Human-in-the-loop oversight for autonomous agents splits across four distinct layers — identity, protocol, infrastructure, and runtime — according to an analysis citing OpenID Connect's CIBA, MCP's el…
The API community is converging on 'capability' as the unit of value for the agentic era, a shift documented in a cross-referenced conversation from June 2023 through October 2025. Bruno Pedro first p…
James Carman of Callibrity argues that AI agent authorization should not rely solely on intent, but on deterministic authorization for typed actions and containment, evaluation, and observability for …
AI agents that hold long-lived bearer credentials in their environment, config, or context window create a systemic leak risk because any entity that obtains the credential can reuse it, and agents ma…
AgentGateway, the Rust-based AI proxy from the AI Agent Infrastructure Foundation, now supports RFC 8693 OAuth 2.0 Token Exchange to securely delegate user identity to AI agents. The feature replaces …
Okta SAML and Keycloak can interoperate via the Identity Assertion JWT Authorization Grant (ID-JAG) draft to enable cross-app access, according to a demo by Christian Posta. The flow converts enterpri…
Christian Posta published a bonus blog post implementing MCP Authorization with Dynamic Client Registration, building an MCP client that follows RFC 7591 to automatically discover and register OAuth c…
Christian Posta explores the concept of AI agent identity, arguing that agents are not human but can be treated as workloads using existing identity primitives like SPIFFE/WIMSE. He notes that for age…