# Authorization Published articles for Authorization. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How API Design Is Evolving for AI Agents, Security, Reliability, and Compliance DevFeed: [How API Design Is Evolving for AI Agents, Security, Reliability, and Compliance]() Original publisher: [Read original article]() Author: J Simpson Published: 2026-09-17T07:00:00Z Content type: article Language: en Sources: [Nordic APIs]() Topics: [API](), [Architecture & Design](), [Artificial Intelligence](), [reliability](), [Security]() Tags: [agents](), [ai-agents](), [api](), [api-architecture](), [api-as-a-product](), [api-design](), [api-discovery](), [api-security](), [architecture](), [authorization](), [blog](), [mcp](), [microservices](), [rate-limiting](), [reliability](), [security]() ### AI overview This article examines six ways API design is evolving as APIs serve AI agents and other machine consumers, with implications for security, reliability, and regulatory compliance. ### Source excerpt For over two decades, API design and architecture remained remarkably consistent. Perhaps it's the outsized influence of Roy Fielding's RESTful dissertation, but API designers have stuck to the principles of stateless architecture, resource-based endpoints, and HTTP commands to an impressive degree. That's all starting to change, now that we've radically recontextualized the way we use ... ## New SymfonyCasts Course: Symfony Security - The Basics DevFeed: [New SymfonyCasts Course: Symfony Security - The Basics]() Original publisher: [Read original article]() Author: Kevin Bond Published: 2026-09-16T09:34:00Z Content type: release Language: en Sources: [Symfony Blog]() Topics: [Symfony](), [Security](), [Authentication](), [Authorization](), [firewalls]() Tags: [access-control](), [authentication](), [authorization](), [controllers](), [firewalls](), [forms](), [passwords](), [security](), [security-events](), [symfony]() ### AI overview SymfonyCasts announces a new course covering the fundamentals of Symfony Security. The course builds an authentication and authorization system with Symfony 8, and the material also works with Symfony 7. ### Source excerpt Authentication, authorization, roles, voters, firewalls... there's a lot happening inside Symfony's Security system. But once you understand how the pieces fit together, it's a powerful and flexible system for answering two fundamental questions: who is this... ## How to study for the MCPA security and governance domain DevFeed: [How to study for the MCPA security and governance domain]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Security](), [Authorization](), [OAuth]() Tags: [agent](), [agentic](), [audit](), [authorization](), [model-context-protocol](), [oauth](), [security]() ### AI overview A study guide for the security and governance domain of the Model Context Protocol Associate exam. It explains trust boundaries, token audience validation, token handling between MCP servers and upstream APIs, and the distinction between consent and authorization. ### Source excerpt Security and governance is 24% of the new Model Context Protocol Associate exam. Here is what each competency actually covers in the 2026-07-28 spec, and the distinctions candidates get wrong. ## How to test an AI agent policy before enforcing it DevFeed: [How to test an AI agent policy before enforcing it]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T22:03:24Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI Agent](), [Authorization](), [Testing](), [Access Control](), [Linear]() Tags: [access-control](), [ai-agent](), [authorization](), [how-to](), [testing]() ### AI overview This guide explains how to test authorization policies for AI agents before enforcing them. It presents reusable tests for role-based access control, task intent, organizational rules, and approval requirements, with checks against the connected service. ### Source excerpt Design and test AI agent policies that block unsafe actions and keep useful work moving. Learn to test intent, RBAC, and approvals, or try WorkOS Airlock. ## From Atlas experiment to Airlock: extracting agent governance into a product DevFeed: [From Atlas experiment to Airlock: extracting agent governance into a product]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:35:36Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Security](), [Artificial Intelligence](), [App](), [Linear](), [Slack]() Tags: [agent](), [ai](), [ai-agents](), [authorization](), [email](), [integrations](), [linear](), [permission](), [policy](), [product](), [security](), [slack]() ### AI overview The article explains how WorkOS's Airlock grew from the Atlas experiment into a standalone authorization product for governing AI-agent actions in company tools. A demonstration shows policies blocking emails containing financial information and requiring approval for unfamiliar distribution lists. ### Source excerpt Airlock grew out of Atlas to give IT and security teams a shared way to govern agent actions. Aaron Tainter's Agent Night demo shows how it works. ## Let coding agents review PRs without giving them unrestricted merge access DevFeed: [Let coding agents review PRs without giving them unrestricted merge access]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:29:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI-assisted coding](), [Code review](), [GitHub](), [Authorization](), [Pull Request](), [pull-requests]() Tags: [ai-code-review](), [authorization](), [code-review](), [coding-agents](), [github](), [reviews]() ### AI overview This guide explains how to let coding agents review GitHub pull requests without granting unrestricted merge access. It recommends separate review and merge credentials, explicit merge assignments governed by WorkOS Airlock, required checks and reviews, and reapproval when the reviewed commit changes. ### Source excerpt Set GitHub permissions for AI code review, govern merges with Airlock, and prevent agents from merging code that changed after approval. ## MCP authorization: governing tool calls beyond OAuth DevFeed: [MCP authorization: governing tool calls beyond OAuth]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:04:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Authorization](), [MCP OAuth](), [MCP Server](), [OAuth]() Tags: [authorization](), [mcp](), [mcp-server](), [oauth](), [permissions](), [policy](), [scope](), [scopes]() ### AI overview This guide explains why OAuth scopes alone cannot govern the content and destination of MCP tool calls. It presents server- or gateway-side policy enforcement before execution, including request-content inspection, approval handling, and testing for data leakage. ### Source excerpt Secure MCP tool calls beyond OAuth scopes. Learn where to enforce tool permissions, check request content, and test for data leakage with Airlock. ## AI agent approval workflows: handling edits and retries DevFeed: [AI agent approval workflows: handling edits and retries]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:02:39Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI Agent](), [Authorization](), [Tool]() Tags: [agent](), [authorization](), [execution](), [how-to](), [retry](), [review](), [server](), [tool](), [workflows]() ### AI overview This guide explains how to add human approval to AI agent tool calls with WorkOS Airlock. It covers binding approval to an exact request, persisting the proposed action, resuming execution after approval, and recovering when a provider response is uncertain. ### Source excerpt Add human approval to AI agent tool calls. Learn how to review exact requests, resume execution, and handle edits and retries with Airlock. ## DigiCert's AI Trust framework for governing enterprise AI agents and models DevFeed: [DigiCert's AI Trust framework for governing enterprise AI agents and models]() Original publisher: [Read original article]() Author: Robin Birtstone Published: 2026-09-15T15:00:00Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [ai-governance](), [AI Agent](), [Authorization](), [Security](), [data]() Tags: [agents](), [ai](), [ai-governance](), [authorization](), [data](), [security](), [sponsored]() ### AI overview This sponsored feature presents DigiCert's AI Trust framework for governing enterprise AI agents. The framework uses public key infrastructure, DNS, and attestation to help organizations identify agents, track data and credentials, stop compromised agents, and reconstruct incidents. ### Source excerpt SPONSORED FEATURE: DigiCert wants to hand every agent a passport, complete with an expiry date and a named human owner ## Agent session chains that can't escalate DevFeed: [Agent session chains that can't escalate]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [API](), [API keys](), [systems]() Tags: [agent](), [api](), [auth](), [authorization](), [backend](), [multi-agent](), [multi-agent-systems](), [permission](), [server](), [systems]() ### AI overview The article explains how Agent Auth session chaining lets an agent create separately scoped child sessions for subtasks. Each child records its parent, uses its own access and single-use refresh tokens, can be revoked independently, and cannot outlive the root session. The supplied text also states that the backend creates the chain server-side using an API key. ### Source excerpt An agent can open a child session of itself for a sub-task. The chain re-derives authority at every hop and can never outlive its root. ## Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more DevFeed: [Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more]() Original publisher: [Read original article]() Author: Nico Vibert and Donia Chaiehloudj, Cilium Published: 2026-09-14T10:45:49Z Content type: article Language: en Sources: [Cloud Native Computing Foundation]() Topics: [Cilium](), [Open Source](), [API](), [networking](), [Kubernetes](), [Amazon Web Services](), [eBPF](), [VPC](), [nginx]() Tags: [2026](), [api](), [authentication](), [authorization](), [aws](), [blog](), [cilium](), [cloud](), [cni](), [ebpf](), [google](), [ingress-nginx](), [ipv4](), [ipv6](), [kubernetes](), [microsoft](), [network](), [networking](), [nginx](), [open-source](), [release]() ### AI overview Cilium 1.20 expands Gateway API support with ExternalAuth, CORS filters, ListenerSets, TCPRoute, and UDPRoute. The release also introduces extensible datapath plugins, advances networking standardization with Kubernetes, and adds beta IPv6 support for AWS ENI IPAM. ### Source excerpt Cilium 1.20, the second major open source Cilium release of 2026 after Cilium 1.19, is finally here. Three themes stand out in this release: Thank you to every contributor, reviewer and maintainer who made Cilium 1.20... ## AI Coding Tip 036 - Grant AI the Least Privilege Possible DevFeed: [AI Coding Tip 036 - Grant AI the Least Privilege Possible]() Original publisher: [Read original article]() Author: Maxi Contieri Published: 2026-09-12T15:51:59Z Content type: tutorial Language: en Sources: [Maximiliano Contieri - Software Design]() Topics: [Artificial Intelligence](), [AI Agent](), [Authorization](), [API](), [systems]() Tags: [ai](), [ai-agent](), [api](), [authorization](), [least-privilege](), [systems]() ### AI overview This developer tip explains why AI agents should receive only the access required for their tasks. It describes how overly broad API permissions, shared credentials, compromised context, and external models connected through MCP can turn routine automation into unauthorized actions. ### Source excerpt Deny by default, or watch your API become someone else's playground. TL;DR: Give every AI agent only the access its task needs, and watch for the intrusion nobody granted. Common Mistake ❌ You wire ## CrowdStrike Announces Agentic Identity Provider DevFeed: [CrowdStrike Announces Agentic Identity Provider]() Original publisher: [Read original article]() Author: Ryan Terry Published: 2026-09-12T11:17:51.295154Z Content type: release Language: en Sources: [Blog]() Topics: [AI Agent](), [Next-Gen Identity Security](), [Authorization](), [Security](), [Authentication]() Tags: [2026](), [agentic](), [ai](), [ai-agent](), [api-keys](), [applications](), [authentication](), [authorization](), [cloud-infrastructure](), [code](), [enterprise](), [identity](), [identity-control](), [next-gen-identity-security](), [saas](), [security]() ### AI overview CrowdStrike announces Agentic Identity Provider, a capability in CrowdStrike Falcon Next-Gen Identity Security that gives AI agents trusted identities and continuously controls their access according to real-time security and business context. The announcement also covers expanded privileged access across SaaS applications, endpoints, code repositories, and cloud infrastructure. ### Source excerpt CrowdStrike gives every AI agent a trusted identity and controls their access based on real-time context, and expands modern privileged access. ## Week Ending September 6, 2026 DevFeed: [Week Ending September 6, 2026]() Original publisher: [Read original article]() Published: 2026-09-11T01:00:00Z Content type: news Language: en Sources: [Last Week in Kubernetes Development]() Topics: [Kubernetes](), [Authorization]() Tags: [authorization](), [developer](), [kubernetes](), [news]() ### AI overview This Kubernetes developer news roundup covers the v1.38 release schedule, a feature-gate review, a proposed SIG UI leadership change, election deadlines, conditional authorization work, and an alpha capability for controlling disruption of lower-priority workloads. ### Source excerpt Developer News ## A Developer's Guide to API Access Policies in Auth0 DevFeed: [A Developer's Guide to API Access Policies in Auth0]() Original publisher: [Read original article]() Author: Madhuri Ravindra Mohan Published: 2026-09-11T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [API](), [Authorization](), [Security](), [Back end](), [Web app]() Tags: [api](), [auth0](), [authorization](), [backend](), [fintech](), [security](), [web-app]() ### AI overview A developer guide to Auth0 API Access Policies for Applications. It explains how to configure per-API policies through the Auth0 Dashboard or Management API, and how to distinguish machine-to-machine client access from user-delegated access. ### Source excerpt Explore how to properly configure Auth0 API Access Policies and client grants to draw a hard line between strict M2M security and user-delegated access. ## User Impersonation Can Trigger Analytics, Emails, Webhooks, and Background Jobs as the Wrong User DevFeed: [User Impersonation Can Trigger Analytics, Emails, Webhooks, and Background Jobs as the Wrong User]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [systems]() Tags: [analytics](), [authorization](), [automation](), [email](), [feature](), [feature-flags](), [notifications](), [support](), [webhooks]() ### AI overview The article explains that user impersonation is a session-level concern whose downstream effects can inherit the impersonated identity. It inventories risks including analytics, notifications, lifecycle email, chat activity, webhooks, feature flags, caches, and queued jobs, with examples of misleading user communications and unintended email automation. ### Source excerpt The side effects nobody documents: analytics, lifecycle email, feature flags, webhooks, and the background job that runs as the wrong person an hour later. ## Agent Gateway: The Next Evolution of the API Gateway DevFeed: [Agent Gateway: The Next Evolution of the API Gateway]() Original publisher: [Read original article]() Author: Gbadebo Bello Published: 2026-09-10T16:00:00Z Content type: article Language: en Sources: [Postman Blog]() Topics: [API](), [AI Agent](), [Architecture & Design](), [Artificial Intelligence](), [Routing (disambiguation)](), [Authentication](), [Authorization](), [observability]() Tags: [agent-gateway](), [ai](), [ai-agents](), [api](), [api-101](), [api-gateway](), [architecture](), [authorization](), [editor-s-picks](), [fabric-gateway](), [general](), [llm-gateway](), [mcp](), [mcp-gateway](), [observability](), [routing]() ### AI overview The article explains the emergence of the Agent Gateway as an architectural component for AI agents. It contrasts traditional API Gateways, which authenticate, govern, route, and deliver requests from clients that already know which API to call, with the needs of AI agents, which receive goals and may require broader governance across agentic workflows. ### Source excerpt API gateways are evolving for AI agents. Learn how the agent gateway governs identity, tools, memory, and policy across agentic workflows. Get early access. The post Agent Gateway: The Next Evolution of the API Gateway appeared first on Postman Blog. ## Document360 Releases Real-Time Collaborative Editing and API v3 DevFeed: [Document360 Releases Real-Time Collaborative Editing and API v3]() Original publisher: [Read original article]() Author: Darshan Sureshkumar Published: 2026-09-10T12:17:41Z Content type: release Language: en Sources: [Knowledge Management Tips, Best Practices and More]() Topics: [API](), [REST API](), [Authorization](), [Documentation](), [Automation]() Tags: [api](), [authorization](), [automation](), [product-update](), [release](), [rest-api]() ### AI overview Document360 announces real-time collaborative editing in its Advanced WYSIWYG editor and a ground-up rebuild of its public REST API as API v3. The release also includes permission-aware authorization, expanded automation coverage, publishing workflow changes, labels, reader-group controls for Eddy AI features, unified navigation, and improved offline exports. ### Source excerpt Documentation is a team effort, but most authoring tools still treat writing as ... The post No Locks, No Limits: Collaborative Editing and API v3 Are Here appeared first on Document360. ## Why You're Getting 429s in Production Using Auth0 and How to Stop Them DevFeed: [Why You're Getting 429s in Production Using Auth0 and How to Stop Them]() Original publisher: [Read original article]() Author: Carla Urrea Stabile Published: 2026-09-10T00:00:00Z Content type: tutorial Language: en Sources: [Auth0 Blog]() Topics: [Auth0](), [API](), [Authorization](), [Caching](), [JSON Web Tokens](), [Latency]() Tags: [apis](), [auth0](), [authorization](), [caching](), [errors](), [how-to](), [jwt](), [latency](), [production](), [token]() ### AI overview This tutorial explains why Auth0 API requests return 429 rate-limit errors in production. It identifies per-request Management API calls and repeatedly fetching machine-to-machine tokens as common causes, and recommends putting suitable authorization data in JWT claims, caching reusable tokens, logging rate-limit headers, and using short-lived tokens or live checks when changes must take effect immediately. ### Source excerpt Getting Auth0 429 status code errors in production? They almost always trace back to APIs rate limit. Here are the two causes and how to fix them. ## Beyond embedding: How to secure AI/BI Dashboards for every viewer DevFeed: [Beyond embedding: How to secure AI/BI Dashboards for every viewer]() Original publisher: [Read original article]() Author: Sonakshi Pandey Published: 2026-09-09T14:04:44Z Content type: tutorial Language: en Sources: [Databricks]() Topics: [databricks](), [Authorization](), [Grafana](), [SDKs](), [Back end](), [data]() Tags: [authorization](), [backend](), [dashboards](), [databricks](), [embedded](), [guide](), [idp](), [mapping](), [platform](), [product](), [sdk](), [sql]() ### AI overview This guide presents a Databricks design pattern for securing embedded AI/BI Dashboards for different viewers. It uses scoped embed tokens, __aibi_external_value, Unity Catalog row filters and column masks, and identity-provider-synchronized groups so one dashboard can show each viewer only the authorized regions and fields. The same entitlement table governs embedded dashboard access and direct Databricks SQL queries. ### Source excerpt The challengeEmbedding a Databricks AI/BI Dashboard in a customer-facing application is relatively straightforward... ## Inside the ID-JAG: How enterprise-managed authorization actually works DevFeed: [Inside the ID-JAG: How enterprise-managed authorization actually works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Model Context Protocol](), [JSON Web Tokens](), [OAuth]() Tags: [authorization](), [enterprise](), [jwt](), [mcp](), [mcp-server](), [oauth]() ### AI overview This tutorial explains how the Enterprise-Managed Authorization extension to MCP uses ID-JAGs--short-lived, signed JWT authorization grants--to let an identity provider authorize a client to access an MCP resource server. The authorization server exchanges the ID-JAG for an access token, replacing repeated user consent screens with centrally managed enterprise authorization. The article notes that the ID-JAG draft remains an active IETF document even though the MCP extension is marked Stable. ### Source excerpt The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate. ## Testing the Swagger Petstore: Manually Testing An API Using Swagger UI DevFeed: [Testing the Swagger Petstore: Manually Testing An API Using Swagger UI]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-09-07T16:43:41Z Content type: tutorial Language: en Sources: [T.J. Maher]() Topics: [Swagger](), [Testing](), [API](), [OpenAPI Specification]() Tags: [api](), [auth](), [authentication](), [authorization](), [http](), [openapi](), [payload](), [schema](), [swagger](), [testing](), [ui]() ### AI overview A practical guide to manually testing the Swagger Petstore API through Swagger UI. It covers happy-path, negative, boundary and edge-case, authentication and authorization, and contract and schema validation tests using the browser-based "Try it out" feature. ### Source excerpt With the last post, Testing the Swagger Petstore: Reviewing API Documentation Formatted in OpenAPI 3.0 with Swagger UI we started exploring an API with Swagger UI, such as the Swagger Petstore at https://petstore3.swagger.io/ Here, we will start exploring how to test an API using the Swagger UI. The tests we can run are: Happy Path Testing, checking the Positive Scenarios Negative Testing, reviewing the Invalid Inputs & Error Handling Boundary & Edge Case Testing, checking how the API handles the extreme limits of allowed input ranges Authentication & Authorization Testing Contract and schema validation We can see in the Swagger PetStore there are three tag groups: Pet, Store, and User. Because this is a Swagger UI doc, we can perform manual testing using only the "Try it out" feature in Swagger UI. No external tools needed! Live HTTP requests can be executed directly from your browser. Types of Testing for the API Here are a few types of testing and examples you can do in Swagger UI Happy path Functional Testing Pet POST /pet: add a new pet with a complete, valid payload. Verify 200 and that the response echoes the submitted fields. PUT /pet: update the pet you just created. Verify the change persists on a follow-up GET. GET /pet/{petId}: retrieve the pet by the ID returned from the POST. GET /pet/findByStatus: query with each valid status value (available, pending, sold) individually. GET /pet/findByTags: query with a tag that exists on a pet you created. POST /pet/{petId} (form data): update name/status via form fields instead of JSON body. POST /pet/{petId}/uploadImage: upload a valid image file, verify response message and metadata. DELETE /pet/{petId}: delete a pet you created, then confirm GET on that ID now fails. Store POST /store/order: place an order with valid petId, quantity, shipDate, status. GET /store/order/{orderId}: retrieve the order just placed. GET /store/inventory: verify it returns a status-to-count map without needing auth. DELETE /store/orde ## Three identity vendors shipped the same agent access pattern in eight days DevFeed: [Three identity vendors shipped the same agent access pattern in eight days]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-04T16:24:43Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Authorization](), [MCP](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Model Context Protocol]() Tags: [anthropic-claude](), [api](), [auth0](), [authorization](), [cross-app-access](), [identity](), [mcp](), [oidc](), [okta](), [sso]() ### AI overview Okta, Auth0, and Descope shipped implementations of the Cross App Access agent-access pattern between August 24 and September 1. The pattern uses a Client ID Metadata Document to identify calling software and an ID-JAG token exchange to let an identity provider control application access. ### Source excerpt Okta, Auth0, and Descope all shipped Cross App Access between August 24 and September 1. The two-layer pattern underneath it outlasts whichever vendor wins. ## Turn your app into an MCP server with the Appwrite OAuth2 server DevFeed: [Turn your app into an MCP server with the Appwrite OAuth2 server]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-04T00:00:00Z Content type: tutorial Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Model Context Protocol](), [OAuth 2.0](), [Authorization](), [Claude Code](), [Serverless](), [web applications](), [Databases]() Tags: [ai](), [ai-tools](), [app](), [auth](), [authorization](), [browser](), [claude](), [claude-code](), [code](), [databases](), [http](), [mcp](), [mcp-server](), [oauth2](), [remote-mcp-server](), [serverless](), [tutorial](), [tutorials](), [web](), [web-app]() ### AI overview This tutorial explains how to turn an Appwrite-based application into a remote MCP server. It uses an Appwrite Function, the OAuth2 server included in an Appwrite project, and a consent screen so AI tools such as Claude Code can access and act on behalf of signed-in users. ### Source excerpt Build a remote MCP server for your product, host it on Appwrite Functions, and let AI tools like Claude Code sign in through the OAuth2 server built into your Appwrite project. [Next page]()