AI
MCP security checklist for enterprises
An enterprise MCP security checklist: approve servers by URL or command, pin OAuth scopes, set tool rules, keep a person in the loop and log every call.
6 min read
Tag
Security
57 posts
AI
How to classify MCP tools by risk (read, edit, delete)
Sort MCP tools into read, edit and delete classes with the spec's readOnlyHint and destructiveHint. Set each class yourself, since hints are not guarantees.
6 min read
AI
How to pin an AI agent to its approved plan
Pin an AI agent to its approved plan by allowlisting exact tool calls, denying the rest and checking arguments in a PreToolUse hook. Claude Code steps included.
6 min read
AI
How to set tool-level authorization for AI agents
Tool-level authorization decides which tools an agent may call. Learn how the MCP spec splits that job and how Claude Code evaluates deny, ask and allow rules.
6 min read
AI
What is ABAC for AI agents?
ABAC grants or refuses an agent's action by checking attributes of the agent, the tool, the operation and the environment. Here is how to map it to tool calls.
9 min read
Kubernetes
How to find over-privileged AI agents
Find over-privileged AI agents by testing each agent's Kubernetes service account with kubectl auth can-i --as, checking escalation paths and reading audit logs
6 min read
AI
What is Cross App Access (XAA) for MCP?
Cross App Access (XAA) lets your identity provider decide which MCP clients reach which MCP servers, via a signed ID-JAG exchanged for an access token.
4 min read
Kubernetes
How to give AI agents identity in Kubernetes
Give each AI agent a named Kubernetes service account, a short-lived projected token for one audience, and a SPIFFE ID from SPIRE when it crosses trust domains.
6 min read
Kubernetes
AI agent threat model for Kubernetes
A threat model for AI agents in Kubernetes maps each path an agent pod can reach to the admission, token, RBAC or network control that blocks it, per agent.
7 min read
Kubernetes
RBAC for AI agents in Kubernetes
Give each AI agent its own service account, bind it to a narrow Role, and point its pod at that account. RBAC has no deny rules, so grants are the limit.
5 min read
AI
How to map AI agents and humans to one identity model with OIDC
Put AI agents and people behind one OIDC issuer, register each agent as its own client, and map claims to the username your Kubernetes API server records for delegated…
7 min read
AI
What is agent identity?
Agent identity gives each AI agent its own auditable principal. A Kubernetes service account names a workload, but cannot show which agent acted or for whom.
5 min read