April 2026 Summaries

The text explores the differences between Monthly Active Users (MAU) and average Daily Active Users (aDAU) as pricing models for identity infrastructure, highlighting how each model impacts billing. MAU measures unique users authenticating at least once in a billing month, which can lead to inflated costs due to spike sensitivity and cost misalignment, as it does not reflect actual usage patterns. In contrast, aDAU averages unique authenticated users per day over the billing period, offering a more accurate reflection of resource consumption and cost alignment. Real-world examples demonstrate how aDAU can significantly reduce costs, especially in applications with variable traffic or low-frequency authentication, by tracking closer to the actual compute load. Industry data indicates that most internet applications fall within a DAU/MAU ratio of 6% to 20%, with aDAU often resulting in substantial savings compared to MAU-based billing. The Ory Network adopts aDAU-based billing, which aligns more closely with authenticated usage and offers predictable costs by consolidating various environments under a single subscription, making it advantageous for applications with high user engagement.

Anthropic's decision to delay the release of its AI model, Claude Mythos, highlights a significant development in the field of cybersecurity as the AI uncovered thousands of zero-day vulnerabilities in major operating systems and web browsers, some of which had been overlooked for decades. This discovery has emphasized the fragility of the global software ecosystem, particularly in identity and access management (IAM) systems, which are often constructed from loosely managed, open-source components. The rapid identification of vulnerabilities by AI presents a new challenge, as remediation processes in many organizations still proceed at a slower, human pace, creating a widening gap between discovery and patching. This situation calls for organizations to prioritize secure IAM infrastructures and seek specialized partners to manage vulnerabilities proactively. Ory offers commercial solutions to address these challenges, providing continuous security patching and expert guidance to reinforce identity infrastructures against the increasing wave of vulnerabilities.

The Keto Playground is a React application designed to help users visualize and understand relationship-based permissions in Ory Keto by rendering permission graphs as interactive directed visualizations. Unlike traditional role-based or attribute-based access controls, relationship-based access control involves creating a graph of relationships between entities to determine permissions. The Keto Playground allows users to explore these graphs in both offline and online modes, offering pre-configured examples to help users model their own use cases before committing to infrastructure. Offline mode enables users to experiment with bundled examples without needing an active Keto instance, while online mode connects to a live Keto instance for real-time testing. The application includes examples such as document access control in a retrieval-augmented generation (RAG) pipeline and a B2B organizational hierarchy, demonstrating how permissions resolve through team memberships and hierarchical structures. Additional examples cover various scenarios like bank account management, healthcare records access, SaaS feature gating, and content publishing workflows, all editable in offline mode. Users can explore, edit, and even share models they create by submitting them as pull requests to the repository.

The text discusses the challenges of securing agentic applications, particularly focusing on identity and access management issues, as highlighted in a presentation by AI architect Bill McIntyre at a Rocky Mountain AI Interest Group meetup. It emphasizes the need for robust identity and authorization infrastructure to control what AI agents can access and execute, as traditional web app security measures are inadequate for agentic apps that can execute actions beyond just handling data. The presentation outlines different methods by which malicious content can infiltrate Retrieval-Augmented Generation (RAG) systems, such as vector-embedded payloads, full-text attacks, and hidden metadata, while stressing the importance of applying least privilege access principles and treating agents as non-human identities with scoped credentials. It also explores the hierarchical model for managing large-scale agentic systems, where strategic agents direct specialized task agents under human oversight, underlining the necessity of having a human accountable for agent actions. The text concludes by noting the significance of building a foundational identity and access management system from the start of developing agentic architectures to ensure security and accountability.

Ory, a leading provider of Customer Identity and Access Management (CIAM) solutions, has surpassed managing 2.5 billion identities through its open-source, enterprise license, and Ory Network offerings, reflecting a shift towards modern, standards-based CIAM solutions favored by development teams and IT leaders. Ory's infrastructure supports high-traffic websites such as Fandom and OpenAI, with the latter seeing an increase from 100 million to over 800 million weekly active users thanks to Ory's scalable and efficient solutions. The company also helped Axel Springer achieve a 15-fold growth in account registrations by implementing Federated Credential Management, and Fandom relies on Ory to handle massive traffic spikes effectively. Ory's modern architecture is noted for its ability to handle secure, verifiable, and automated identity workflows, a factor that has attracted investment from firms like Insight Partners. With over 45,000 GitHub stars and 700 million downloads, Ory is recognized for its enterprise-grade security and developer-friendly flexibility, serving diverse sectors including financial services, technology, and media.