Why should you care?

Unauthenticated /api/ai routes become free LLM proxies and PHI leaks; enterprise buyers require SSO integration.

See it live — copy this example

Paste into an ASP.NET Core 8+ / AgentNest project, then run with dotnet run (set your API keys in user-secrets).

// Program.cs
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer();
builder.Services.AddAuthorization(o =>
    o.AddPolicy("AiUser", p => p.RequireClaim("scope", "agentnest.ai")));

app.MapPost("/api/ai/complete", [Authorize(Policy = "AiUser")] async (...) => { /* ... */ });

What happened?

• JWT bearer auth plus AiUser policy checks the agentnest.ai scope.
• Only authenticated CRM users reach copilot endpoints.

Practice next

1. Register Entra ID or Auth0 JWT bearer in Program.cs.
2. Add scope agentnest.ai to access tokens for AI routes.
3. Apply [Authorize(Policy = "AiUser")] on AI controllers.
4. Add step-up MFA policy for hospital write agents.
5. Validate token audience matches AgentNest API identifier.

Remember

Protect AgentNest AI routes with JWT and scoped policies. Never expose provider API keys to front-end code. Auth user identity separately from tenant data access.

SSO for CRM copilot

Customer IT requires Entra ID groups to gate AI features.

Outcome: AiUser policy maps Entra groups to copilot access without separate passwords.