How Apache DataFusion Runs SQL In-Process
Apache DataFusion is an embeddable query engine: SQL goes in, runs as columnar Arrow batches inside your own process, and results come out without a separate service.
Loading visual explainer…
Authorization Is a Runtime Decision
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Explanation
Authorization decides whether a known principal may perform a specific action on a specific resource; authentication only establishes identity. This explainer follows an agent request from agent, user, and organization context through a policy decision, short-lived or user-scoped credentials, tool execution, and audit logging. It also shows where consent, tenant boundaries, read-only limits, human review, and revocation fit into the runtime path.
FAQ
Why is an agent’s identity alone not enough to authorize a tool call?
The gateway example evaluates agent, user, and organization context together because customer-facing agents may act across delegated accounts and tenant boundaries. A recognized identity still needs a runtime decision about the requested tool action and scope.
Where should credentials and permissions be limited in an agent workflow?
Use short-lived agent-only tokens or user-scoped credentials rather than treating the agent as permanently privileged. The supplied examples also describe delegated OAuth access with read-only enforcement, token lifetimes, and revocation.
What should happen when an action needs more than an automated policy decision?
A policy check can route sensitive cases to a durable human pause instead of automatic approval. The fraud-review example records recommendations, human verdicts, audit events, and mandate receipts so the decision remains traceable.
The posts behind it
Related reading
More like this
More how it works explainers
How MaaS Governance Wraps a Model Endpoint on AKS
A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.
How Caddy Serves a Static Site: The Request Flow
See how Caddy handles a request for a static site, from DNS resolution through container routing to file_server, and how TLS and redirects fit into the flow.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.