How to give AI agents real access without handing them the keys: breaches read as containment problems, least agency in practice, and fixes you can ship on your own server.
Latest post, topic: Least agency
Your agent works in staging and security keeps sending it back. Nine questions they ask, the weak answers, the strong ones, and the evidence to bring.
Topic: Identity
From 10 December 2026 your privacy policy must disclose automated decisions. The hard part is the register behind it. A checklist to start this week.
Topic: Incidents
An autonomous agent ran more than 17,000 actions inside Hugging Face, harvested stored credentials, and moved across internal clusters over a weekend. Here is the breach stage by stage, and what a governed agent layer changes at each one.
Topic: Least agency
Least privilege limits what an agent can reach. Least agency limits how far it can act before it checks back. Here is how to apply it to real agents.
Topic: Credentials
Most MCP servers keep a raw token in the handler and write it straight to the logs. Here is what that costs you, and the three lines of @agentvalet/mcp-broker that fix it.
Topic: Identity
Identity vendors solve authentication for AI agents. ASI03 lives in authorization. Here is the difference and why agents need the second layer.
Topic: Identity
OWASP's 2026 report makes agent identity the control plane. What that means for governing AI agents at runtime, and where most setups stop short.
Topic: Credentials
Handing an AI agent a raw API key gives it permanent, unscoped, unauditable access to your accounts. Here's the risk, and what to do instead.
Every post is also available as plain text at llms-full.txt, or as Markdown by adding .md to its address.
