It had every permission it needed and a ticket telling it exactly what to do. Blocked once, it reworded the request to fool the check. Blocked again, it asked me to switch the check off. This is the call-by-call trace of why nothing left Linear — and the design decision that made "reword it until it's allowed" a dead end.

The LiteLLM CVE-2026-42271 and Starlette BadHost CVE-2026-48710 chain turned authenticated command injection into unauthenticated RCE. The deeper lesson: AI gateways hold model credentials, route sensitive traffic, and expose MCP utility endpoints — and need action-time authorization, not flat API keys.

Sandboxing a coding agent isolates it from the host—but the real blast radius is the credentials it holds. GitHub tokens, cloud keys, MCP connections, and CI/CD access define what an agent can actually do. Here's the runtime permission model that closes the gap.

Atlassian Rovo's MCP server makes a precise security tradeoff visible: OAuth 2.1 handles identity and consent; API tokens handle non-interactive automation. Neither governs what agents can actually do at tool-call time. Here is what that gap looks like in practice.

Coding agents are operational actors, not just assistants. This guide presents a practical trust-level taxonomy for agent commands and MCP tools, explains why human approval prompts degrade at scale, and shows how runtime authorization policy enforces trust levels without relying on click fatigue.

Treating AI agents like service accounts is a useful starting point — but it fails at runtime. Here's why scoped tokens are necessary but not sufficient, and how runtime authorization fills the gap.

The Claude Code MCP OAuth token theft chain is an authorization failure, not just a credential leak. OAuth got the agent connected, but it never constrained which tool calls remained valid after the routing layer was tampered with — and that is the gap runtime policy enforcement must close.

The IETF SD Agent draft and Microsoft Entra Agent ID are turning agent identity into real infrastructure. But a verified Agent Card or sponsored enterprise identity still doesn't answer whether an agent may call a specific MCP tool right now — that requires runtime authorization.

Microsoft Entra Agent ID and SD-JWT agent identity solve registration, governance, and authentication — but they don't decide whether a specific MCP tool call is permissible right now. This article explains the gap and the runtime authorization architecture needed to close it.

In April 2026, the NSA published 'Careful Adoption of Agentic AI Services' — the first intelligence-community advisory specifically targeting AI agent authorization failures. Here is what it actually demands and why most engineering teams are not close to meeting it.

If you already run OPA, AI agents don't require a new policy engine — they require a richer input schema, ephemeral identity, and enforcement at every layer. Learn how to evolve your OPA setup for delegated, multi-hop agentic authorization with Zero Standing Permissions, production-grade Rego, and OPAL-backed real-time enforcement.

Zero Standing Privileges (ZSP) means no identity holds usable access between tasks. This article explains how ZSP differs from least privilege, how to implement it with ephemeral credentials and runtime policy enforcement, and why AI agents running on MCP make standing access a new category of operational risk.