AI Security . AI Architect · Cloud Native Engineer

The Danger of Standing Tokens: Moving to Ephemeral, Scoped Access Paths for AI Tools The Danger of Standing Tokens: Moving to Ephemeral, Scoped Access Paths for AI Tools Date: 12 November 2026 Executive Summary AI tools increasingly act across source repositories, ticketing systems, cloud platforms, internal APIs, and production workflows. When these tools use long-lived API keys, shared service accounts, or broadly privileged tokens, a single prompt injection, compromised integration, or leaked secret can become a persistent path into the enterprise. The security decision is straightforward: treat every AI tool call as a high-risk, policy-controlled access request rather than as a trusted internal operation. Replace standing credentials with short-lived, narrowly scoped authorization, enforce policy at the tool boundary, and produce an audit record that connects the human request, model decision, tool invocation, identity, and result. Contents Architecture and Th...

The first authorization check is often the least important one. A user asks an agent to update a supplier record. The request is approved. The agent has permission to read the supplier system and write changes. Then the plan changes. The agent decides it needs to export related payment details, call a second system, or update several records instead of one. The original authorization may still be technically valid, but it no longer represents what the agent is about to do. That is the failure mode: authorization gets attached to the conversation, while risk changes with every new action. A hypothetical failure Imagine an internal procurement agent asked to correct a supplier's address. Its first plan is simple: Find the supplier record. Update the address. Confirm the change. The agent cannot find the supplier using the provided name. It revises the plan: Search invoices for a matching company name. Read payment records to confirm the identity. Update the supplier ...

🤖 Top Agentic AI, AI Agents & Governance Articles Your twice-weekly roundup of the latest in Agentic AI , AI agents , and agent access, permission, governance & audit — covering agent frameworks, MCP/tool-use, agent identity, non-human access control, AI governance and agent security. JioStar’s chief architect on AI discovery at 500M-user scale Source : OpenAI News JioStar’s Vijay Seshadri explains AI discovery at 500M-user scale. Read his lessons on evals, guardrails, and taking AI into production. Cogent and OpenAI build cyber defense factories for enterprises Source : OpenAI News Cogent combines OpenAI models with enterprise context to help automatically remediate vulnerabilities with agents. Introducing AlphaProof Code: a breakthrough in verifying complex software at depth Source : Google DeepMind ...

Context-Bound Gateways: Making Dynamic Allow/Disallow Authorization Decisions at Runtime Date: 11 November 2026 Context-Bound Gateways: Making Dynamic Allow/Disallow Authorization Decisions at Runtime Executive Summary AI systems increasingly act through tools: they query databases, call APIs, modify records, send messages, and trigger business workflows. A static permission model cannot reliably decide whether every action is safe because the answer depends on runtime context. The security decision is whether an action should be allowed, denied, or sent for additional review based on the identity, tool, data, request purpose, session state, risk signals, and requested operation. Organizations deploying capable AI agents should place a policy enforcement gateway between the agent and sensitive tools. That gateway should evaluate each material action at runtime, produce a decision that the tool can enforce, and record enough evidence for investigation an...