DM
Dan Moore

Dan Moore

Things Dan Says on Podcasts

Where to Find Them

Dan Moore writes Maintainable . They have also been a guest on Scaling DevTools (3 times) , Real Python Podcast (2 times) , The Changelog (2 times) , The Agile Brand with Greg Kihlström®: Expert Mode Marketing Technology, AI, & CX , The Stack Overflow Podcast , Software Engineering Radio - the podcast for professional software developers and Down the Security Rabbithole Podcast (DtSR) .

Recently: “Oh, your agents need OAuth2, too” on The Stack Overflow Podcast (November 2026); “Acquiring a startup: what to do AFTER the deal closes - with Dan Moore from FusionAuth” on Scaling DevTools (June 2026); “Over the top auth strategies (Friends)” on The Changelog (January 2025); “Dan Moore: Building Developer-Friendly Authentication Solutions” on Maintainable (December 2024); “Dan Moore: Building Developer-Friendly Authentication Solutions” on Maintainable (December 2024); “Startups don't need DevRel. A debate.” on Scaling DevTools (March 2024).

What They Said

“Why do we accept a 400-line or 4,000-line PR from AI when we wouldn't from our coworkers? Why wouldn't we go back to the AI and say, you need to break this down into ten smaller things that I can actually review and understand? Part of us learning to adjust to this new tool is building cultural norms that say, just because the AI wrote it doesn't mean you have to accept it as is.” — Dan Moore, The Stack Overflow Podcast

The host had just described 'zombie code review', where reviewers wave through huge AI-generated pull requests. Dan relays a question a colleague put to him the night before.

The Stack Overflow Podcast · 2026-11-03 Permalink → Listen →
The Stack Overflow Podcast Around 17:58 into the episode
Dan Moore

Yeah. LGM TM. Do they say that or do they just let it linger? Oh,

Ryan Donovan

they just kick it through. Yeah. There's the old saw: if you want a detailed code review, push 10 lines. If you wanted to prove to me, push 100. It's

Dan Moore

a bike-shedding problem. I mean, actually, I had a conversation last night with someone, and she was saying, Why do we accept that? Like, why do we accept a 400-line or 4,000-line PR from AI when we wouldn't from our coworkers? Why wouldn't we go back to the AI and say, actually, you need to break this down into like 10 smaller things that I can actually review and understand? And I think that is part of us learning to adjust to this new tool is for us to build cultural norms that say, actually, just because the AI wrote it doesn't mean you have to kind of accept it as is. You can push back the same way you would with a colleague.

Ryan Donovan

Yeah. GitHub actually had a feature roll out recently that is breaking up commits into smaller pieces.

Dan Moore

Does that do it kind of automatically or is it more like a UI? I'm

Ryan Donovan

not sure. Okay. Right by the headline. Stack

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.
“We have a couple of principles around AI agents. One is the agent needs its own identity, because if it's riding along with your identity, it's really hard to audit and really hard to differentiate. The people who let agents drive their browsers terrify me. And another is that the bounds around the agent need to be deterministic software. It's not enough to say, hey, Claude, don't break anything or be good. Because they will try to do whatever they can to accomplish their goal. That's what we've seen.” — Dan Moore, The Stack Overflow Podcast

Asked whether agents should log in directly and whether their access can be limited, Dan Moore of FusionAuth gives his two rules for agent security.

The Stack Overflow Podcast · 2026-11-03 Permalink → Listen →
The Stack Overflow Podcast Around 04:56 into the episode
Dan Moore

Anything it's allowed to, yes. Yeah, yes.

Ryan Donovan

Yeah, I mean, my next question was: should you let it log in directly? But it sounds like there are ways to really bound what the agent is allowed to do with that account.

Dan Moore

Yeah. You know, we kind of have a couple of different principles around AI agents at FusionOff. And one is the agent needs its own identity. And because if it's riding along with your identity, like, then it's really hard to audit. It's really hard to differentiate. The people who let agents drive their browsers terrify me. And another is that the bounds around the agent need to be deterministic software. It's not like enough to say, hey, Claude, don't break anything or be good. Because they will try to do whatever they can to accomplish their goal. That's what we've seen. And so you need to have bounds around that.

Ryan Donovan

I remember when OpenCloud was first released, people were buying new computers for it. I'm sure for that very reason because it's just this YOLO software. It's just like running wild. Totally.

Dan Moore

I think that's fine for experimentation. There's actually one of the people that I follow in the identity space has an agent that's running OpenCloud, I believe, called Claudery Hepburn. And she's given it all its own accounts. And if it gets a credit card, it has limited spend. And that's the kind…

Ryan Donovan

They're limiting. Yeah. I've seen some solutions where it's very, very tightly controlled. The usage like time boxed or single use or something. You think about things like that?

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

Collections They Appear In

Hands-On Engineering Podcasts Software Engineering & Infra