Loading…
Topic
4 posts about Authorization. Every summary links to the original.
See the idea
Binary Authorization blocks container images that lack the attestations a cluster policy requires. This comparison sets a strict blocking posture beside an audit-only one, and shows how to choose between them.
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Databricks Apps now generally supports on-behalf-of-user (OBO) authorization, enabling apps to act using the signed-in user’s identity so Unity Catalog enforces existing data permissions including row filters and column masks. Developers choose between app authorization for app-owned operations and user authorization for user-specific data access, with API scopes such as sql:restricted-query limiting what the app can do on the user’s behalf. The forwarded user access token is short-lived and per-request, passed via the x-forwarded-access-token HTTP header to the SQL connector, and the app must never store it. Workspace administrators can set an allowlist of API scopes, providing two levels of control: the app declares minimum scopes and the workspace defines the maximum, with account administrators able to add scopes outside the allowlist. The post recommends keeping app-owned and user-authorized clients separate in code and failing closed when a user token is missing to avoid returning results with incorrect permissions.
The Confused Deputy problem, first documented in 1988, describes a program with legitimate authority being tricked into misusing that authority on behalf of a less-privileged actor. AI agents are particularly vulnerable because they process instructions and untrusted content through the same natural-language channel, making prompt injection straightforward. The post traces this pattern through CSRF, SSRF, and recent attacks like Clinejection, where an issue-triage bot executed an attacker-supplied command from a crafted issue title. That attack led to a poisoned GitHub Actions cache and a compromised npm package downloaded 4,000 times. The fix involves task-scoped short-lived credentials, capability-scoped permissions, credential isolation from the model, and human-in-the-loop approval for high-risk actions.
Auth0 Agent Gateway is announced in beta as a Customer Identity and Access Management (CIAM) control plane for governing product-native, customer-facing AI agents in multi-tenant SaaS applications. It addresses a trust model involving organizations, delegated user access, customer consent, independently owned connected accounts, and cross-tenant data boundaries, rather than workforce-only identity. Positioned between an agent and its tools, the gateway evaluates each call using agent, user, and organization context; it uses Organizations, Agents as Principals, Token Vault, token exchange, tenant logs, and administrative controls. The described capabilities include short-lived agent-only tokens, user-scoped credentials, runtime tool authorization, audit logging with optional SIEM streaming, and an agent kill switch. Auth0 is seeking product and engineering teams to join the beta.
Modal announced Role-Based Access Control for Team and Enterprise users, enabling teams to grant agents and humans precise workspace access within Environments. Environments are workspace subdivisions with dedicated storage, apps, and limits, commonly set as dev-staging-production or per-developer. These now act as enforceable security boundaries through Restricted Environments, where workspace members are read-only by default and only explicitly assigned users or service users can deploy or manage resources. The RBAC system distinguishes human developers, AI agents, CI deployers, and external callers with recommended identities and environment access patterns, such as service users for agents and proxy auth tokens for external callers. Built on a new permissions architecture running for months, RBAC ties into Audit Logs and is the first of planned tools; future additions include spending limits and programmatic permissions.
The best engineering reads, once a week.
