6
The Middleware Layer: Dapr and the Multi-Tenant OAuth Nightmare 17:28 Lena: So, Miles, let’s get tactical. If someone is listening and they want to build this *today*, they’re going to run into the "Multi-Tenant OAuth Nightmare." I mean, if I have fifty customers, each with their own Salesforce account, how does an agent manage all those different tokens without getting confused?
17:47 Miles: This is where a proxy layer is your best friend. You should never, ever let the LLM see an OAuth token. Instead, you use a system like Dapr or a specialized integration proxy. The agent just says, "Fetch the contacts for Customer A." The proxy layer intercepts that request, looks up Customer A’s encrypted credentials, checks the token expiry, and—this is the key—proactively refreshes the token if it’s about to expire.
18:14 Lena: So the agent never sees a "401 Unauthorized" error?
0:40 Miles: Exactly. Because if the agent sees a 401, it might try to "hallucinate" a fix. It might apologize to the user and stop, or worse, try to "guess" a new token. By handling the auth at the proxy level, the agent just sees a slightly longer response time while the token refreshes. It’s transparent.
18:33 Lena: And that same proxy layer can handle rate limits, too, right? Because an agent can move a lot faster than a human. It could easily fire off a hundred requests to HubSpot in a second and get immediately blocked.
18:45 Miles: Oh, absolutely. The proxy layer sees the "429 Too Many Requests" from the vendor API and implements "Exponential Backoff with Jitter." It pauses the request, waits a few seconds, and retries. Again, the agent just experiences this as "thinking time." It doesn't need to know the messy details of HubSpot’s rate-limiting headers.
19:04 Lena: It’s about "Normalization." We’re normalizing the chaos of the internet into a clean interface for the agent. I was reading about "Pagination Normalization," too. Some APIs use cursors, some use offsets, some use page numbers. If you give all that raw data to an LLM, it’s going to get the next page wrong half the time.
19:23 Miles: It’ll mangle the cursor string or try to decode a base64-encoded URL. The fix is to have the proxy layer translate everything into a standard `next_cursor` format. The agent just sees a simple "more data" flag and an opaque string. It passes that string back to the tool, and the proxy "un-translates" it for the specific API.
19:42 Lena: This is why I think the "Agentic SDKs" like the one from Claude are so interesting. They’re starting to package these tools—Bash, Edit, Read, WebSearch—directly into the library. You don't have to build the "Body" from scratch anymore.
19:58 Miles: It’s a huge time-saver. You can literally just "permit" the agent to use the Bash tool, and suddenly it can run git operations, scripts, or terminal commands. But you still need those guardrails we talked about. You need "Edit Approval Mode" where the agent can *propose* a file change, but a human has to hit "Accept" before it hits the disk.
20:17 Lena: And for teams that use a lot of different tools, there’s the Model Context Protocol, or MCP. It’s becoming the industry standard for how agents talk to external systems. Instead of writing a custom wrapper for every single API, you just point the agent at an MCP server for PostgreSQL, or Slack, or GitHub.
20:37 Miles: It’s like the "USB port" for AI. It solves that "M-by-N" problem where you have M models and N tools. Without MCP, you’d need a custom integration for every combination. With MCP, you just build the tool once, and any model—Claude, GPT-4, Llama—can use it immediately.
20:55 Lena: It’s such a powerful shift. We’re building a "Universal Interface" for digital labor. If the agent can "ask" for any tool that supports MCP, then it really can "automate almost anything" just by discovering the right server.