March 2026 Summaries

As the 2026 conference season commences, the RSAC and KubeCon events are set to take place simultaneously, highlighting the convergence of security and platform engineering discussions with a strong focus on artificial intelligence (AI). Both conferences are emphasizing authorization as a crucial component for AI, particularly agentic AI, due to the significant barriers posed by security, data privacy, compliance, and regulatory challenges, as outlined in Omdia's report on enterprise AI project failures. With AI recognized as essential and heavily invested in, the need for securing AI projects to prevent breaches and legal issues is critical for their success. Notable sessions at RSAC are expected to cover AI governance and security frameworks such as Forrester's AEGIS for managing agentic AI, alongside discussions on securing the MCP protocol. Networking opportunities at these events offer a chance for professionals to engage with peers and discuss emerging challenges and solutions in AI and security.

AI agents are challenging traditional access control systems due to their autonomous and high-volume data interactions, which most existing permissions infrastructures weren't designed to handle, leading to stalled AI projects. Companies are modernizing applications with AI, compressing development timelines, but the underlying permissions infrastructure has not kept pace, causing a gap that stalls AI initiatives. AuthZed offers a solution with an authorization platform that accommodates the complexities of AI systems, enabling faster deployment and secure data access. This platform integrates with tools like LangChain and Pinecone to ensure authorization is part of the retrieval process, allowing companies like OpenAI and Workday to run AI applications efficiently in production. SpiceDB Community Day highlights practical solutions and innovations in AI and authorization, featuring sessions on permission-aware testing and the challenges of agentic search.

In 2025, AI technologies like RAG pipelines and LLM-powered agents became prevalent across companies, with LangChain emerging as a leading framework for building AI applications. A significant challenge in this landscape is managing authorization, as traditional Role-Based Access Control (RBAC) methods struggle with the complexity of nested and inherited permissions. The newly announced LangChain-SpiceDB integration addresses this issue by incorporating Relationship-Based Access Control (ReBAC), a model popularized by Google's Zanzibar paper, which focuses on user-resource relationships for precise permission checks. SpiceDB, the open-source implementation of Zanzibar, offers scalable, low-latency authorization checks suitable for AI and RAG applications. The langchain-spicedb library enhances LangChain workflows by ensuring that AI applications respect user permissions, preventing unauthorized data access. This integration offers various components such as SpiceDBAuthFilter, SpiceDBRetriever, create_auth_node for LangGraph workflows, and SpiceDBPermissionTool for LLM agents, each designed to ensure secure data handling while maintaining efficiency. This development underscores the importance of robust authorization in AI systems, providing a comprehensive solution for managing sensitive data access.

LangChain's integration with SpiceDB addresses the complex challenge of authorization in AI-driven applications, particularly in Retrieval-Augmented Generation (RAG) pipelines. While LangChain has become a popular framework for building AI applications, it does not inherently solve authorization issues, which are crucial when users access sensitive information through AI agents. Traditional Role-Based Access Control (RBAC) is insufficient for complex scenarios where access depends on specific user-document relationships. SpiceDB, based on Google's Zanzibar authorization model, offers a more nuanced Relationship-Based Access Control (ReBAC) that ensures permissions are assessed based on user relationships to resources. The newly introduced langchain-spicedb library seamlessly incorporates this authorization model into LangChain workflows, ensuring that AI applications respect user permissions by filtering document access post-retrieval but before language models process the information. This approach is crucial for maintaining data security and privacy in AI applications that handle dynamic and sensitive documents, encouraging industries to adapt robust authorization measures beyond traditional web applications.

AuthZed Cloud has introduced a self-service capability for customers to independently scale their operations by using the new Datastore Overview page, which provides insights into the configuration, performance, and health of the datastore that underpins their SpiceDB permission systems. This enhancement allows customers to evaluate and modify their data storage resources without relying heavily on AuthZed's support teams, fostering operational transparency and independence. The decision to offer such transparency reflects customer feedback emphasizing the need for a deeper understanding of the infrastructure and the trade-offs involved in their deployments. As part of their commitment to improving user autonomy, AuthZed plans to continue rolling out additional self-service features to their platform.