authorization

A comprehensive guide explaining OAuth 2.0 concepts from the ground up, covering authorization code flow, tokens, PKCE, and more for backend developers.

The article outlines four essential boundaries (identity, intent, policy/execution, system-of-record) to ensure LLMs never have direct access to production systems, preventing irreversible actions. It emphasizes the need for multi-layered permission checks and human approval for risky operations.

OxDeAI is an open-source protocol for deterministic pre-execution authorization of AI agent actions, providing signed artifacts and guards to enforce policy outside the agent loop. It supports popular agent frameworks like LangGraph, CrewAI, and AutoGen, and is seeking critical feedback.

The author explains the differences between SSO, OAuth, OIDC, and SAML, clarifying that SSO is a user experience, OAuth is for authorization, OIDC provides identity on top of OAuth, and SAML is an older enterprise protocol.

Phoenix now acts as an OAuth2 authorization server, enabling `px auth login` for short-lived user-scoped tokens, admin audit/revoke, and a beta remote MCP server.

The article argues that in agent-to-agent communication, authentication alone is insufficient for authorization; instead, structured, inspectable claims about intent, identity, and authority are needed, with the human remaining the final authority.

Explores the challenge of where to implement authorization when an AI agent can call multiple tools, discussing architectural considerations for secure access control.

The team released an open-source authorization gate to prevent AI agents from behaving unexpectedly or maliciously.

Discusses the fundamental difference in authorization between traditional automation tools like Zapier (design-time approval) and AI agents (call-time approval), arguing that accountability issues stem from the timing of authorization rather than org charts.

This article discusses how A2A (agent-to-agent) protocol solves communication between agents but leaves unresolved the issue of authorization — what a stranger agent is allowed to do.

A developer seeks advice on how to control and bound AI agents' actions in production environments, particularly when they interact with real systems like databases and customer data, asking about current practices and whether this is a known headache.

A developer describes encountering authentication and authorization gaps when one AI agent calls a third-party vendor's agent, highlighting failure modes like scope escalation, unverified chains, and confused deputy attacks. They ask the community how to handle cross-org agent call verification.

Discusses the security gap in AI agent workflows where agents assume human oversight at critical steps, and proposes a runtime control plane that enforces permissions and requires human approval for destructive actions, demonstrated with a Tandem demo.

Karpathy's point about keeping AI on a leash still holds even as models improve, because permissions and authorization are separate from correctness. The article demonstrates how AI-generated apps lack identity and audit, and how Retool's platform solves this by providing a governed runtime.

This article discusses how AI agent demos often succeed while production deployment reveals critical security and authorization issues, emphasizing that model quality does not solve problems like access control, data leaks, and auditability.

Explores the challenge of enforcing authorization when AI agents take real-world actions, questioning where security controls should be placed.

The Enterprise-Managed Authorization extension for MCP is now stable, allowing organizations to centrally manage authorization for MCP servers and enabling zero-touch OAuth for end-users. Adopted by Anthropic, Microsoft, and Okta.

AI coding agents like Claude Code can be dangerous because they generate code without considering authorization and operational safety, potentially leading to unauthorized writes like deleting production databases. The real risk is not the code quality but the lack of runtime access controls.

This paper proposes Risk-Aware Causal Gating (RACG), a training-free mechanism that applies the principle of least privilege to LLM agent tool exposure, reducing attack surface from prompt injection by only exposing high-risk tools when authorized and causally necessary.

Ory Talos is an open-source API key server written in Go for issuing, verifying, and managing API keys at scale, with low-latency verification and support for JWT and macaroon tokens.