What is AI agent identity?
An AI agent that borrows a person's token or a shared API key cannot be limited, audited or stopped on its own. Here is what an identity for an agent consists of.
Blog
Guides and engineering notes on identity, access and AI agents, from the people building AuthFI.
AI agents
Identity, boundaries and approvals for software that acts on its own.
The agent boundary: deciding what an AI agent may touch
An agent will try whatever its input tells it to. A boundary limits what it can reach, for how long, and where the limit is enforced so the agent cannot argue with it.
Authenticating MCP servers and tool calls
Where authentication sits in an agent's tool call, how OAuth-based authorisation works for MCP, and why a token must never be passed through to the API behind a tool.
Human approval for agent actions: when to ask and how
Some actions should not be an agent's decision alone. How to pick them, and how to design approval requests that people actually read before they answer.
Engineering
How the fabric is built and run.
How this blog runs on Cloudflare Workers
This blog is a Next.js app on Cloudflare Workers with a Strapi CMS. Pages are pre-rendered, cached at the edge and regenerated only when a webhook says content changed.
Keeping identity data in your region
Identity data is personal data. What counts as identity data, how regional planes and a global control plane divide the work, and what may reasonably cross a border.
Designing an audit record you can query
An audit record should answer who did what, on whose behalf, from where and with what outcome. How to design the fields, make it tamper-evident and keep it searchable.
Identity
Sign-in, single sign-on, passkeys and recovery for the people you serve.
SAML vs OIDC: which to use for single sign-on
SAML 2.0 and OpenID Connect both deliver single sign-on, in different shapes. How each one works, when to pick which, and what it takes to run both side by side.
Account recovery without account takeover
Recovery is the weakest door into most accounts. Design rules for a recovery email that helps a locked-out person without handing an attacker a second way in.
Workforce identity vs customer identity: what differs
Employees and customers both sign in, but the users, scale, lifecycle and sign-in methods differ. Here is how the two compare and when one platform fits both.
Product
Guides to roles, access and choosing the right tools.
RBAC done properly: roles, bindings and least privilege
Role-based access control decays unless it is maintained. How permissions, roles and bindings fit together, and how to find roles nobody holds or that grant nothing.
Kubernetes access tied to a person's identity
A shared kubeconfig tells the cluster nothing about who is calling. How OIDC, RBAC subjects and short-lived credentials tie Kubernetes access to a person or workload.
How to evaluate an identity provider: a checklist
A vendor-neutral checklist for choosing an identity provider: protocols, sign-in methods, lifecycle, audit, data residency, key custody, AI agents and your exit plan.
Security
Keys, certificates and the controls that keep access honest.
Replacing long-lived SSH keys with short-lived certificates
SSH keys copied to servers outlive the people who made them. Certificates signed by a CA expire in minutes, name who may log in and leave a record. How they work.
Step-up authentication: a stronger factor only when it matters
Step-up authentication asks for a stronger or fresher factor only before sensitive actions. Which actions to cover, how fresh a session must be, and how to avoid MFA fatigue.
Zero-Code
Protecting applications and services without changing their code.
What is zero-code authentication?
Zero-code authentication puts sign-in and access checks in front of a service instead of inside it. How sidecars, proxies and kernel interception compare, and when to use an SDK.
Service-to-service authentication: mTLS and workload identity
How services prove who they are to each other with mTLS, workload identity and short-lived certificates, and why a shared static API key is the wrong tool for the job.