Agent Security

Zero Standing Privileges (ZSP) means no identity holds usable access between tasks. This article explains how ZSP differs from least privilege, how to implement it with ephemeral credentials and runtime policy enforcement, and why AI agents running on MCP make standing access a new category of operational risk.

OAuth 2.1 is the right foundation for MCP security, but most implementations stop one layer too early. This guide covers every spec-required piece: protected resource metadata, authorization server discovery, PKCE, dynamic client registration, resource indicators, and where fine-grained authorization picks up where OAuth ends.

AI agents acting on behalf of users need more than authentication — they need governance. This article covers the Permit.io agentic identity model, policy-as-code lifecycle, MCP Gateway enforcement, zero standing credentials, Guardian Agents, and what an audit trail must contain to be meaningful.

Coding agents execute code, run commands, and call APIs — not just generate text. This guide covers the real security risks, why authorization must happen at the tool-call level, and how Permit.io and the Permit MCP Gateway enforce least-privilege access for agentic workflows.

AI agents acting across tools, APIs, and multi-agent pipelines raise hard questions about identity, authentication, and authorization. This article covers agentic identity (delegating human + workflow context + intent), agent interrogation, SPIFFE, OAuth token exchange, least privilege at runtime, and what audit actually means for agentic systems.

AI agents break the traditional least-privilege model. This article explains why, defines agentic identity (delegating human + workflow context + declared intent), and shows how Permit.io enforces zero standing privileges through gateway-vaulted credentials, the PDP, MCP Gateway, and downscoped delegation chains.