# least privilege Published articles for least privilege. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline DevFeed: [Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline]() Original publisher: [Read original article]() Author: Luis Pastor Published: 2026-09-15T15:53:51Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS Identity and Access Management (IAM)](), [CI/CD](), [Infrastructure as code](), [AWS CloudFormation](), [Amazon Web Services]() Tags: [aws](), [aws-cloudformation](), [aws-cloudtrail](), [aws-iam](), [aws-identity-and-access-management-iam](), [aws-organizations](), [best-practices](), [ci-cd](), [expert-400](), [iam](), [infrastructure-as-code-iac](), [least-privilege](), [pull-request](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article describes an automated workflow for operationalizing least privilege in AWS. It explains how AWS IAM Access Analyzer identifies unused permissions and how remediation can be routed through different paths for infrastructure-as-code-managed, manually created, and unused IAM principals. ### Source excerpt The principle of least privilege is straightforward to articulate but challenging to maintain at scale. When teams first deploy applications to AWS, they often grant broader permissions than strictly necessary; it's faster to get things working, and the plan is always to tighten permissions later. But later rarely comes. Permissions accumulate, AWS Identity and Access [...] ## Give every teammate and agent the right level of access to your Workers DevFeed: [Give every teammate and agent the right level of access to your Workers]() Original publisher: [Read original article]() Author: Visal In Published: 2026-09-15T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Workers](), [Authorization](), [Developer Platform](), [debug]() Tags: [agent](), [api](), [cloudflare](), [debug](), [developer](), [developer-platform](), [developers](), [identity](), [least-privilege](), [logs](), [metrics](), [monitor](), [product-news](), [scope](), [security](), [traces](), [workers](), [workflows]() ### AI overview Cloudflare now lets teams scope access to individual Workers and assign narrower Developer Platform roles. Teammates, CI tokens, and agents can receive only the permissions needed to debug, deploy, or monitor safely. ### Source excerpt You can now scope access to individual Workers and assign narrower Developer Platform roles, so teammates, CI tokens, and agents get only the access they need to debug, deploy, or monitor safely. ## AI Coding Tip 036 - Grant AI the Least Privilege Possible DevFeed: [AI Coding Tip 036 - Grant AI the Least Privilege Possible]() Original publisher: [Read original article]() Author: Maxi Contieri Published: 2026-09-12T15:51:59Z Content type: tutorial Language: en Sources: [Maximiliano Contieri - Software Design]() Topics: [Artificial Intelligence](), [AI Agent](), [Authorization](), [API](), [systems]() Tags: [ai](), [ai-agent](), [api](), [authorization](), [least-privilege](), [systems]() ### AI overview This developer tip explains why AI agents should receive only the access required for their tasks. It describes how overly broad API permissions, shared credentials, compromised context, and external models connected through MCP can turn routine automation into unauthorized actions. ### Source excerpt Deny by default, or watch your API become someone else's playground. TL;DR: Give every AI agent only the access its task needs, and watch for the intrusion nobody granted. Common Mistake ❌ You wire ## How to secure AI coding agents with permissions, approval gates, hooks, and sandboxing DevFeed: [How to secure AI coding agents with permissions, approval gates, hooks, and sandboxing]() Original publisher: [Read original article]() Author: Jeff Morhous Published: 2026-09-08T10:07:38Z Content type: tutorial Language: en Sources: [The AI-Augmented Engineer]() Topics: [Claude Code](), [agentic-coding](), [Artificial Intelligence](), [AI-assisted coding](), [coding]() Tags: [agents](), [ai](), [ai-coding-agents](), [claude-code](), [coding-agents](), [how-to](), [least-privilege](), [permissions](), [sandboxing](), [security]() ### AI overview The article explains why coding-agent instructions such as CLAUDE.md are behavioral guidance rather than enforceable security boundaries. It discusses least privilege, Claude Code permissions, approval gates, hooks, and sandboxing as technical controls for limiting agent actions. ### Source excerpt Learn how to use the principle of least privilege, Claude Code permissions, approval gates, hooks, and sandboxing to keep your agentic coding secure ## Fine-Grained Access Control Now Available for All Heroku Customers DevFeed: [Fine-Grained Access Control Now Available for All Heroku Customers]() Original publisher: [Read original article]() Author: Alberto Sigismondi Published: 2026-08-21T17:07:29Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [Access Control](), [Security](), [IAM](), [Zero Trust](), [legacy]() Tags: [access-control](), [deploy](), [heroku](), [iam](), [identity-and-access-management](), [least-privilege](), [legacy](), [news](), [permissions](), [pipelines](), [security](), [security-compliance](), [zero-trust]() ### AI overview Heroku announces that Fine-Grained Access Control is available to all customers. The feature replaces fixed legacy roles with capability-based roles and app-specific permissions for roles such as view, deploy, operate, and manage. ### Source excerpt Fine-Grained Access Controls is now available to all Heroku customers. Heroku's legacy system gave you predefined roles like admin, member, or collaborator, each with a fixed bundle of permissions. It replaces that system with fine-grained roles like view, deploy, operate, and manage, with specific capability sets. Access control is managed at an app-specific layer, giving [...] The post Fine-Grained Access Control Now Available for All Heroku Customers appeared first on Heroku. ## Agent Night recap: Airlock and intent-based access control DevFeed: [Agent Night recap: Airlock and intent-based access control]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-17T19:04:02Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [Access Control](), [Authorization](), [Software Engineering]() Tags: [agent](), [demo](), [engineering](), [least-privilege](), [recap]() ### AI overview A recap of Agent Night presents Airlock, WorkOS's proposed intent-based access control model, and argues that conventional RBAC and least-privilege approaches do not adequately fit agent permissions. It also discusses why software engineering has been an early area of agent adoption. ### Source excerpt Recap of Agent Night at the Regency Ballroom: why agent permissions break RBAC and least privilege, and a live demo of Airlock, our intent-based access control. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## Platform engineering makes a difference. Here's how to prove it DevFeed: [Platform engineering makes a difference. Here's how to prove it]() Original publisher: [Read original article]() Author: Liz Coolman Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [internal developer platform](), [AI Engineering](), [Developer Platform](), [configuration](), [Security](), [telemetry]() Tags: [ai](), [ai-engineering](), [ai-impact](), [cognitive-load](), [configuration](), [developer-platform](), [encryption](), [engineering](), [idp](), [infrastructure](), [least-privilege](), [metrics](), [performance](), [platform](), [platform-engineering](), [platforms](), [security](), [software](), [speed](), [tooling]() ### AI overview This article explains how platform engineering teams can prove the value of an internal developer platform (IDP) to executives. It describes how IDPs reduce developer friction and cognitive load through standardized golden paths, configuration, and tooling; provide guardrails for security, encryption, and least-privilege access; and help organizations manage the effects of AI on engineering work. It recommends measuring velocity indicators such as cycle time and lead time to change, along with AI adoption, impact, and other metrics, to quantify platform performance and guide improvements. ### Source excerpt Learn how to prove the value of platform engineering to executives. This article outlines the essential metrics--from velocity and AI impact to developer sentiment--needed to quantify the success of your Internal Developer Platform (IDP) and keep pace with evolving AI capabilities. ## Identity Security for AI DevFeed: [Identity Security for AI]() Original publisher: [Read original article]() Author: info@goteleport.com (Ben Arent) Published: 2026-07-21T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security for AI](), [Security](), [Artificial Intelligence](), [Authorization]() Tags: [agents](), [ai](), [ai-agents](), [github](), [identity](), [least-privilege](), [llms](), [permissions](), [secrets](), [security](), [security-for-ai]() ### AI overview The article examines identity-security challenges created by AI agents that can act continuously with delegated access. It connects traditional risks such as broad permissions, credential sprawl, insider threats, and long-lived secrets with emerging risks from agents, sub-agents, and LLM capabilities, and advocates delegated, ephemeral, least-privilege access. ### Source excerpt AI agents run 24/7 with the same infrastructure access as your engineers. See how Teleport secures AI with cryptographic identity, audit, and trusted runtimes. ## Least-Privilege AI Agents: Identity & Permissions in Harness DevFeed: [Least-Privilege AI Agents: Identity & Permissions in Harness]() Original publisher: [Read original article]() Author: Shivansh Srivastava Shubham Jindal Published: 2026-07-16T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [AI Agent](), [Authorization](), [Model Context Protocol]() Tags: [agents](), [ai](), [ai-agents](), [authorization](), [least-privilege](), [mcp](), [mcp-gateway](), [security]() ### AI overview Harness describes how its Autonomous Worker Agents use delegated identity, per-run ephemeral tokens, inherited RBAC and OPA policy, least-privilege scope filtering, and server-side MCP gateway tool intersection. The design gives agents a bounded subset of the triggering principal's permissions and removes token access when a run ends. ### Source excerpt How Harness scopes AI Worker Agent access with delegated identity, ephemeral tokens, RBAC, OPA policy, and the MCP gateway tool, enforced server-side. | Blog ## Kubernetes for Agentic AI: Best Practices for Identity and Access DevFeed: [Kubernetes for Agentic AI: Best Practices for Identity and Access]() Original publisher: [Read original article]() Author: info@goteleport.com (Boris Kurktchiev, Megan Moore) Published: 2026-07-07T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Artificial Intelligence](), [Kubernetes](), [Authentication](), [audit](), [SPIFFE](), [OpenID connect (OIDC)](), [Cloud Native Ecosystem]() Tags: [agent-identity](), [agentic-ai](), [audit](), [cloud-native](), [identity](), [kubernetes](), [least-privilege](), [oidc](), [spiffe](), [technical]() ### AI overview This article explains when autonomous or long-running agents in Kubernetes need distinct workload identities instead of inheriting a user's identity. It recommends least-privilege access, short-lived credentials, re-authentication for sensitive actions, network enforcement, and auditability. ### Source excerpt When agents act autonomously beyond a user's session, they need their own identity, least-privilege access, and full audit trails. ## DataAgents: How we turned 9 months of analysis into 10 days DevFeed: [DataAgents: How we turned 9 months of analysis into 10 days]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-06-09T22:42:18Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [Cloud](), [AI Agent](), [Amazon Web Services](), [Azure](), [Google Cloud Platform (GCP)](), [data]() Tags: [agentic-ai](), [ai](), [aws](), [azure](), [cloud](), [cloud-platform](), [data-analysis](), [false-positives](), [gcp](), [least-privilege](), [security]() ### AI overview This engineering deep dive describes the DataAgents pattern for analyzing heterogeneous cloud resources at scale. It focuses on cloud resource dormancy detection across AWS, Azure, and Google Cloud Platform, using entity-specific criteria, confidence-based prioritization, and documented reasoning. The article reports reducing the analysis effort from an estimated 6-9 months to 10 days. ### Source excerpt An engineering deep dive into the pattern that changed how we approach large-scale classification problems. Every engineering team has that project sitting in the backlog. The one where someone says, "We really should analyze all of these," and the room goes quiet. Everyone knows what "all of these" means -- hundreds of entities, complex rules, no clear starting point. For us, it was cloud resource dormancy detection. We had around 350 distinct cloud resource types spread across AWS, Azure and Google Cloud Platform (GCP). Each type has different behavior patterns. An EC2 instance sitting idle looks nothing like a dormant Amazon S3 (S3) bucket or an unattached Elastic IP. Detecting dormancy required understanding what "active" means for each specific resource, then writing detection logic that wouldn't flood operations teams with false positives. Traditional estimate: 6-9 months of expert analysis. Actual time: 10 days. Here's how we did it, and more importantly, here's the reusable pattern behind it. The problem with large-scale analysis: Before we get to the solution, it's worth naming the pattern that makes these projects so painful. It shows up everywhere: Cloud resources - Which of our 350 resource types are dormant? Data governance - Which of our 800 tables have quality issues we should monitor? Security - Which of our access entitlements violate least-privilege principles? Compliance - Which of our 500 policy controls need remediation? In every case, the structure is similar -- a large catalog of heterogeneous entities, entity-specific rules that don't generalize, unknown priorities and a high cost for getting it wrong. The traditional approach is not just slow. It's structurally limited. You get coverage of the "obvious" cases, inconsistent logic across analysts, and tribal knowledge that evaporates when people leave. What you need is something that can assess each entity, apply consistent criteria, prioritize by confidence and document its reasoning. The DataA ## Modernizing Administrative Access for CMMC Level 2 DevFeed: [Modernizing Administrative Access for CMMC Level 2]() Original publisher: [Read original article]() Author: info@goteleport.com (Nicolas Morris) Published: 2026-05-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Access Control](), [IAM](), [Cloud](), [ssh](), [remote access](), [Virtual Private Network](), [Kubernetes]() Tags: [access-control](), [audit](), [cloud](), [cmmc](), [governance](), [iam](), [kubernetes](), [least-privilege](), [remote-access](), [ssh](), [visibility](), [vpn]() ### AI overview The article discusses administrative access challenges faced by organizations pursuing CMMC Level 2 readiness. It describes fragmented access across VPNs, local accounts, static SSH keys, cloud IAM, and disconnected authentication workflows, and presents Teleport as an identity-native approach to centralize governance, reduce standing privileges, and improve audit readiness. ### Source excerpt Defense contractors pursuing CMMC Level 2 face persistent AC, IA, and AU findings. Coalfire outlines how Teleport addresses the enforcement and audit gaps assessors require. ## Kubernetes for Agentic AI: Best Practices for Security and Observability DevFeed: [Kubernetes for Agentic AI: Best Practices for Security and Observability]() Original publisher: [Read original article]() Author: info@goteleport.com (Boris Kurktchiev, Jack Pitts) Published: 2026-04-01T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Kubernetes](), [Security](), [observability](), [Containers](), [Availability](), [AI Platform]() Tags: [availability](), [container](), [kubernetes](), [kubernetes-security](), [least-privilege](), [monitoring](), [network-segmentation](), [observability](), [permissions](), [recommendations](), [security]() ### AI overview This article presents 18 Kubernetes best practices for securing and monitoring containerized agentic AI workloads. It emphasizes foundational controls such as least privilege, access control, network policies, image assurance, network segmentation, and continuous monitoring, while noting that many practices also apply to other containerized and serverless environments. ### Source excerpt Discover 18 Kubernetes security, observability, and availability best practices for container-based agentic workloads. ## What is Infrastructure from Code? DevFeed: [What is Infrastructure from Code?]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Encore Updates]() Topics: [Code](), [Cloud](), [Artificial Intelligence](), [Terraform](), [Databases](), [AWS IAM](), [Caching](), [Amazon Simple Queue Service (SQS)]() Tags: [ai](), [ai-agents](), [aws](), [caching](), [cloud](), [code](), [database](), [infrastructure](), [least-privilege](), [message-queue](), [terraform]() ### AI overview The article explains Infrastructure from Code (IFC), an approach that declares infrastructure such as databases, queues, and scheduled jobs in application code. It describes how frameworks derive cloud resources from those declarations and argues that AI-generated application changes have increased the need to keep infrastructure synchronized. ### Source excerpt How it works, why AI made it urgent, and what the trade-offs are. ## Zero Trust Architecture: From Perimeter Walls to "Never Trust, Always Verify" DevFeed: [Zero Trust Architecture: From Perimeter Walls to "Never Trust, Always Verify"]() Original publisher: [Read original article]() Author: hello@ankit-rana.com Published: 2026-03-16T00:00:00Z Content type: tutorial Language: en Sources: [Ankit Rana | Mechanical Sympathy]() Topics: [Zero Trust](), [Architecture & Design](), [Encryption](), [least privilege](), [zero trust network access](), [Authentication](), [Authorization](), [Monitoring](), [Network]() Tags: [architecture](), [authentication](), [cloud](), [encryption](), [identity-and-access](), [least-privilege](), [monitoring](), [network](), [network-security](), [observability](), [security](), [security-architecture](), [zero-trust](), [zero-trust-network-access](), [ztna]() ### AI overview This article explains Zero Trust Architecture as a security model that assumes the network may already be compromised. It contrasts Zero Trust with perimeter security and describes explicit verification, contextual authorization, least privilege, encryption, segmentation, and continuous monitoring. It also distinguishes the broader ZTA model from Zero Trust Network Access (ZTNA). ### Source excerpt Zero Trust starts from the assumption that the network is already compromised, so every request is authenticated, authorised, and encrypted regardless of where it originates. It rests on explicit verification, least privilege, micro-segmentation, continuous monitoring, and encryption everywhere. It is an architectural direction, not a product you buy. ## Secure access at the speed of incident response DevFeed: [Secure access at the speed of incident response]() Original publisher: [Read original article]() Author: Brian Hanson Published: 2026-02-24T22:44:00Z Content type: article Language: en Sources: [The incident.io Blog]() Topics: [incident](), [Incident response](), [Authorization](), [Provisioning](), [Security]() Tags: [cloud](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [integration](), [least-privilege](), [on-call](), [outage](), [post-mortem](), [provisioning](), [security](), [slack-incident](), [speed](), [workflow]() ### AI overview The article announces an integration between incident.io and Apono that gives on-call engineers just-in-time, least-privilege access during incidents. Access is dynamically provisioned and revoked through the incident response workflow, reducing approval delays while maintaining security. ### Source excerpt Blog about combining incident.io's incident context with Apono's dynamic provisioning, the new integration ensures secure, just-in-time access for on-call engineers, thereby speeding up incident response and enhancing security. ## Secure AI Agent Infrastructure with Zero-Code MCP DevFeed: [Secure AI Agent Infrastructure with Zero-Code MCP]() Original publisher: [Read original article]() Author: boris.kurktchiev@goteleport.com (Boris Kurktchiev) Published: 2025-12-16T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Security](), [Model Context Protocol](), [AI Agent](), [Authorization](), [MCP Server]() Tags: [ai-agent](), [ai-security](), [auditability](), [authorization](), [least-privilege](), [mcp]() ### AI overview This tutorial explains how Teleport's zero-code MCP integration can secure AI agent infrastructure without writing authorization code or rewriting MCP servers. It describes MCP's role in connecting LLM-based applications to external systems and highlights authorization boundaries, least privilege, just-in-time access, and auditability. ### Source excerpt Secure AI agent workflows without writing authorization code. Teleport delivers least privilege, just-in-time access, and identity auditability for MCP agents. ## Moving Beyond Terraform CDK: Encore's Infrastructure-from-Code Approach DevFeed: [Moving Beyond Terraform CDK: Encore's Infrastructure-from-Code Approach]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2025-12-11T00:00:00Z Content type: comparison Language: en Sources: [Encore Updates]() Topics: [Terraform](), [Code](), [Amazon Web Services](), [Deployment](), [Self-hosted](), [Database]() Tags: [aws](), [code](), [deployment](), [gcp](), [high-availability](), [infrastructure](), [least-privilege](), [postgresql](), [security](), [self-hosting](), [terraform]() ### AI overview The article discusses Terraform CDK's sunset and explains Encore's infrastructure-from-code approach. Encore embeds infrastructure declarations in application code, provisions resources through AWS or GCP APIs, and supports Docker-based self-hosting. ### Source excerpt How infrastructure-from-code works when infrastructure declarations are part of your application ## Securing AI agents and tool calls DevFeed: [Securing AI agents and tool calls]() Original publisher: [Read original article]() Author: Alexander Nohe Published: 2025-12-02T19:00:00Z Content type: tutorial Language: en Sources: [Firebase Blog]() Topics: [Securing AI](), [prompt injection](), [AI Agent](), [Loop Engineering](), [App]() Tags: [agentic](), [ai](), [ai-agent](), [app-check](), [authentication](), [firebase](), [genkit](), [go](), [least-privilege](), [prompt](), [prompt-injection](), [securing-ai]() ### AI overview This article explains how prompt injection can manipulate AI agent tool calls to access unauthorized user data. It recommends using application context and least-privilege access when designing tool definitions. ### Source excerpt Beyond authentication: Learn how to secure your AI agent's tool calls from prompt injection by using application context and the principle of least privilege. ## Immediate, Automated, Compliant Access Enforcement with Teleport JIT Watcher DevFeed: [Immediate, Automated, Compliant Access Enforcement with Teleport JIT Watcher]() Original publisher: [Read original article]() Author: dan.johns@goteleport.com (Dan Johns) Published: 2025-08-29T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [JIT](), [Security](), [Monitoring](), [DevOps](), [API](), [Go]() Tags: [api](), [devops](), [go](), [jit](), [least-privilege](), [monitoring](), [policies](), [security]() ### AI overview This article presents a Go-based Teleport JIT Watcher that continuously enforces just-in-time access policies. It connects to Teleport's gRPC API using Machine ID, reviews access requests every 30 seconds, automatically approves compliant requests, denies policy violations, and locks old requests to limit access accumulation. ### Source excerpt Immediate, Automated, Compliant Access Enforcement with Teleport JIT Watcher A common request we hear at Teleport is for immediate Just-in-Time (JIT) access. Users shouldn't have standing access to resources, but they do need an audited escalation and approval process they can personally execute when access is required. This raises an important challenge: how do we ensure users only access the resources they truly need, without creating access sprawl or slowing teams down? ## 5 Ways to Keep AWS Fast with Just-in-Time Access DevFeed: [5 Ways to Keep AWS Fast with Just-in-Time Access]() Original publisher: [Read original article]() Author: jpitts@goteleport.com (Jack Pitts) Published: 2025-08-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Amazon Web Services](), [JIT](), [Amazon Elastic Kubernetes Service](), [AWS IAM](), [audit trail](), [Security](), [Amazon EC2](), [AI Agent](), [Amazon Bedrock](), [CI/CD](), [Amazon DocumentDB](), [PostgreSQL]() Tags: [ai-agent](), [amazon-bedrock](), [amazon-rds](), [audit-trail](), [aws](), [aws-iam](), [ci-cd](), [jit](), [least-privilege](), [postgresql](), [security]() ### AI overview This article explains how Teleport's just-in-time access model can help govern fast-moving AWS environments. It describes ephemeral, policy-defined privileges for humans, machines, and AI agents, with least-privilege controls, approvals, expirations, and audit visibility across use cases including EKS, EC2, AWS Console, CI/CD, and AI access. ### Source excerpt Learn how just-in-time access accelerates EKS, EC2, AWS Console, CI/CD, and AI access while eliminating standing privileges and ensuring full audit visibility. ## Securing Model Context Protocol (MCP) with Teleport and AWS DevFeed: [Securing Model Context Protocol (MCP) with Teleport and AWS]() Original publisher: [Read original article]() Author: info@goteleport.com (Boris Kurktchiev, Dylan Souvage (AWS), Thierno Diallo (AWS)) Published: 2025-07-11T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Model Context Protocol](), [Amazon Web Services](), [anthropic](), [Amazon Bedrock](), [Strands Agents]() Tags: [agentic-ai](), [ai-agents](), [amazon-bedrock](), [anthropic](), [auditability](), [aws](), [credentials](), [how-to](), [implement](), [least-privilege](), [mcp](), [model-context-protocol](), [security]() ### AI overview This tutorial explains how to secure Anthropic's Model Context Protocol for enterprise AI agents using Teleport and AWS. It discusses least-privilege access, credential management, auditability, and behavioral visibility for MCP-based systems. ### Source excerpt Discover how to implement Anthropic's MCP for AI agents with Teleport and AWS. Eliminate static credentials, enforce least privilege, and ensure AI auditability. ## Microauthorization: Why Microservices can be Great for Security Hygiene DevFeed: [Microauthorization: Why Microservices can be Great for Security Hygiene]() Original publisher: [Read original article]() Published: 2025-05-08T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Architecture & Design](), [microservices architecture](), [Security](), [Authorization](), [IAM]() Tags: [architecture](), [authorization](), [container-security](), [iam](), [least-privilege](), [microauthorization](), [microservices](), [remote-code-execution](), [security]() ### AI overview The article argues that decomposing monolithic applications into microservices can improve security hygiene by isolating processes and assigning each service a distinct identity with narrower IAM capabilities. It explains that service-to-service authorization can limit the blast radius of a breach, although attackers may still need to move laterally across services. ### Source excerpt Microservices can enable you to easily independently roll out services, but they can also provide security benefits. Learn more with Chainguard CTO Matt Moore. [Next page]()