FusionAuth’s CTO on the 3 Critical Areas of AI-Ready Authentication

Key Takeaways

• Authentication must treat AI agents like any other client, using standards-based protocols such as OAuth to ensure compatibility and security.
• Local-first and self-hosted authentication models offer control over performance, troubleshooting, and data privacy, especially in dev and test environments.
• Executives should monitor key metrics across three areas: user experience, system scalability, and security.

As AI becomes part of how companies build, test, and scale their software, it’s raising a new question: is your authentication strategy ready?

Brian Pontarelli, Founder and CTO of FusionAuth, has been thinking about this long before AI agents and machine-to-machine interactions hit the mainstream.

His company helps teams handle everything from login and registration to user management, whether for humans or machines. And lately, he’s seeing a shift in what businesses need from their identity stack.

In this conversation, Pontarelli breaks down the three areas every executive should be watching right now, adding what he believes is at stake if companies don’t modernize fast.

Who is Brian Pontarelli?

Brian Pontarelli is the Founder and current CTO of FusionAuth, a platform focused on login, registration, and user management solutions. He began his career as a software engineer at companies like BEA and Orbitz. Today, he leads FusionAuth’s growth while continuing to support customers and contribute to the technical side of the product.

#1: Performance Is Still King

For companies using applications that require authentication, the user experience around login and registration has a direct impact on growth.

That’s always been the case, but with an increase in AI-driven programs, both humans and machines have become potential ‘clients’, and monitoring auth performance is even more critical.

Pontarelli advises executives to focus on core UX metrics:

“Authentication success rates, authentication latency and response times, login and registration drop-off rates, self-service adoption rates, and average time to provision or deprovision users.”

Even in AI agent scenarios, speed and success rates matter.

Agents are just another type of client, and any delay, failure, or error in the auth handshake can break downstream functionality.

“The core requirement remains the same: granting access to protected resources and ensuring protection over private systems and data,” he explains.

#2: Scalability Demands a Local-First Approach

While many companies default to cloud-only authentication models, Pontarelli argues that local-first or hybrid setups offer more control, especially for development and testing.

“Moving beyond cloud-only authentication actually provides significant benefits.

“Companies can ensure homogeneity across development, production, and staging environments while having direct access to logs needed for troubleshooting,” he says.

This shift also protects against rate limiting and external API failures during test cycles.

When AI systems depend on consistent, real-time access to services, a locally hosted or embedded auth layer can become a key differentiator.

He points to Viam, an IoT platform, as a real-world example:

“By moving to a dedicated authentication architecture, they were able to define stricter security policies, meet compliance needs, and better isolate customer environments.”

#3: Security to Both Humans and AI

As AI systems multiply, security is no longer just about humans logging in, it’s about machines interacting securely and predictably.

According to Pontarelli, the most common mistake companies make is relying on outdated or non-standard authentication protocols.

“With less standard protocols, which are very common in homegrown authentication, you’ll run into the side-cases where AI hasn’t been trained, or there is less information on how to make it interoperate.”

Pontarelli stresses the importance of aligning with established standards like OAuth and ensuring strong documentation.

“Most importantly, focus on documentation and making authentication easy for large language models to understand and implement.”

Security KPIs executives should monitor are:

• Multi-factor authentication (MFA) adoption rates
• Privileged account activity and review frequency
• Authorization failure rates
• Mean time to detect and respond to identity-related incidents

As AI systems gain broader access to sensitive data, these indicators will become even more critical for maintaining trust, compliance, and control.

Final Thoughts: Treat Auth Strategically

The rise of AI agents isn’t changing what authentication is, but it’s absolutely changing how critical it is.

“If you plan on developing with AI or incorporating it, now is the time to get your authentication up to the most recent standards,” he says.

Companies still using fragmented or DIY authentication systems risk bottlenecking their AI plans.

Authentication used to be a backend detail according to Pontarelli.

Now, it’s becoming a “front-line piece of your AI and automation strategy.”