Jeremy Frenay is an AI engineer at Lenses.io developing secure ways for AI agents to operate Apache Kafka infrastructure. His work on Lenses MCP Server makes access to real-time enterprise data attributable to individual users, restricted by explicit permissions, and auditable.
Frenay began leading data-operations work at Babylon Health in late 2017, building Kafka infrastructure, automation, and engineering tools for cloud-native data pipelines. He became an engineering manager focused on opening healthcare data platforms to developers while protecting sensitive information. By 2019, he was working with Lenses on DataOps and GitOps practices; his subsequent work included Kubernetes-native streaming applications.
At Lenses, Frenay applied that operational background to agents working with Kafka topics, schemas, connectors, consumer groups, and datasets. His guide to securing agent-operated streaming applications describes production workflows for payment pipelines, consumer failures, and compliance audits, with each agent action tied to an identifiable engineer.
His approach to production-ready agents
- Replace shared credentials with accountable authorization. Frenay favors OAuth 2.1 with short-lived, scoped tokens, user consent, PKCE, and token exchange. This limits the risks of persistent API keys, shared credentials, and upstream services receiving tokens intended for other systems.
- Verify the client, not only the user. Client ID Metadata Documents establish client identity through metadata hosted at a controlled HTTPS address, reducing duplicate registrations, misleading identity claims, and unsafe redirect destinations.
- Govern each operation independently. Tool-level access control, sensitive-data masking, audit logs, and end-to-end tracing determine what an agent can do and reconstruct its actions when incidents or compliance questions arise.
- Teach agents real operational practice. Frenay contributed to open-source Kafka skills for coding agents, addressing consumer lag, topic audits, schema and security reviews, connectors, and dead-letter queues.
His public writing on agent authorization centers on a practical production question: who granted an agent access, to which operations, and for how long?
