https://blog.authfi.io Engineering notes on identity, access and the fabric that runs them. en Sat, 10 Oct 2026 18:25:03 GMT https://blog.authfi.io/blog/ai-agents/what-is-ai-agent-identity https://blog.authfi.io/blog/ai-agents/what-is-ai-agent-identity An AI agent that borrows a person's token or a shared API key cannot be limited, audited or stopped on its own. Here is what an identity for an agent consists of. Tue, 06 Oct 2026 09:00:00 GMT Sourabh Singh AI agents https://blog.authfi.io/blog/ai-agents/the-agent-boundary https://blog.authfi.io/blog/ai-agents/the-agent-boundary An agent will try whatever its input tells it to. A boundary limits what it can reach, for how long, and where the limit is enforced so the agent cannot argue with it. Tue, 29 Sep 2026 09:00:00 GMT Sourabh Singh AI agents https://blog.authfi.io/blog/ai-agents/authenticating-mcp-servers-and-tools https://blog.authfi.io/blog/ai-agents/authenticating-mcp-servers-and-tools Where authentication sits in an agent's tool call, how OAuth-based authorisation works for MCP, and why a token must never be passed through to the API behind a tool. Tue, 22 Sep 2026 09:00:00 GMT Sourabh Singh AI agents https://blog.authfi.io/blog/ai-agents/human-approval-for-agent-actions https://blog.authfi.io/blog/ai-agents/human-approval-for-agent-actions Some actions should not be an agent's decision alone. How to pick them, and how to design approval requests that people actually read before they answer. Thu, 10 Sep 2026 09:00:00 GMT Sourabh Singh AI agents https://blog.authfi.io/blog/zero-code/zero-code-sso-with-an-ebpf-proxy https://blog.authfi.io/blog/zero-code/zero-code-sso-with-an-ebpf-proxy How to put single sign-on in front of an old internal app without changing it, and why the identity headers it receives must be stripped and re-stamped at the boundary. Thu, 03 Sep 2026 09:00:00 GMT Sourabh Singh Zero-Code https://blog.authfi.io/blog/zero-code/what-is-zero-code-authentication https://blog.authfi.io/blog/zero-code/what-is-zero-code-authentication Zero-code authentication puts sign-in and access checks in front of a service instead of inside it. How sidecars, proxies and kernel interception compare, and when to use an SDK. Wed, 26 Aug 2026 09:00:00 GMT Sourabh Singh Zero-Code https://blog.authfi.io/blog/zero-code/service-to-service-authentication https://blog.authfi.io/blog/zero-code/service-to-service-authentication How services prove who they are to each other with mTLS, workload identity and short-lived certificates, and why a shared static API key is the wrong tool for the job. Tue, 18 Aug 2026 09:00:00 GMT Sourabh Singh Zero-Code https://blog.authfi.io/blog/identity/passkeys-explained https://blog.authfi.io/blog/identity/passkeys-explained How passkeys work under WebAuthn, the difference between synced and device-bound passkeys, and a rollout plan that covers fallback and recovery from day one. Tue, 11 Aug 2026 09:00:00 GMT Sourabh Singh Identity https://blog.authfi.io/blog/identity/saml-vs-oidc https://blog.authfi.io/blog/identity/saml-vs-oidc SAML 2.0 and OpenID Connect both deliver single sign-on, in different shapes. How each one works, when to pick which, and what it takes to run both side by side. Tue, 04 Aug 2026 09:00:00 GMT Sourabh Singh Identity https://blog.authfi.io/blog/identity/account-recovery-without-account-takeover https://blog.authfi.io/blog/identity/account-recovery-without-account-takeover Recovery is the weakest door into most accounts. Design rules for a recovery email that helps a locked-out person without handing an attacker a second way in. Tue, 28 Jul 2026 09:00:00 GMT Sourabh Singh Identity https://blog.authfi.io/blog/identity/workforce-vs-customer-identity https://blog.authfi.io/blog/identity/workforce-vs-customer-identity Employees and customers both sign in, but the users, scale, lifecycle and sign-in methods differ. Here is how the two compare and when one platform fits both. Tue, 21 Jul 2026 09:00:00 GMT Sourabh Singh Identity https://blog.authfi.io/blog/security/why-every-secret-key-lives-in-one-place https://blog.authfi.io/blog/security/why-every-secret-key-lives-in-one-place Signing keys, SSH authorities, SAML certificates and sealed secrets belong behind one key service. How envelope encryption and rotation with a grace window work. Tue, 14 Jul 2026 09:00:00 GMT Sourabh Singh Security https://blog.authfi.io/blog/security/short-lived-ssh-certificates https://blog.authfi.io/blog/security/short-lived-ssh-certificates SSH keys copied to servers outlive the people who made them. Certificates signed by a CA expire in minutes, name who may log in and leave a record. How they work. Tue, 07 Jul 2026 09:00:00 GMT Sourabh Singh Security https://blog.authfi.io/blog/security/step-up-authentication https://blog.authfi.io/blog/security/step-up-authentication Step-up authentication asks for a stronger or fresher factor only before sensitive actions. Which actions to cover, how fresh a session must be, and how to avoid MFA fatigue. Tue, 30 Jun 2026 09:00:00 GMT Sourabh Singh Security https://blog.authfi.io/blog/engineering/running-the-blog-on-cloudflare-workers https://blog.authfi.io/blog/engineering/running-the-blog-on-cloudflare-workers This blog is a Next.js app on Cloudflare Workers with a Strapi CMS. Pages are pre-rendered, cached at the edge and regenerated only when a webhook says content changed. Tue, 23 Jun 2026 09:00:00 GMT Sourabh Singh Engineering https://blog.authfi.io/blog/engineering/keeping-identity-data-in-your-region https://blog.authfi.io/blog/engineering/keeping-identity-data-in-your-region Identity data is personal data. What counts as identity data, how regional planes and a global control plane divide the work, and what may reasonably cross a border. Tue, 16 Jun 2026 09:00:00 GMT Sourabh Singh Engineering https://blog.authfi.io/blog/engineering/an-audit-record-you-can-query https://blog.authfi.io/blog/engineering/an-audit-record-you-can-query An audit record should answer who did what, on whose behalf, from where and with what outcome. How to design the fields, make it tamper-evident and keep it searchable. Tue, 09 Jun 2026 09:00:00 GMT Sourabh Singh Engineering https://blog.authfi.io/blog/product/rbac-roles-bindings-and-least-privilege https://blog.authfi.io/blog/product/rbac-roles-bindings-and-least-privilege Role-based access control decays unless it is maintained. How permissions, roles and bindings fit together, and how to find roles nobody holds or that grant nothing. Tue, 02 Jun 2026 09:00:00 GMT Sourabh Singh Product https://blog.authfi.io/blog/product/kubernetes-access-tied-to-identity https://blog.authfi.io/blog/product/kubernetes-access-tied-to-identity A shared kubeconfig tells the cluster nothing about who is calling. How OIDC, RBAC subjects and short-lived credentials tie Kubernetes access to a person or workload. Tue, 26 May 2026 09:00:00 GMT Sourabh Singh Product https://blog.authfi.io/blog/product/how-to-evaluate-an-identity-provider https://blog.authfi.io/blog/product/how-to-evaluate-an-identity-provider A vendor-neutral checklist for choosing an identity provider: protocols, sign-in methods, lifecycle, audit, data residency, key custody, AI agents and your exit plan. Tue, 19 May 2026 09:00:00 GMT Sourabh Singh Product