October 2026 Summaries

AuthZed has open-sourced Open Agent Primitives (OAP), a modular platform for building enterprise AI agents with authorization controls that are enforced independently of model behavior. Developed from the company’s experience running internal agents, OAP supports granular permissions, separate agent identities, team collaboration, configurable infrastructure components, and auditable operations. As an example, AuthZed built a self-hosted marketing design agent that uses approved brand repositories, design skills, and versioned feedback to generate and revise HTML pages without requiring new platform code. The agent is restricted to read-only access to selected GitHub repositories, operates in a sandboxed environment, attributes feedback to authorized reviewers, renders generated artifacts safely, and preserves immutable revisions and signed audit logs. OAP is released alongside conceptual Agent Primitives definitions, working deployment defaults, example agents, and tutorials for organizations that want to build agents using their own models, infrastructure, and security policies.

Federated authorization addresses the challenge of enforcing fine-grained access controls when organizations use incompatible identity providers, such as Keycloak and GitHub OAuth, without requiring disruptive identity migrations. The proposed approach uses SpiceDB to map each external account, identified by immutable provider-specific IDs such as OIDC subject claims or GitHub numeric IDs, to an organization-controlled internal user identity, while documents and permissions reference only that unified internal model. A relationship-based schema defines document ownership, editing, viewing, and sharing permissions, which SpiceDB evaluates through APIs for individual and bulk permission checks, accessible-resource lookups, relationship writes, and grant revocations. The design recommends avoiding email addresses as identifiers, treating accounts from different providers as distinct unless explicitly bound, using read-your-writes consistency tokens where needed, and reserving raw relationship reads for displaying specific grants rather than making access decisions. In production, persistent datastores and managed services such as AuthZed Cloud can provide scalable deployment, audit logging, least-privilege service access, and operational management while retaining the same authorization model.