December 2025 Summaries

AuthZed, a remote-first company focused on improving access control, emphasizes the importance of off-site meetings for fostering team cohesion and enhancing company culture. Despite being globally distributed, AuthZed prioritizes regular gatherings that allow employees to relax, bond, make decisions, and collaborate more effectively. These off-sites lead to improved empathy, communication, and inspiration across the company, as well as a clearer understanding of the organization's history, present status, and future vision. The author reflects on the personal and professional benefits of these gatherings, highlighting their role in reinforcing human connections and encouraging the continual growth of both the company and its employees. Additionally, the author offers their expertise in organizing off-sites for similar businesses, inviting interested parties to reach out for advice.

AI agents are increasingly used in enterprise settings for automation and decision-making, but their autonomous nature introduces security challenges that traditional systems aren't equipped to handle. Communication protocols like the Model Context Protocol (MCP) and Agent-to-Agent (A2A) have been developed to standardize interactions, yet they largely leave authorization as an implementation-specific concern, relying on broad token mechanisms that lack granularity. This can lead to security vulnerabilities such as the Insufficient Granularity of Access Control, privilege persistence, and unauthorized access due to inadequate token management and revocation propagation. The A2A protocol, for example, uses broad JSON-RPC scopes and lacks a defined mechanism for user consent, which can lead to unauthorized data propagation and consent fatigue. While existing protocols recommend best practices for authorization, they do not enforce them, leaving agentic systems potentially unsafe without a centralized authorization layer to manage permissions dynamically and securely.

In 2025, AuthZed focused on expanding its authorization infrastructure to accommodate the growing integration of AI technologies, working with companies like OpenAI and Workday to address the heightened authorization challenges posed by AI applications. The company introduced the Authorization Infrastructure for AI, supporting Retrieval-Augmented Generation pipelines and agentic AI systems, and launched AuthZed Cloud, a self-service, usage-billed permissions system that integrates with major cloud platforms like AWS, Google Cloud, and Azure. AuthZed celebrated its fifth anniversary by highlighting its journey and innovations at an event, emphasizing the importance of authorization infrastructure in the AI era. The SpiceDB project, central to AuthZed's offerings, saw continued development and community engagement, culminating in 20 releases throughout the year. Additionally, AuthZed introduced Dibs, the SpiceDB mascot, and shared a story to promote understanding of authorization concepts, reiterating their mission to improve access control as they look ahead to further advancements in 2026.

The Model Context Protocol (MCP) is designed to connect AI agents with tools, data sources, and APIs, focusing on standardization rather than security, which is left to the implementers. Although MCP includes detailed authentication mechanisms like OAuth 2.1 flows, token validation, and Protected Resource Metadata, it does not dictate the permissions or what authenticated users can do, leaving authorization decisions to those implementing the protocol. This gap has led to security breaches involving unauthorized data access, such as prompt injection attacks and over-privileged token use, underscoring the necessity for precise permission controls. While AI-based detection can aid in identifying anomalies, core authorization decisions must be deterministic to ensure security. As MCP evolves rapidly, with significant backing from major tech companies and a growing ecosystem, the need for adaptable and scalable authorization infrastructures becomes critical. This includes treating agents and tools as first-class subjects and ensuring permissions are reevaluated at every execution to prevent unauthorized data access.