The Curious Engineer

All blogs / Security

Permit.io Blog

permit.io/blog

Read the Permit.io Blog for expert guides, step-by-step tutorials, best practices, and the latest news on everything Authorization, IAM, and Software Development

SecurityAI / ML

’24’25’26
Posts
288 from 24 Jul 2024 to 3 Nov 2026
Posting
weekly (83 in the last year)
Kind
company blog

2026 75

  1. Or WeisNov 03 2026The Alignment Problem in AI Agents: Why It Breaks After Login, and How to Enforce ItAn AI agent can be aligned with its task when you hand it a token and drifting two minutes later. Here is how the alignment problem shows up in real agent workflows, and how to enforce alignment at
  2. Ze'ev ManilovichNov 02 2026Auth0 FGA: Alternative Fine-Grained Authorization Options for 2026Auth0 FGA provides managed relationship-based authorization built on OpenFGA. A comparison with Permit.io covering policy languages, deployment models, and enterprise features.Read more
  3. Or WeisOct 30 2026OpenFGA Alternatives: Comparing Fine-Grained Authorization Options in 2026OpenFGA alternatives for fine-grained authorization including SpiceDB, Cerbos, OPA, Cedar, and Permit.io. A comparison of relationship-based and policy-based approaches to help you choose.Read more
  4. Ze'ev ManilovichOct 29 2026WorkOS FGA: Alternative Fine-Grained Authorization Options for 2026WorkOS FGA extends RBAC with hierarchical resource scoping. A comparison with Permit.io covering policy languages, deployment models, and when each fits your authorization requirements.Read more
  5. Or WeisOct 28 2026Four Pillars → APP 1.7 Homework ChecklistMap enforcement, granularity, realtime, and audit to APP 1.7 homework: inventory PEPs, PI→resource maps, revoke/sync, and audit/export for privacy-policy statements.Read more
  6. Or WeisOct 27 202610 December 2026: APP 1.7 and the Authorization Evidence Behind Automated DecisionsAPP 1.7-1.9 commence 10 December 2026. Honest ADM privacy-policy disclosure needs AuthZ inventory, PI→resource maps, PEPs, realtime revoke, and decision-log evidence, plus a soft APRA parallel.Read m
  7. Ze'ev ManilovichOct 22 2026EN 18286:2026 and AI Agents: What the EU's First AI Act Standard Means for AuthorizationEN 18286:2026 is Europe's first harmonised standard under the EU AI Act. It turns Article 17's QMS requirements into auditable processes. Here's what it means for teams shipping AI agen
  8. Or WeisOct 21 2026NIST NCCoE Four Focus Areas → AuthZ ControlsCheat-sheet: NIST NCCoE's four focus areas (identification, authorization, access delegation, and logging) mapped to concrete AuthZ controls. Soft alignment aid, not a certification checklist.Read more
  9. Or WeisOct 20 2026Treat AI Agents as Privileged IdentitiesTreat AI agents as privileged NHIs: distinct identity, least privilege, attributable delegation, and forensic decision logs, not shared keys. Map to NIST NCCoE's identification · authorization · delegation · logging.Read more
  10. Or WeisOct 15 2026Permit.io vs Cerbos: Managed Control Plane vs Self-Hosted PDPPermit.io and Cerbos can both run an open source policy decision point next to your app. A neutral comparison of managed control plane vs self-hosted PDP, with a table and when to choose each.Read more
  11. Ze'ev ManilovichOct 14 2026How to Migrate from Oso to Permit.ioA practical migration guide for teams moving from Oso Cloud to a supported authorization platform. Covers mapping Polar policy patterns to RBAC, ReBAC, and ABAC, step-by-step migration planning, and code examples.Read more
  12. Or WeisOct 14 2026What Audit Trail Do You Need for Human-to-Agent Delegation?For human-to-agent delegation, bind human principal, agent ID, tools, data, policy decision, and HITL, not just tool traces, into an attributable audit trail.Read more
  13. Or WeisOct 13 2026AI Agents Don't Lower the Security Bar. They Raise the Authorization Workload.AI agent authorization checks every agent action against policy, delegation, resource and context. Add per-action checks, trust ceilings and decision logs.Read more
  14. Or WeisOct 09 2026ISO 42001 Certification Guide: Audits, Annex A, EvidenceWhat ISO 42001 certification involves: the AI management system, accredited certification bodies, stage 1 and 2 audits, Annex A controls, and agent evidence.Read more
  15. EU AI Act Logging Requirements: Article 12 and ISO 42001 for AI Agents
  16. Real-Time Authorization Enforcement: Four Pillars for Production Applications
  17. What is Authorization as a Service?
  18. AI Agent Audit Logs and MCP Audit Log Schema: 12 Essential Fields
  19. AI Agent Audit Trail: Proving What an Agent Did and Why
  20. SOC 2 CC6 & ISO 27001 Access Control Checklist for AI Agents
  21. NewPermit Nexus PDP benchmarks: 5.6 ms P99 on RBAC checks, measured server-sideNexus PDP: 5.6 ms P99 RBAC checksSee the benchmarks
  22. PEP, PDP, and Decision Logs: The Architecture Behind “Prove It”
  23. DORA vs NIST Access Control: What Each Expects and How to Prove It
  24. Why Your AI Agent Doesn't Get User Permissions (Auth0, Okta) and How to Fix It
  25. Daniel BassSep 25 2026RBAC VS ABAC: Choosing the Right Authorization Policy ModelRBAC grants access by role; ABAC evaluates user, resource, and environment attributes. Compare them side by side, see examples, and learn how to migrate from RBAC to ABAC.Read more
  26. Authorization Models → Least-Privilege Evidence
  27. RBAC vs ABAC vs ReBAC: Pick a Stack, Not a Religion
  28. Authentication vs Authorization: 401 vs 403, Plus Examples
  29. Explainable Deny: Authorization Decision Evidence for SOC 2-Style Access Reviews
  30. Why Was This Allowed? Building an Explainable Authorization Audit Trail
  31. Stop Rebuilding Permissions in Application Code
  32. How to Govern AI Agents Operating Cloud and API Control Planes Through MCP
  33. Shared Agent Memory Is a Permissions Problem
  34. MCP Auth vs Tool-Call Authorization After the 2026-07-28 Spec
  35. Read-Only Is a Trust Level, Not a Feeling: How to Govern AI Ops Agents Before They Remediate Production
  36. Agent-Generated APIs Need Governance Before They Become Agent-Callable Tools
  37. Can AI Generate Authorization Policy Safely?
  38. MCP Auth Bypasses Show Why Tool Calls Need Runtime Authorization
  39. Payment Is Not Permission: How to Authorize Paid MCP Tool Calls
  40. MCP in ERP: Why Agentic Business Workflows Need Runtime Authorization
  41. MCP Server Supply Chain Is Runtime Supply Chain: Tool Manifests Need Policy and Evidence
  42. CVE-2026-49257: Why MCP Database Servers Need Fail-Closed Authorization
  43. Zero Standing Permissions for Coding and Automation Agents
  44. Agent Audit Logs Need a Causal Commit Log, Not Just Tool Traces
  45. When AI Subagents Call MCP Tools, Who Owns the Permission Decision?
  46. OpenAPI-to-MCP Turns Every API Into an Agent Tool. The Missing Piece Is Endpoint-Level Policy
  47. Tool-Call Safety Is Not Text Safety: Why Coding Agents Need Action-Time Authorization
  48. Zero Standing Permissions for AI Agents: Lessons from Hermes Blank Slate and Toolset Pinning
  49. Agent Identity Is Not Enough: From DIDs and AI Control Towers to Runtime Permissions
  50. Prompt Injection Is an Authority-Promotion Failure, Not Just a Bad Prompt
  51. A poisoned Linear ticket told our AI agent to leak the team. It tried three ways. None worked.
  52. When the AI Gateway Becomes the Blast Radius: Lessons from the LiteLLM MCP RCE Chain
  53. Coding Agent Sandboxes Don't Solve Credential Authorization
  54. Authentication vs. Authorization in MCP: What Atlassian Rovo Shows About OAuth, API Tokens, and Tool Calls
  55. Trust Levels for Coding Agents: How to Decide Which Commands and MCP Tools Can Run Automatically
  56. Agent Identity vs. Service Accounts: Why Scoped Tokens Still Need Runtime Authorization
  57. Claude Code MCP Token Theft Shows Why OAuth Tokens Need Runtime Tool-Call Authorization
  58. Agent Identity Is Becoming a Protocol Layer, but Tool Calls Still Need Runtime Authorization
  59. Agent Identity Is Not Agent Authorization: What Entra Agent ID Still Leaves to Runtime Policy
  60. What the NSA Agentic AI Advisory Actually Requires
  61. OPA for Protecting AI Agents and Agentic Stacks
  62. Zero Standing Privilege for AI Agents: A Practical Guide
  63. MCP OAuth 2.1: PKCE, Resource Metadata and Authorization
  64. Best Practices for AI Identity Governance
  65. Securing Coding Agents: What You Need to Know
  66. Agent Identity Security: Authentication, Authorization, and Trust in AI Systems
  67. Least Privilege in AI Agents and Agentic Identity
  68. RBAC vs ReBAC for AI Agents: Best Authorization Model for Secure Agentic Systems
  69. MCP Auth vs Agent Authorization: Why OAuth Alone Doesn’t Solve Agent Security
  70. MCP Proxy vs MCP Gateway: Routing vs Governance
  71. How Security Teams Review an MCP Gateway for SOC 2 + HIPAA
  72. The Six Layers Every MCP Gateway Must Enforce
  73. Announcing Permit MCP Gateway
  74. Securing AI Agents: Why Traditional Authorization Isn’t Enough
  75. RBAC vs ABAC (and ReBAC): Key Differences and How to Choose

2025 72

  1. MCP Authorization: Resource Metadata and Zero Standing Privilege
  2. What the OpenAI–Mixpanel Incident Really Reveals About Metadata Risk
  3. Why AI Agents Choose Permit.io for Authorization
  4. Top Open-Source Authorization Tools for Enterprises in 2026
  5. Fine-Grained Access Control for n8n Workflows
  6. Deploying On-Perm Fine-Grained Authorization Service
  7. Permit.io Introduces Database-Level Authorization with Trino Integration
  8. Exploring the x402 Protocol for Internet-Native Payments
  9. Learn ReBAC vs ABAC by example: with Permit.io and AWS Cedar
  10. ReBAC in Practice: Permit.io Vs OpenFGA
  11. The Ultimate Guide to MCP Auth: Identity, Consent, and Agent Security
  12. Why JWTs Can’t Handle AI Agent Access
  13. Human in the Loop AI Agents: Approval Workflows That Work
  14. Implementing Fine-Grained Nuxt Authorization
  15. Prisma ORM Data Filtering with ReBAC
  16. Delegating AI Permissions to Human Users with Permit.io’s Access Request MCP
  17. Implementing Multi-Tenant RBAC in Nuxt.js
  18. Implementing Fine-Grained Postgres Permissions for Multi-Tenant Applications
  19. Postgres RLS Implementation Guide - Best Practices, and Common Pitfalls
  20. Implementing Authentication and Authorization in Next.js
  21. How to Use JWTs for Authorization: Best Practices and Common Mistakes
  22. Introducing the New Permit.io CLI: A New Era of Access Control Developer Experience
  23. Policy-Based Access Control (PBAC) Isn’t as Great as You Think
  24. Implement Multi-Tenancy Role-Based Access Control (RBAC) in MongoDB
  25. The State of Authorization - 2025
  26. Bearer Token vs JWT vs Opaque Token: Key Differences
  27. Supabase Authentication and Authorization in Next.js: Implementation Guide
  28. Implementing Serverless Authorization in Node.js with the Serverless Framework
  29. Salt Security: Enterprise-Grade API Security with Fine-Grained Authorization
  30. A Full Guide to Planning Your Authorization Model and Architecture
  31. Machine Identity Security: Managing Risk, Delegation, and Cascading Trust
  32. AI Security Posture Management (AISPM): How to Handle AI Agent Security
  33. Firebase Rules Aren’t Enough: Decoupling Authorization for Scalable, Fine-Grained Access Control
  34. What is a Machine Identity? Understanding AI Access Control
  35. Identity Tokens Explained: Best Practices for Better Access Control
  36. Authentication and Authorization with Firebase
  37. Best Practices for Multi-Tenant Authorization
  38. Managing Frontend Authorization in Vue with CASL
  39. Implementing Role Based Access Control (RABC) in React
  40. How to Implement Dynamic React Feature Flags (2025 Update)
  41. Cookies vs. Local Storage: What’s the Difference? When and Where to Use Each?
  42. Django Authorization: An Implementation Guide
  43. Implementing Access Control in Langchain: The Four-Perimeter Approach
  44. Building a Secure Flight Booking AI Agent with Langflow
  45. Implementing Authentication and Authorization in Vue
  46. Flask RBAC: How to Implement Role-Based Access Control in a Flask Application
  47. So Long RBAC, and Thanks for All the Roles
  48. How to Implement Role-Based Access Control (RBAC) in Vue.js
  49. Announcing Permit.io AI Access Control: AI Identity FGA
  50. DeepSeek Completely Changed How We Use Google Zanzibar
  51. AI Agents Need an Access Control Overhaul - PydanticAI is Making It Happen
  52. Prompt Filtering with OpenAI: Using GPT for GPT Access Control
  53. We Let AI Handle User Permissions (And it Works)
  54. AI Content Moderator - Why and how to build one with Gemini 1.5
  55. Implementing Prisma RBAC: Fine-Grained Prisma Permissions
  56. Centauri AI: Enhancing AI-Driven Fintech with Fine-Grained Authorization (FGA)
  57. How to Implement RBAC in an Express.js Application
  58. Best Practices for Implementing Permissions in Keycloak
  59. FastAPI RBAC - Full Implementation Tutorial
  60. How HippHealth Secures Patient Data with Fine-Grained Authorization (FGA)
  61. Fine-Grained Keycloak Authorization with ABAC and ReBAC
  62. Authorization with Open Policy Agent (OPA)
  63. How to Setup Role Based Access Control (RBAC) with Keycloak
  64. Django Role-Based Access Control (RBAC): Full Implementation Guide
  65. Implementing Database Permissions
  66. What is Policy as Code?
  67. Policy Engine Showdown - OPA vs. OpenFGA vs. Cedar
  68. How to Implement Role-Based Access Control (RBAC) in Laravel
  69. Policy as Code | From Infrastructure to Fine-Grained Authorization
  70. The Challenges of Generative AI in Identity and Access Management (IAM)
  71. The “When” - Dynamic AI Access Control for a Changing Timeline
  72. ״Where״ Can They Go? Managing AI Permissions

2024 34

  1. The “What” - Adopting Proactive AI Identity Security
  2. Implement RBAC Authorization in a NestJS: Full Guide
  3. The “Who” - Understanding AI Identity in IAM
  4. Everyone Loves Policy as Code, No One Wants to Write Rego
  5. Permit.io Announces a New Pricing Model
  6. Coding Tutorial: Build a Secure Chat App with React, Firebase, and Permit.io
  7. Permit.io in KubeCon 2024 - Here’s What We're Excited For
  8. Building AI Applications with Enterprise-Grade Security Using RAG and FGA
  9. How to Implement Role-Based Access Control (RBAC) Authorization in Golang
  10. Permit.io Launch Week - Day 5: Fine-Tuned Performance
  11. Permit.io Launch Week - Day 4: Intelligent Integrations
  12. Permit.io Launch Week - Day 3: Fine-Grained Modeling
  13. Permit.io Launch Week - Day 2: Precise Decisions
  14. Permit.io Launch Week - Day 1: Optimized Developer Experience
  15. Permit.io Launch Week: Exciting Announcements and New Features!
  16. OPAL - an Authorization Service for Fine-Grained Permissions
  17. The Unspoken Tradoffs of Fine-Grained Authorization
  18. How to Implement Role-Based Access Control (RBAC) in Angular
  19. The Arc Browser Vulnerability Exposes the Inefficiency of Row-Level Security (RLS)
  20. Best Practices for Microservice Authorization
  21. What is RBAC? Uses and Implementation
  22. How Custom GitHub Actions Enabled Us to Streamline Thousands of CI/CD Pipelines
  23. Best Practices for Implementing Hybrid Cloud Security
  24. Honeycomb - A Case Study in Fine Grained Authorization
  25. Everything We Learned About Developer Conference Sponsorship
  26. Irrigating Innovation: How Fine-Grained Authorization Helps Developers Focus on What Matters
  27. Implementing RBAC Authorization in Next.js - 2024 Updated Guide
  28. Protecting Democracy Through Fine-Grained Authorization
  29. Protecting Your Users' Data from AI Training Crawlers
  30. MAC, DAC, RBAC, and FGA: A Journey Through Access Control
  31. MAC vs. DAC: Comparing Access Control Fundamentals
  32. What is Fine Grained Authorization (FGA)?
  33. Announcing “Permit Share-If"
  34. 7 Developer Tools to Prepare Your Stack for the GenAI Era

Undated 107

  1. Implementing graphql authorization
  2. Laravel authorization guide
  3. Conditions vs relationships choosing between abac and rebac
  4. How to implement rbac role based access control in astro framework
  5. How discord built access an authorization management portal
  6. What is google zanzibar
  7. Best practices for effective user permissions and access delegation
  8. Generate personalized frontend experiences with user attributes and feature flags
  9. Jwts arent made for authorization
  10. How to implement rbac in supabase
  11. How to model and implement cloud native authorization
  12. 45 questions to ask yourself before modeling authorization
  13. Opa cedar openfga why are policy languages trending
  14. Secure access into childs play with permit access request apis
  15. How to use casl for implementing authorization in react
  16. Whats new on opa v1
  17. Frontend authorization with nextjs and casl tutorial
  18. From rbac to rebac and abac with nextjs and permitio
  19. How reddit scaled to millions of decisions per second
  20. Permit scaling up with scale vp
  21. Custom policies
  22. Best practices to implement rbac for developers
  23. Best practices for api authentication and authorization
  24. Api security a comprehensive guide for developers
  25. Oauth tokens definitive guide
  26. Differences between oauth vs jwt
  27. Api authorization best practices
  28. What is token based authentication
  29. Top 5 access control features in 2024
  30. Authentication vs authorization
  31. How to implement abac
  32. What is abac
  33. Top 12 open source auth tools
  34. Build authorization like google
  35. Building healthcare authorization nextjs
  36. Authorization in healthcare
  37. How to use oauth scopes for authorization
  38. Better access control with passkeys and fine grained authorization
  39. The best developer communities of 2023
  40. Devsecops is nothing without devex
  41. Abac vs rebac
  42. 401 vs 403 error whats the difference
  43. Rbac vs rebac
  44. Producthunt howto
  45. 10 exceptional developer tools launched in 2023
  46. Shift left best practices
  47. Relationship based access control rebac with open policy agent opa
  48. What is rebac
  49. Policy engines
  50. Roll your own rbac
  51. Audit logs
  52. Frontend low code tools
  53. Best practices for authorization in python
  54. Implement authorization in fastapi
  55. Send frontend app events directly to slack
  56. Add a slack chatbox directly into your react app
  57. Everything you need to know about aws cedar policy language
  58. Implementing authorization in 4 nodejs frameworks
  59. Opa for app level authorization from rbac to abac in scale
  60. Location based access control made easy with nextjs and ipinfo
  61. Owasp 2023
  62. Cedar rbac
  63. Nextjs passwordless authentication with supertokens and twilio
  64. Mailgun foaz
  65. Zanzibar vs opa
  66. Foaz
  67. Send sms from the browser no backend code required
  68. Implement rbac authorization in express
  69. Scaling authorization with cedar and opal
  70. Cedar qna
  71. Opa vs cedar
  72. Oss aws cedar is a gamechanger for iam
  73. Planning app rbac
  74. Add rbac authorization to auth0
  75. Kubecon eu 2023
  76. Nsa
  77. Crafting your own application the 4 essential building blocks
  78. Bingbang
  79. Access control scary to simple
  80. How to create an authorization middleware for fastify
  81. Testing app permissions with cypress
  82. Building app authorization the 5 keys for scalability and compliance
  83. Netflix authz
  84. Elements
  85. Elements guide
  86. Rbac with permit
  87. Choose an authz service
  88. Podcasts2022
  89. Iam buzzwords
  90. Intellyx implementing authz
  91. Announcing abac
  92. No code permissions with kong and permitio
  93. Four mistakes you make when building permissions
  94. Homebrewing permissions with os
  95. Multitenancy in cloud
  96. Aws iam roles and policies
  97. Authorization the cloud native way
  98. Opal opa vs xacml
  99. Load external data into opa
  100. Introduction to opa
  101. Announcing permit
  102. Custom auth0 universal login
  103. Implement abac using opa
  104. Implement rbac using opa
  105. The case for centralized iam
  106. 5 best practices for building cloud native permissions
  107. What is authorization