Identity & Access
Identity for non-human agents — cryptographic identity, OAuth/OIDC, capability-based security, token theft and zero-trust enforcement.
Cryptographic Identity for AI Agents: Issuing Verifiable Identity with mTLS, JWT, and SPIFFE/SPIRE
How to give non-human AI agents verifiable cryptographic identity using mTLS, JWT, and SPIFFE/SPIRE — why static API keys fail and how to issue short-lived workload identity.
Read →Capability-Based Security for Agent Tools: Enforcing Least Privilege with Scoped, Per-Tool Tokens and Object Capabilities
How capability-based security, object capabilities, and scoped per-tool tokens let you enforce least privilege for AI agents, so a compromised tool cannot reach what it was never handed.
Read →Delegation Chains and the Confused Deputy in Agent Identity: Safe Impersonation, Token Exchange, and Audit Trails
How AI agents pass authority safely down a delegation chain, why the confused deputy bites, and how token exchange (RFC 8693) keeps audit trails intact.
Read →OAuth 2.1 and OIDC for AI Agents: Client Credentials, Token Rotation, and Tight Scopes
How to authenticate AI agents with OAuth 2.1 and OIDC: when to use the client-credentials flow, how token rotation limits blast radius, and how to design scopes that stay tight.
Read →Token Theft and Replay Attacks Against AI Agents: How Agent Credentials Leak and How to Contain the Blast Radius
How AI agent credentials leak, why stolen tokens replay past MFA, and how token binding plus short-lived tokens shrink the blast radius of token theft.
Read →Zero-Trust for AI Agents: the Trust Assumptions Attackers Exploit — and the Enforcement That Stops Them
Why implicit trust between AI agents is an attack path: how adversaries abuse agent-to-agent trust and delegated identity, and how continuous verification, a policy decision point and mTLS shut it down.
Read →