https://blog.christianposta.com/Christian Posta's blog on Istio, Envoy, API gateways, MCP, and the infrastructure that runs production AI agents. 2026-07-15T22:59:41+00:00 Christian Posta https://blog.christianposta.com/ Jekyll © 2026 Christian Posta /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-07-13T01:05:21+00:00 2026-07-15T22:59:25+00:00 https://blog.christianposta.com/okta-saml-and-keycloak-for-id-jag-cross-app-access/ Christian Posta

A working Okta SAML/SSO → ID-JAG → Keycloak access-token path for Cross-App Access

2026-06-16T02:35:18+00:00 2026-06-23T01:10:02+00:00 https://blog.christianposta.com/what-is-agent-identity/ Christian Posta

In previous posts, I’ve covered the reasons why an AI agent needs an identity. I recommend reading that first. In this post I want to nail down “what is agent identity” because I’ve seen a lot of different interpretations from smart people such as “use OAuth” to “it’s just workload identity”, and new protocols cropping up, etc. But what “is” an agent identity in concrete terms? An AI agent is ...

2026-06-15T22:40:22+00:00 2026-06-15T23:23:46+00:00 https://blog.christianposta.com/difference-between-microservices-and-ai-agents/ Christian Posta

Microservices and AI agents are not the same thing. And just because you introduce an LLM doesn’t make a microservice an AI agent. Not realizing this will lead to catastrophic security and infrastructure mistakes. We have become accustomed to building service style architectures over the past 15+ years. Actually, probably much longer. This diagram probably resonates quite strongly with modern a...

2026-05-04T18:38:15+00:00 2026-05-04T18:38:15+00:00 https://blog.christianposta.com/avoiding-mcp-confused-deputy-with-aauth/ Christian Posta

MCP’s Authorization Spec builds heavily around OAuth 2.1 authorization code grant, but the more dynamic AI agent and MCP systems get, the more we need something that is built to live in this new world. Agent Auth (AAuth) is a protocol built for the needs of modern AI agentic applications: agent identity across services / trust domains dynamic agent registration agent discover permission...

2026-03-04T01:48:35+00:00 2026-03-04T01:48:35+00:00 https://blog.christianposta.com/inbound-auth-for-agentcore-with-agentgateway/ Christian Posta

The best thing about being on the frontline of large enterprises adopting AI agents and MCP tools at scale is we get to see real, practical challenges. AWS Agentcore is a popular platform for deploying custom-built AI agents, but one question crops up frequently: how do callers authenticate to my agent, and how does the agent know who is calling? Getting both right ie, strong caller authenticat...