The Curious Engineer

All blogs / Security

Permit.io Blog

permit.io/blog

Read the Permit.io Blog for expert guides, step-by-step tutorials, best practices, and the latest news on everything Authorization, IAM, and Software Development

SecurityAI / ML

’24’25’26
Posts
286 from 24 Jul 2024 to 30 Oct 2026
Posting
weekly (83 in the last year)
Kind
company blog

2026 73

  1. Or WeisOct 30 2026OpenFGA Alternatives: Comparing Fine-Grained Authorization Options in 2026OpenFGA alternatives for fine-grained authorization including SpiceDB, Cerbos, OPA, Cedar, and Permit.io. A comparison of relationship-based and policy-based approaches to help you choose.Read more
  2. Ze'ev ManilovichOct 29 2026WorkOS FGA: Alternative Fine-Grained Authorization Options for 2026WorkOS FGA extends RBAC with hierarchical resource scoping. A comparison with Permit.io covering policy languages, deployment models, and when each fits your authorization requirements.Read more
  3. Or WeisOct 28 2026Four Pillars → APP 1.7 Homework ChecklistMap enforcement, granularity, realtime, and audit to APP 1.7 homework: inventory PEPs, PI→resource maps, revoke/sync, and audit/export for privacy-policy statements.Read more
  4. Or WeisOct 27 202610 December 2026: APP 1.7 and the Authorization Evidence Behind Automated DecisionsAPP 1.7-1.9 commence 10 December 2026. Honest ADM privacy-policy disclosure needs AuthZ inventory, PI→resource maps, PEPs, realtime revoke, and decision-log evidence, plus a soft APRA parallel.Read m
  5. Ze'ev ManilovichOct 22 2026EN 18286:2026 and AI Agents: What the EU's First AI Act Standard Means for AuthorizationEN 18286:2026 is Europe's first harmonised standard under the EU AI Act. It turns Article 17's QMS requirements into auditable processes. Here's what it means for teams shipping AI agen
  6. Or WeisOct 21 2026NIST NCCoE Four Focus Areas → AuthZ ControlsCheat-sheet: NIST NCCoE's four focus areas (identification, authorization, access delegation, and logging) mapped to concrete AuthZ controls. Soft alignment aid, not a certification checklist.Read more
  7. Or WeisOct 20 2026Treat AI Agents as Privileged IdentitiesTreat AI agents as privileged NHIs: distinct identity, least privilege, attributable delegation, and forensic decision logs, not shared keys. Map to NIST NCCoE's identification · authorization · delegation · logging.Read more
  8. Or WeisOct 15 2026Permit.io vs Cerbos: Managed Control Plane vs Self-Hosted PDPPermit.io and Cerbos can both run an open source policy decision point next to your app. A neutral comparison of managed control plane vs self-hosted PDP, with a table and when to choose each.Read more
  9. Ze'ev ManilovichOct 14 2026How to Migrate from Oso to Permit.ioA practical migration guide for teams moving from Oso Cloud to a supported authorization platform. Covers mapping Polar policy patterns to RBAC, ReBAC, and ABAC, step-by-step migration planning, and code examples.Read more
  10. Or WeisOct 14 2026What Audit Trail Do You Need for Human-to-Agent Delegation?For human-to-agent delegation, bind human principal, agent ID, tools, data, policy decision, and HITL, not just tool traces, into an attributable audit trail.Read more
  11. Or WeisOct 13 2026AI Agents Don't Lower the Security Bar. They Raise the Authorization Workload.AI agents multiply the places where authorization must run. Delegation becomes a first-class part of the authorization shape: the human, the agent, the scope, the resource, conditions. Extend fine-grained
  12. Or WeisOct 09 2026ISO 42001 Certification Guide: Audits, Annex A, EvidenceWhat ISO 42001 certification involves: the AI management system, accredited certification bodies, stage 1 and 2 audits, Annex A controls, and agent evidence.Read more
  13. Or WeisOct 08 2026EU AI Act Logging Requirements: Article 12 and ISO 42001 for AI AgentsEU AI Act logging requirements under Article 12 for high-risk AI systems, log retention rules (at least six months for deployers under Article 26(6)), ISO 42001 A.6.2.8, and practical logging design for AI agents
  14. Or WeisOct 06 2026Real-Time Authorization Enforcement: Four Pillars for Production ApplicationsProduction authorization enforcement requires four pillars: a policy decision at every sensitive action, granular policy models, realtime revocation, and auditable decisions. Control plane to OPAL to PDP t
  15. Daniel Bass & Or WeisOct 06 2026What is Authorization as a Service?Authorization as a Service provides a solution for managing user access and permissions in applications. Learn when you might want to consider such a service, how it can streamline your authorization implementation, and simplify perm
  16. Or WeisOct 05 2026AI Agent Audit Logs: 12 Fields Every MCP Audit Log NeedsAI agent audit logs need about twelve fields: identity, delegation, tool, resource, policy, decision, HITL, and outcome.Read more
  17. Or WeisOct 02 2026AI Agent Audit Trail: Proving What an Agent Did and WhyAn AI agent audit trail binds identity, delegation, tool, resource, policy, allow/deny, HITL, and outcome. Tool traces are not enough.Read more
  18. Or WeisOct 01 2026SOC 2 CC6 & ISO 27001 Access Control Checklist for AI AgentsSOC 2 CC6 and ISO 27001 access control checklist for AI agents: what controls assumed, how agents break them, evidence to produce.Read more
  19. NewPermit Nexus PDP benchmarks: 5.6 ms P99 on RBAC checks, measured server-sideNexus PDP: 5.6 ms P99 RBAC checksSee the benchmarks
  20. Or WeisSep 30 2026PEP, PDP, and Decision Logs: The Architecture Behind “Prove It”Regulators’ “prove it” maps to PEP + PDP + decision logs: enforce in the app, decide in a local PDP synced by OPAL, and keep explainable allow/deny evidence.Read more
  21. Or WeisSep 29 2026DORA and NIST Don't Say "Buy Permit": They Do Demand Access Control You Can ProveDORA and NIST do not prescribe a vendor. They expect scoped least-privilege access and attributable logs, including for NHIs and agents. Application FGA with decision logs is how product teams produce
  22. Or WeisSep 28 2026Do AI Agents Inherit User Permissions? Why That FailsAI agents get their own IdP token, separate from the user session. OAuth scopes are too coarse for resource-level rules; check agent role at each tool call.Read more
  23. Daniel BassSep 25 2026RBAC VS ABAC: Choosing the Right Authorization Policy ModelRBAC grants access by role; ABAC evaluates user, resource, and environment attributes. Compare them side by side, see examples, and learn how to migrate from RBAC to ABAC.Read more
  24. Or WeisSep 23 2026Authorization Models → Least-Privilege EvidenceYour authorization model shapes least-privilege evidence in access reviews. Role assignments, attribute conditions, and relationship tuples each prove different things.Read more
  25. Or WeisSep 22 2026RBAC vs ABAC vs ReBAC: Pick a Stack, Not a ReligionHybrid authorization by default: RBAC for org roles, ABAC for context, ReBAC for sharing graphs—one check API across models. How to pick a stack before role explosion, and why least privilege needs explainable entitlements.Read mor
  26. Or WeisSep 16 2026What's the Difference Between Authentication and Authorization?AuthN proves who you are; AuthZ decides what you can do. See the 401 vs 403 difference, real SaaS examples, and how to separate identity from permissions.Read more
  27. Or WeisSep 15 2026Explainable Deny: Authorization Decision Evidence for SOC 2-Style Access ReviewsSOC 2-style access reviews need more than IdP login events. Explainable allow and deny decision logs — decision provenance from identity to policy to resource — are the authorization evidence that makes
  28. Or WeisSep 10 2026Why Was This Allowed? Building an Explainable Authorization Audit TrailEvery authorization decision should be explainable. Authorization observability is not more logs — it is decision provenance. Here is how to build an audit trail that answers why access was allowed or denied.Rea
  29. Or WeisSep 09 2026Stop Rebuilding Permissions in Application CodeFine-grained authorization belongs in a dedicated control plane—not scattered if-statements. Learn when to externalize authorization and stop rebuilding DIY RBAC in application code.Read more
  30. How to Govern AI Agents Operating Cloud and API Control Planes Through MCP
  31. Shared Agent Memory Is a Permissions Problem
  32. MCP Auth vs Tool-Call Authorization After the 2026-07-28 Spec
  33. Read-Only Is a Trust Level, Not a Feeling: How to Govern AI Ops Agents Before They Remediate Production
  34. Agent-Generated APIs Need Governance Before They Become Agent-Callable Tools
  35. Can AI Generate Authorization Policy Safely?
  36. MCP Auth Bypasses Show Why Tool Calls Need Runtime Authorization
  37. Payment Is Not Permission: How to Authorize Paid MCP Tool Calls
  38. MCP in ERP: Why Agentic Business Workflows Need Runtime Authorization
  39. MCP Server Supply Chain Is Runtime Supply Chain: Tool Manifests Need Policy and Evidence
  40. CVE-2026-49257: Why MCP Database Servers Need Fail-Closed Authorization
  41. Zero Standing Permissions for Coding and Automation Agents
  42. Agent Audit Logs Need a Causal Commit Log, Not Just Tool Traces
  43. When AI Subagents Call MCP Tools, Who Owns the Permission Decision?
  44. OpenAPI-to-MCP Turns Every API Into an Agent Tool. The Missing Piece Is Endpoint-Level Policy
  45. Tool-Call Safety Is Not Text Safety: Why Coding Agents Need Action-Time Authorization
  46. Zero Standing Permissions for AI Agents: Lessons from Hermes Blank Slate and Toolset Pinning
  47. Agent Identity Is Not Enough: From DIDs and AI Control Towers to Runtime Permissions
  48. Prompt Injection Is an Authority-Promotion Failure, Not Just a Bad Prompt
  49. A poisoned Linear ticket told our AI agent to leak the team. It tried three ways. None worked.
  50. When the AI Gateway Becomes the Blast Radius: Lessons from the LiteLLM MCP RCE Chain
  51. Coding Agent Sandboxes Don't Solve Credential Authorization
  52. Authentication vs. Authorization in MCP: What Atlassian Rovo Shows About OAuth, API Tokens, and Tool Calls
  53. Trust Levels for Coding Agents: How to Decide Which Commands and MCP Tools Can Run Automatically
  54. Agent Identity vs. Service Accounts: Why Scoped Tokens Still Need Runtime Authorization
  55. Claude Code MCP Token Theft Shows Why OAuth Tokens Need Runtime Tool-Call Authorization
  56. Agent Identity Is Becoming a Protocol Layer, but Tool Calls Still Need Runtime Authorization
  57. Agent Identity Is Not Agent Authorization: What Entra Agent ID Still Leaves to Runtime Policy
  58. What the NSA Agentic AI Advisory Actually Requires
  59. OPA for Protecting AI Agents and Agentic Stacks
  60. Zero Standing Privileges: What It Is, How to Implement It, and Why AI Agents Need It
  61. OAuth on MCP: The Comprehensive Implementation Guide
  62. Best Practices for AI Identity Governance
  63. Securing Coding Agents: What You Need to Know
  64. Agent Identity Security: Authentication, Authorization, and Trust in AI Systems
  65. Least Privilege in AI Agents and Agentic Identity
  66. RBAC vs ReBAC for AI Agents: Best Authorization Model for Secure Agentic Systems
  67. MCP Auth vs Agent Authorization: Why OAuth Alone Doesn’t Solve Agent Security
  68. MCP Proxy vs MCP Gateway: Routing vs Governance
  69. How Security Teams Review an MCP Gateway for SOC 2 + HIPAA
  70. The Six Layers Every MCP Gateway Must Enforce
  71. Announcing Permit MCP Gateway
  72. Securing AI Agents: Why Traditional Authorization Isn’t Enough
  73. RBAC vs ABAC & ReBAC: Choosing the Right Authorization Model

2025 72

  1. Authorization Strategies for Model Context Protocol (MCP)
  2. What the OpenAI–Mixpanel Incident Really Reveals About Metadata Risk
  3. Why AI Agents Choose Permit.io for Authorization
  4. Top Open-Source Authorization Tools for Enterprises in 2026
  5. Fine-Grained Access Control for n8n Workflows
  6. Deploying On-Perm Fine-Grained Authorization Service
  7. Permit.io Introduces Database-Level Authorization with Trino Integration
  8. Exploring the x402 Protocol for Internet-Native Payments
  9. Learn ReBAC vs ABAC by example: with Permit.io and AWS Cedar
  10. ReBAC in Practice: Permit.io Vs OpenFGA
  11. The Ultimate Guide to MCP Auth: Identity, Consent, and Agent Security
  12. Why JWTs Can’t Handle AI Agent Access
  13. Human in the Loop AI Agents: Approval Workflows That Work
  14. Implementing Fine-Grained Nuxt Authorization
  15. Prisma ORM Data Filtering with ReBAC
  16. Delegating AI Permissions to Human Users with Permit.io’s Access Request MCP
  17. Implementing Multi-Tenant RBAC in Nuxt.js
  18. Implementing Fine-Grained Postgres Permissions for Multi-Tenant Applications
  19. Postgres RLS Implementation Guide - Best Practices, and Common Pitfalls
  20. Implementing Authentication and Authorization in Next.js
  21. How to Use JWTs for Authorization: Best Practices and Common Mistakes
  22. Introducing the New Permit.io CLI: A New Era of Access Control Developer Experience
  23. Policy-Based Access Control (PBAC) Isn’t as Great as You Think
  24. Implement Multi-Tenancy Role-Based Access Control (RBAC) in MongoDB
  25. The State of Authorization - 2025
  26. A Guide to Bearer Tokens: JWT vs. Opaque Tokens
  27. Supabase Authentication and Authorization in Next.js: Implementation Guide
  28. Implementing Serverless Authorization in Node.js with the Serverless Framework
  29. Salt Security: Enterprise-Grade API Security with Fine-Grained Authorization
  30. A Full Guide to Planning Your Authorization Model and Architecture
  31. Machine Identity Security: Managing Risk, Delegation, and Cascading Trust
  32. AI Security Posture Management (AISPM): How to Handle AI Agent Security
  33. Firebase Rules Aren’t Enough: Decoupling Authorization for Scalable, Fine-Grained Access Control
  34. What is a Machine Identity? Understanding AI Access Control
  35. Identity Tokens Explained: Best Practices for Better Access Control
  36. Authentication and Authorization with Firebase
  37. Best Practices for Multi-Tenant Authorization
  38. Managing Frontend Authorization in Vue with CASL
  39. Implementing Role Based Access Control (RABC) in React
  40. How to Implement Dynamic React Feature Flags (2025 Update)
  41. Cookies vs. Local Storage: What’s the Difference? When and Where to Use Each?
  42. Django Authorization: An Implementation Guide
  43. Implementing Access Control in Langchain: The Four-Perimeter Approach
  44. Building a Secure Flight Booking AI Agent with Langflow
  45. Implementing Authentication and Authorization in Vue
  46. Flask RBAC: How to Implement Role-Based Access Control in a Flask Application
  47. So Long RBAC, and Thanks for All the Roles
  48. How to Implement Role-Based Access Control (RBAC) in Vue.js
  49. Announcing Permit.io AI Access Control: AI Identity FGA
  50. DeepSeek Completely Changed How We Use Google Zanzibar
  51. AI Agents Need an Access Control Overhaul - PydanticAI is Making It Happen
  52. Prompt Filtering with OpenAI: Using GPT for GPT Access Control
  53. We Let AI Handle User Permissions (And it Works)
  54. AI Content Moderator - Why and how to build one with Gemini 1.5
  55. Implementing Prisma RBAC: Fine-Grained Prisma Permissions
  56. Centauri AI: Enhancing AI-Driven Fintech with Fine-Grained Authorization (FGA)
  57. How to Implement RBAC in an Express.js Application
  58. Best Practices for Implementing Permissions in Keycloak
  59. FastAPI RBAC - Full Implementation Tutorial
  60. How HippHealth Secures Patient Data with Fine-Grained Authorization (FGA)
  61. Fine-Grained Keycloak Authorization with ABAC and ReBAC
  62. Authorization with Open Policy Agent (OPA)
  63. How to Setup Role Based Access Control (RBAC) with Keycloak
  64. Django Role-Based Access Control (RBAC): Full Implementation Guide
  65. Implementing Database Permissions
  66. What is Policy as Code?
  67. Policy Engine Showdown - OPA vs. OpenFGA vs. Cedar
  68. How to Implement Role-Based Access Control (RBAC) in Laravel
  69. Policy as Code | From Infrastructure to Fine-Grained Authorization
  70. The Challenges of Generative AI in Identity and Access Management (IAM)
  71. The “When” - Dynamic AI Access Control for a Changing Timeline
  72. ״Where״ Can They Go? Managing AI Permissions

2024 34

  1. The “What” - Adopting Proactive AI Identity Security
  2. Implement RBAC Authorization in a NestJS: Full Guide
  3. The “Who” - Understanding AI Identity in IAM
  4. Everyone Loves Policy as Code, No One Wants to Write Rego
  5. Permit.io Announces a New Pricing Model
  6. Coding Tutorial: Build a Secure Chat App with React, Firebase, and Permit.io
  7. Permit.io in KubeCon 2024 - Here’s What We're Excited For
  8. Building AI Applications with Enterprise-Grade Security Using RAG and FGA
  9. How to Implement Role-Based Access Control (RBAC) Authorization in Golang
  10. Permit.io Launch Week - Day 5: Fine-Tuned Performance
  11. Permit.io Launch Week - Day 4: Intelligent Integrations
  12. Permit.io Launch Week - Day 3: Fine-Grained Modeling
  13. Permit.io Launch Week - Day 2: Precise Decisions
  14. Permit.io Launch Week - Day 1: Optimized Developer Experience
  15. Permit.io Launch Week: Exciting Announcements and New Features!
  16. OPAL - an Authorization Service for Fine-Grained Permissions
  17. The Unspoken Tradoffs of Fine-Grained Authorization
  18. How to Implement Role-Based Access Control (RBAC) in Angular
  19. The Arc Browser Vulnerability Exposes the Inefficiency of Row-Level Security (RLS)
  20. Best Practices for Microservice Authorization
  21. What is RBAC? Uses and Implementation
  22. How Custom GitHub Actions Enabled Us to Streamline Thousands of CI/CD Pipelines
  23. Best Practices for Implementing Hybrid Cloud Security
  24. Honeycomb - A Case Study in Fine Grained Authorization
  25. Everything We Learned About Developer Conference Sponsorship
  26. Irrigating Innovation: How Fine-Grained Authorization Helps Developers Focus on What Matters
  27. Implementing RBAC Authorization in Next.js - 2024 Updated Guide
  28. Protecting Democracy Through Fine-Grained Authorization
  29. Protecting Your Users' Data from AI Training Crawlers
  30. MAC, DAC, RBAC, and FGA: A Journey Through Access Control
  31. MAC vs. DAC: Comparing Access Control Fundamentals
  32. What is Fine Grained Authorization (FGA)?
  33. Announcing “Permit Share-If"
  34. 7 Developer Tools to Prepare Your Stack for the GenAI Era

Undated 107

  1. Implementing graphql authorization
  2. Laravel authorization guide
  3. Conditions vs relationships choosing between abac and rebac
  4. How to implement rbac role based access control in astro framework
  5. How discord built access an authorization management portal
  6. What is google zanzibar
  7. Best practices for effective user permissions and access delegation
  8. Generate personalized frontend experiences with user attributes and feature flags
  9. Jwts arent made for authorization
  10. How to implement rbac in supabase
  11. How to model and implement cloud native authorization
  12. 45 questions to ask yourself before modeling authorization
  13. Opa cedar openfga why are policy languages trending
  14. Secure access into childs play with permit access request apis
  15. How to use casl for implementing authorization in react
  16. Whats new on opa v1
  17. Frontend authorization with nextjs and casl tutorial
  18. From rbac to rebac and abac with nextjs and permitio
  19. How reddit scaled to millions of decisions per second
  20. Permit scaling up with scale vp
  21. Custom policies
  22. Best practices to implement rbac for developers
  23. Best practices for api authentication and authorization
  24. Api security a comprehensive guide for developers
  25. Oauth tokens definitive guide
  26. Differences between oauth vs jwt
  27. Api authorization best practices
  28. What is token based authentication
  29. Top 5 access control features in 2024
  30. Authentication vs authorization
  31. How to implement abac
  32. What is abac
  33. Top 12 open source auth tools
  34. Build authorization like google
  35. Building healthcare authorization nextjs
  36. Authorization in healthcare
  37. How to use oauth scopes for authorization
  38. Better access control with passkeys and fine grained authorization
  39. The best developer communities of 2023
  40. Devsecops is nothing without devex
  41. Abac vs rebac
  42. 401 vs 403 error whats the difference
  43. Rbac vs rebac
  44. Producthunt howto
  45. 10 exceptional developer tools launched in 2023
  46. Shift left best practices
  47. Relationship based access control rebac with open policy agent opa
  48. What is rebac
  49. Policy engines
  50. Roll your own rbac
  51. Audit logs
  52. Frontend low code tools
  53. Best practices for authorization in python
  54. Implement authorization in fastapi
  55. Send frontend app events directly to slack
  56. Add a slack chatbox directly into your react app
  57. Everything you need to know about aws cedar policy language
  58. Implementing authorization in 4 nodejs frameworks
  59. Opa for app level authorization from rbac to abac in scale
  60. Location based access control made easy with nextjs and ipinfo
  61. Owasp 2023
  62. Cedar rbac
  63. Nextjs passwordless authentication with supertokens and twilio
  64. Mailgun foaz
  65. Zanzibar vs opa
  66. Foaz
  67. Send sms from the browser no backend code required
  68. Implement rbac authorization in express
  69. Scaling authorization with cedar and opal
  70. Cedar qna
  71. Opa vs cedar
  72. Oss aws cedar is a gamechanger for iam
  73. Planning app rbac
  74. Add rbac authorization to auth0
  75. Kubecon eu 2023
  76. Nsa
  77. Crafting your own application the 4 essential building blocks
  78. Bingbang
  79. Access control scary to simple
  80. How to create an authorization middleware for fastify
  81. Testing app permissions with cypress
  82. Building app authorization the 5 keys for scalability and compliance
  83. Netflix authz
  84. Elements
  85. Elements guide
  86. Rbac with permit
  87. Choose an authz service
  88. Podcasts2022
  89. Iam buzzwords
  90. Intellyx implementing authz
  91. Announcing abac
  92. No code permissions with kong and permitio
  93. Four mistakes you make when building permissions
  94. Homebrewing permissions with os
  95. Multitenancy in cloud
  96. Aws iam roles and policies
  97. Authorization the cloud native way
  98. Opal opa vs xacml
  99. Load external data into opa
  100. Introduction to opa
  101. Announcing permit
  102. Custom auth0 universal login
  103. Implement abac using opa
  104. Implement rbac using opa
  105. The case for centralized iam
  106. 5 best practices for building cloud native permissions
  107. What is authorization