Authorization as AI Security
Alignment shapes what a model tries to do, while authorization controls what it can do. Secure, reliable agents need both. We're sharing what we're learning from building access control for AI systems in production: how permissions keep agents on task and within bounds, what works, what doesn't, and the practices we recommend.
AI Security in Practice
Analysis written as the AI ecosystem takes shape: what real MCP breaches teach, where agent protocols leave authorization unanswered, why policy engines strain under agentic workloads, and the infrastructure we build to close the gap.
A Timeline of Model Context Protocol (MCP) Security Breaches
A running timeline of real security incidents in MCP servers, the patterns they share, and what they say about securing agent access to tools and data.
MCP is Not Secure
An opinion piece on where the MCP specification stops and the implementer's responsibility for authorization begins.
Agentic AI is not Secure
An analysis of MCP, A2A, and ACP that shows where each falls short on authorization: token granularity, revocation, and delegation chains.
Policy Engines for AI Agents
A recorded talk, with transcript, on why policy engines struggle with relationship-heavy agent workloads and where relationship-based access control fits better.
Prevent AI Agents from Accessing Unauthorized Data
A short recap from the Secure Minds Summit, with a demo of permission-aware AI agents that only reach the data they are authorized to use.
AI Authorization: The Infrastructure Your AI Systems Need
How AuthZed applies fine-grained authorization to RAG pipelines and AI agents.
RAG Authorization: Interactive Demo
A five-step walkthrough showing how retrieval-augmented generation leaks data without authorization, and how SpiceDB prevents it.