April 2026 Summaries

Jake Moshenko, CEO of AuthZed, predicts that Agentic Retrieval-Augmented Generation (RAG) will become the standard approach in enterprise applications as AI agents are increasingly adopted. A blog post demonstrates how to construct an Agentic RAG system using AuthZed Cloud, highlighting the complexities of real-world document sharing and the inefficiency of traditional role-based access control systems. The demo employs Weaviate as a vector database, the OpenAI API for language model processing, and LangChain-SpiceDB integration for fine-grained permissions, with SpiceDB ensuring deterministic authorization checks. The system's architecture incorporates a four-node LangGraph pipeline where the authorization process is integral and cannot be bypassed, demonstrating the importance of robust access control in AI systems to prevent security breaches. SpiceDB's minimal schema facilitates department-based access, cross-department grants, and public documents, and its CheckBulkPermissions API efficiently handles multiple permission checks. The blog underscores the importance of not relying on the client-side for access control, especially with AI agents, and invites users to explore AuthZed Cloud for scalable authorization infrastructure.

Composable schemas have been made generally available in SpiceDB 1.51.1, offering a modular approach to managing large schemas by breaking them into reusable components, which facilitates faster, safer, and more scalable development workflows. This new feature allows organizations and the open-source community to design reusable data models for common problems and simplifies authorization management by preventing schemas from becoming monolithic. Significant updates have been made to the schema compiler and Language Server Protocol to make them filesystem-aware, enhancing error handling and developer experience in tools like the Zed CLI and VS Code extension. These tools now support composable schemas, allowing for more efficient validation and navigation across multiple files, although the Playground currently does not support the import syntax due to its single-editor design. The SpiceDB community is thanked for their support and feedback, which contributed to the refinement of this feature.

AuthZed addresses emerging issues with AI coding agents, such as excessive permissions and inadequate access control in generated code, by introducing two open-source tools: SpiceBox and spicedb-dev. SpiceBox enhances security by wrapping AI agents like Claude Code with fine-grained permission enforcement using SpiceDB, allowing developers to define explicit permissions for reading, writing, and network requests, thereby preventing unauthorized actions. Meanwhile, spicedb-dev integrates authorization expertise into the coding process by providing a plugin for Claude Code that automates the implementation of permission checks and relationship writes in generated applications. This approach aims to improve the security posture of AI-generated applications by embedding proper access control from the outset and ensuring that developers are continually attentive to authorization needs throughout the development process. Both tools are designed to meet developers where they are currently working with AI coding tools, bringing AuthZed's expertise in fine-grained access control directly into the coding workflow.

At the recent RSAC conference, discussions focused on securing Agentic AI, which presents both transformative opportunities and significant risks, yet solutions remain unclear. The conversation highlighted a misconception about Identity and Access Management (IAM), emphasizing that authentication and authorization are distinct disciplines with unique challenges. Authentication involves verifying identities, but its complexity ensures it will never be fully resolved, necessitating multiple systems to handle new patterns and regulations. Authorization, however, deals with what actions can be performed once identity is established, and it faces challenges related to latency and the diverse needs of various organizational stakeholders. The core issue with Agentic AI is not identity management but the governance of agents once they access systems, requiring innovative authorization strategies beyond traditional Role-Based Access Control (RBAC) to accommodate non-deterministic agents making real-time decisions.

The Technical Skills Panel at Authzed is designed to evaluate a candidate's engineering thinking and problem-solving approach in real-time, focusing on systems over syntax rather than rote memorization of code. Candidates are expected to collaborate with engineers to tackle practical challenges similar to those encountered in scaling distributed systems, emphasizing the importance of architectural intuition, understanding trade-offs, and navigating ambiguous requirements. With the rise of AI coding agents lowering the cost of generating syntax, the panel values candidates who can direct tools effectively and relate technical solutions to broader business contexts. Preparation involves strengthening core engineering fundamentals, analyzing real systems for scalability, practicing open-ended problem-solving, and clearly articulating thought processes. During the interview, candidates are encouraged to drive the conversation, structure their responses, and delve into technical details, showcasing their ability to manage real-world constraints and complexities.

AuthZed is seeking engineers who excel in distributed systems, open-source projects, and the fast-paced environment of startups, valuing not only technical proficiency but also cultural fit. Their interview process is structured around three pillars: the Background Panel, the Technical Skills Panel, and the Culture Panel, with the current focus on the Background Panel. This involves a comprehensive review of a candidate's past experiences and technical decisions, emphasizing high agency and ownership, pragmatic perfectionism, and exceptional communication skills. Candidates are expected to participate in a collaborative session with two engineers, discussing their resume and detailing significant projects, highlighting their problem-solving abilities and technical ownership. Preparation involves reviewing past architectures, employing structured storytelling methods like STAR, and being candid about challenges and learning experiences. The goal is to gauge the candidate's ability to navigate complex technical issues and their growth as a professional. Future posts will explore the other two pillars of their interview process.