Cerbos

Checking authorization once at the edge leaves every downstream hop unguarded. Here is why agent delegation needs a policy decision at every hop, and how to do it.

Compare Keycloak alternatives by protocol, deployment model, limitations, and migration path. Covers ZITADEL, Authentik, Authelia, SuperTokens, and Ory Hydra, plus when to keep Keycloak and add Cerbos for fine-grained authorization instead.

The best AI agent security and governance tools, broken down by layer. Prompt security, guardrails, posture and shadow-agent discovery, non-human identity, authorization and access control, data and RAG protection, and runtime monitoring, with the notable

When agent A delegates to agent B to a tool, the user's consent and identity get lost along the way. Here is how multi-hop delegation should actually work.

Platform teams usually keep two sets of access rules, one for what may be admitted into the cluster and one for what users may do in the applications there. Covers serving the admission webhook from the same policy layer, what a full ruleset looks like, a

Not every authorization decision is allow or deny. Some denials are conditional, and the policy can return what would unblock them. Covers Cerbos policy outputs, the conditionNotMet trigger, the AuthZEN ARAP draft profile for requestable denials, and why

Learn what authorization is all about! Explore several key authorization design patterns, how they work, and possible scenarios where they may be implemented. This guide covers RBAC, ABAC, PBAC, DAC, MAC, and ReBAC, how authorization differs from authenti

Istio proves which workload is calling with mTLS and SPIFFE, and stops there. This guide covers where AuthorizationPolicy runs out, handing the decision to an external authorizer through the CUSTOM action, running one policy set across north south and eas

How to resolve identity attributes at decision time rather than reading stale JWT claims. Covers Envoy verifying the token while a Synapse data source fetches current profile and group data, policies that read attributes rather than claims, per source cac

Telling an agent which tools not to use is a request, not a control. Here is how to gate MCP tool calls with policy enforced outside the agent, at the execution boundary.