Skip to content
ammaradam
‹ Topics

Identity and security

Who is calling, what they may do, and where that decision should be made.

3 posts, oldest first

  1. 1 Checking both the user and the agent Workload identity says which software is calling; authorizing an agent's action also needs to know which user it acts for and through which chain of agents. 16 Sep 2026, 1 min
  2. 2 An agent's identity is not its permission Knowing who an agent is answers only part of the question. Whether an action is allowed depends on the user, the scope they delegated and the resource's own policy. 13 Oct 2026, 2 min
  3. 3 Patterns for agent tool calls you can trust in production Most of what makes an agent safe to run happens at the tool call, not in the prompt: who the call acts for, how risky it is, what happens when it is retried, and whether anyone can see it afterwards. 19 Oct 2026, 9 min