Software Engineer — Agent Auth Platform

Issuer systems — building signed grant issuance, JWKS publishing, key rotation, and verifier-facing trust primitives

Approval infrastructure — designing device, backchannel, host-mediated, and service-mediated approval flows that preserve both user experience and security guarantees

Runtime and operator controls — building the surfaces for runtime registration, operator trust, default budgets, delegated execution, and admin review

Capability policy — defining least-privilege grants, constraints, bounded-use authorization, principal-on-grant semantics, and revocation behavior

Verification model — shaping offline verification, request signing, replay protection, cache behavior, and the practical tradeoffs between verification and revocation

Control plane and org policy — building tenant-level trust configuration, approval policy, auditability, runtime management, and enterprise admin controls

Adoption bridge — building the platform that lets agents securely access real services before native agent auth support exists, while creating a clean path toward first-class protocol adoption

New primitives in code — implementing issuer, verifier, SDK, and IDP primitives from scratch across the Better Auth plugin, client SDK, and platform surfaces

Experience level — 7+ years building production systems in security-sensitive or protocol-heavy domains

Security-sensitive systems — strong experience building systems where correctness, trust, and misuse resistance matter

Protocol judgment — the ability to reason about hard tensions like offline verification versus revocation, delegation versus misuse resistance, approval UX versus security guarantees, and issuer/runtime/service boundaries

Token and key systems — hands-on experience with signed token formats, key lifecycle, and binding tokens to specific requests in real systems