. If a tool is computationally expensive, you are forced to scale the entire client application where the agent resides. This is inefficient and often not the optimal architectural decision. Many developers resort to browser-based tools simply because the agent is already in that environment, not because it’s the best choice.
Arcade: A Middleware for Secure Tool Execution
Arcade is designed as a middleware layer that sits between your agent and external services to solve these challenges. It abstracts away the complex, “boring” legwork of security, authorization, and token management, allowing developers to focus on building powerful tools and agents.
Declarative Security via Tool Decoration
The core concept in Arcade is decorating standard Python functions with the necessary metadata for security and execution. Instead of manually handling OAuth flows or secret management, a developer simply decorates their tool to declare its requirements.
At runtime, the Arcade middleware intercepts the tool call and handles everything:
- OAuth Flow: It manages the entire OAuth 2.0 process, prompting the user to log in if necessary.
- Token Management: It securely stores, manages, and refreshes user tokens, ensuring the tool always has a valid, short-lived token when it executes.
- Scoped Permissions: It ensures the token requested from the user has only the permissions specified in the decorator, enforcing the principle of least privilege.
- Secret Injection: For tools that need API keys or database URLs, Arcade can securely inject these secrets at runtime. These secrets can be scoped at various levels (project, tenant, user), ensuring the right credentials are delivered to the right context.
This makes the entire process seamless for both the tool developer, who only needs to write the core logic, and the agent developer, who can simply use the tool without worrying about the underlying security plumbing.
Best Practices and Developer Experience
Arcade encourages and simplifies the adoption of security best practices:
- Use Specific Scopes: Always define the most restrictive OAuth scope necessary for the action (e.g., a
readscope for reading data, not a genericuserscope). - Never Log Tokens: With Arcade, tokens are managed in the middleware and never need to be logged or passed through insecure channels.
- Correlate Users to Actions: It’s crucial to be able to trace which user performed which action, and Arcade facilitates this correlation.
The developer workflow is streamlined: write a single Python function, run the arkade CLI command, and the tool is ready to be used in any MCP-compatible client, such as Claude or Cursor, with full OAuth support.
The MCP Gateway
For organizations with a growing number of tools, Arcade offers the MCP Gateway. This allows companies to take dozens or hundreds of individual MCP servers and consolidate them under a single, unified, and manageable HTTPS URL. All tools behind the gateway benefit from the same robust project, tenant, and user-level security and secret management provided by the Arcade middleware.