Mode 3 from part 2 takes standing decrypt away from the token vault with KMS grants. The grant quota caps the whole system at 50 exchanges a second, and the attacker who actually shows up doesn't need to decrypt the store anyway. Here's the variant that scales, and the component that makes what leaks worth less.

In my work with customers adopting and securing AI agents at scale in enterprise environments, we are running into “human in the loop” usecases. For example, usecases where a sensitive operation MU...

APIs designed for AI agents need to enforce resource-owned invariants or surface them into the enforcement path, not just expose operations guarded by caller-side authorization checks.

A credential broker fixes the agent's credential problem by concentrating credentials somewhere else. Here's how we keep that concentration from becoming a single point of total failure.

The safest credential for an AI agent is one it never holds. A look at the CB4A draft, why the proxy model is the one that actually works against today's bearer-token APIs, and how we build it in agentgateway.

A working Okta SAML/SSO → ID-JAG → Keycloak access-token path for Cross-App Access

In previous posts, I’ve covered the reasons why an AI agent needs an identity. I recommend reading that first. In this post I want to nail down “what is agent identity” because I’ve seen a lot of d...

Microservices and AI agents are not the same thing. And just because you introduce an LLM doesn’t make a microservice an AI agent. Not realizing this will lead to catastrophic security and infrastr...

MCP’s Authorization Spec builds heavily around OAuth 2.1 authorization code grant, but the more dynamic AI agent and MCP systems get, the more we need something that is built to live in this new wo...

The best thing about being on the frontline of large enterprises adopting AI agents and MCP tools at scale is we get to see real, practical challenges. AWS Agentcore is a popular platform for deplo...

Enterprise adoption of MCP still has problems. How do you govern its usage? Especially when developers are willy-nilly installing stdio MCP servers on their machines. » BTW « we should be restricti...

OAuth has evolved a lot since 2012 with many “lessons learned”. AAuth (Agent Auth) is an attempt to bring those lessons together for AI agents. AAuth is an exploratory spec from Dick Hardt (Author/...

If you’re building AI agents that need strong identity, proper authorization, and the ability to act on behalf of users, Microsoft’s Entra Agent ID capability is worth your attention. I’ve put toge...

MCP servers are cropping up all over the enterprise like weeds in a nice lawn. And just like weeds, this can cause problems. MCP servers should be secured, but how? The official spec says use OAuth...

As I work with enterprise users adopting AI agents, questions around authorization, impersonation, and delegation come up again and again. OAuth is already a delegation protocol, so where does it f...

Enterprises see the power in connecting their data and functionality directly to AI models but most are still treading lightly. The Model Context Protocol (MCP) has quickly emerged as the de facto ...

Do you use API keys to protect your enterprise APIs? If you work in a large enterprise organization, you probably do. This is a very common pattern. A developer can get access to an API for the app...

Prompt injection remains one of the biggest open security challenges for AI and LLM-powered systems in the enterprise. If you’ve been following my writing, you know I’ve explored how indirect injec...

Organizations are working out how best to introduce implementations of the model context protocol (MCP) for their AI agents. One of the mistakes they want to avoid is letting MCP implementations sp...

The more we dig into enterprise usecases around Agent to Agent (A2A) and Agent to MCP scenarios (MCP), the more questions pop up that I’m interested in discussing and sharing. In this post we’ll ta...