In focus · September 2026
AI agents.
Access under control.
Agent identity and permissions are in focus in AI security. The architecture priority: constrain tools and data, record actions and test access revocation.
Explore my profile ↗Select a layer to explore
Identity
Authorize every access. Authenticate every identity.
Broken Access Control / Authentication Failures
Reference controlsLeast privilege · MFA · session review
Conceptual grouping by Thiago Silva based on OWASP Top 10:2025; not an official layer model or certification. OWASP reference ↗
Explore architecture decisions
- AWS and GCP: turn shared responsibility into tasks
Assign ownership for each control.
- Authentication: design beyond login
Device changes and recovery also establish trust.
- CI/CD: every stage carries a trust boundary
Building code and authorizing production are different decisions.
- RAG: revocation must reach retrievable content
Removing source access may leave usable copies.
- BOLA and IDOR: review the actual object
Knowing an identifier is not authorization evidence.
- Additional encryption: which threat does it address?
Application encryption changes exposure boundaries and operations.
Subscribe via RSS
Get new articles in your RSS reader. Copy the feed address and add it to Feedly, Inoreader or another reader.
AI-assisted curation · Sources: Microsoft Security — Least privilege for AI agents