June 2026 Summaries

Ory's Enterprise Helm Charts are designed to streamline the deployment and operation of Identity and Access Management (IAM) platforms on Kubernetes, addressing the complexities often encountered in production environments. These charts offer a declarative framework that incorporates best practices for operational resiliency, including replica strategies, autoscaling, load balancing, and monitoring configurations, ensuring the system's availability and resilience. Unlike generic open-source charts, the enterprise version provides production-oriented defaults that reduce manual configuration efforts and improve security by continuously integrating updates to address vulnerabilities. By embedding operational knowledge directly into the deployment layer, Ory Enterprise Helm Charts facilitate easier scaling, monitoring, and management of IAM systems, thus enabling teams to focus on aligning deployments with their specific infrastructure and risk requirements. This approach is particularly beneficial for teams already self-hosting Ory, as it simplifies the migration process by adapting to the intricacies of their existing production setups.

Token lifecycle management in OAuth 2.0 is critical for maintaining security across systems by governing the issuance, validation, refresh, and revocation of access, refresh, and ID tokens. Misconfigurations can lead to significant vulnerabilities, such as allowing stolen credentials to remain valid or failing to log users out effectively. The process involves five stages: issuance, validation, refresh, expiration, and revocation, each with distinct security implications. Access tokens should have short lifetimes, while refresh tokens should rotate upon each use to enable theft detection and ensure security. Compliance with regulations like GDPR, HIPAA, and SOX influences token lifecycle policies, requiring detailed audit logs for issuance, refresh, and revocation events. Using both opaque and JWT tokens helps balance immediate revocability and stateless validation, with introspection providing real-time awareness of revoked tokens. Implementing standards like RFC 7009 for revocation and RFC 7662 for introspection is vital, and a dedicated OAuth 2.0 authorization server can centralize lifecycle management, reducing application code complexity and ensuring compliance.

AI skills are reshaping the concept of software trust, as highlighted by Air's experiment demonstrating how malicious content can be delivered through seemingly benign AI skills. Traditional security models, which rely on static scanning of packages, are inadequate for this new challenge, as these skills can reference external documentation that may later be altered to execute harmful actions. Ory Agent Security addresses this issue by incorporating identity, authorization, and governance controls directly into the AI agent's runtime environment, thereby moving the control point from external scanning to internal decision-making. This approach ensures that each agent action is subject to real-time policy checks, preventing unauthorized operations even if an agent is influenced by malicious external instructions. Ory’s solution emphasizes continuous audit and runtime authorization, offering a framework for understanding and controlling agent actions while maintaining a separation between agent and human user identities, thus providing a more robust defense against evolving security threats.

In the discourse surrounding access control models, framing Role-Based Access Control (RBAC) versus Attribute-Based Access Control (ABAC) as a binary choice overlooks the practical hybrid approaches deployed in most production systems. While RBAC is valued for its simplicity and ease of auditability, it can suffer from role explosion as organizations grow, necessitating a shift to ABAC for more granular and context-aware access management. However, ABAC introduces its own complexities and is particularly suited for compliance-heavy environments requiring fine-grained access decisions. Most mature systems employ a hybrid model, using RBAC for broad access boundaries and ABAC for detailed, dynamic policies. Additionally, Relationship-Based Access Control (ReBAC) is gaining traction for addressing hierarchical and collaborative scenarios, as demonstrated by Google's Zanzibar model. The decision on which model to implement should consider the complexity of access requirements, the rate of change in those requirements, and compliance obligations, with many systems eventually integrating all three models to meet evolving needs effectively.

Cloudflare's decision to implement OAuth for all its users involved leveraging Ory Hydra, an established OAuth 2.0 and OpenID Connect server, rather than developing an identity engine from scratch. As Cloudflare's platform expanded to support 20% of the web, the company needed to enhance its infrastructure to accommodate this growth without disrupting service. The migration to Ory Hydra 2.X demonstrated notable improvements, including a 45% reduction in API response times and significant decreases in memory and CPU usage, achieved through a blue-green deployment strategy and a Cloudflare Queues-backed replay system. Ory Hydra, rooted in open source and designed for scale, has proven its reliability and capability to handle substantial authentication workloads, as evidenced by its use in high-demand environments like OpenAI. This transformation illustrates the maturity of identity infrastructure capable of supporting global-scale enterprises without compromising on security or performance.

The concept of Identity and Access Management (IAM) is encapsulated within four crucial pillars: Authentication, Authorization, Identity Administration, and Federation/SSO, which collectively ensure that the right individuals have appropriate access to resources. Authentication involves verifying user identities, often through methods like MFA or passkeys, while Authorization determines what authenticated users can do, emphasizing least privilege and zero trust principles. Identity Administration focuses on managing user identities across their lifecycle, from provisioning to deprovisioning, to maintain compliance and security. Federation and SSO facilitate seamless access across multiple systems, leveraging protocols such as OAuth/OIDC and SAML. These pillars are interdependent, creating a structured framework that aids organizations in auditing existing IAM systems, identifying gaps, and making informed build-versus-buy decisions. This framework is adaptable to both workforce IAM and Customer IAM (CIAM), where it supports consumer-facing applications by optimizing conversion without compromising security. Each pillar can be implemented using open-source tools, like those offered by Ory, which provide versatile, non-monolithic solutions that integrate seamlessly into existing IAM architectures. The effective management of these pillars is essential for maintaining security, compliance, and operational efficiency in modern cloud-native and zero-trust environments, while also accommodating emerging needs such as agentic AI and non-human identities.

OAuth and SAML, often mistakenly compared as alternatives, actually serve different functions within identity architecture, with OAuth being an authorization framework and SAML an authentication protocol. The article clarifies the distinction, emphasizing that OAuth facilitates delegated access to resources without sharing user credentials, while SAML provides federated authentication for enterprise Single Sign-On (SSO). OpenID Connect (OIDC) is highlighted as an essential extension of OAuth that introduces an authentication layer, making it suitable for modern applications, and is frequently compared with SAML rather than OAuth alone. The guide explores their key differences, including token formats, primary use cases, implementation complexities, and support for modern app architectures. It underscores the importance of understanding when to employ SAML for enterprise SSO needs and OAuth/OIDC for API access and consumer-facing applications. Furthermore, it explains that the two protocols can coexist in a hybrid identity stack, each handling different aspects of authentication and authorization, as illustrated by real-world examples such as Microsoft's ecosystem.

Authorization and authentication are distinct processes often confused in discussions and documentation, leading to vulnerabilities such as broken access control, a top web application threat. Authentication verifies the identity of a user, service, or device, generating an identity claim that is then used as input for authorization, which determines what actions or resources the verified entity can access. These processes must be executed sequentially, with authentication preceding authorization, to ensure security and proper access control. Open-source tools help separate and manage these concerns effectively, reducing the risk of security flaws. Authentication methods include passwords, multi-factor authentication, and passkeys, while authorization models involve role-based, attribute-based, and relationship-based access controls. Properly architecting these processes separately ensures scalability, security, and flexibility in managing access policies, and using dedicated tools rather than monolithic systems is beneficial for optimization and compliance. Open-source solutions like Ory Kratos for authentication and Ory Keto for authorization provide customizable, scalable infrastructure, avoiding vendor lock-in and high costs associated with managed SaaS platforms.

AI agents are increasingly using static API keys for making API calls on behalf of users, but this approach poses significant security risks due to their permanent nature and broad permissions, leading to vulnerabilities associated with leaked keys and compromised systems. Ory Talos addresses these challenges by offering a security-hardened solution that combines the simplicity of API keys with the stringent requirements of enterprise security. It introduces innovations such as token derivation for generating short-lived child tokens, Macaroon-based chained delegation for dynamic permissions, and IP whitelists with time-to-live expirations to enforce zero-trust boundaries. These features minimize the risks associated with static credentials by ensuring that any leaked or intercepted tokens are quickly rendered useless and limiting the blast radius of potential security breaches. Additionally, Ory Talos benefits machine-to-machine communications with high-throughput security and offline token verification, offering flexible deployment options through open-source, enterprise, and SaaS models, thereby maintaining familiar workflows for developers while enhancing security protocols.

Ory Network has implemented a new rate limit system designed to address the limitations of the previous flat model, which grouped all API operations into a single pool, often leading to issues when different operations interfered with each other. The new system, introduced in phases starting June 15, 2026, categorizes API operations into separate buckets based on service, access level, and cost, allowing for more precise control and preventing one type of operation from affecting others. Each bucket enforces both burst and sustained thresholds, with limits adjusted according to subscription tier and project environment, ensuring that customers have adequate headroom for their specific needs. The limits were determined by analyzing five months of production traffic, and exceptions have been created for customers whose usage exceeds the new base limits. Rate limit headers are included in API responses to help users manage their request rates proactively, and endpoint-level protections are in place to guard against malicious traffic. The rollout is automatic and staggered across different customer tiers, with load testing requiring prior approval to avoid temporary blocks.

Anthropic has released Claude Fable 5 and Claude Mythos 5, with the latter claiming to have unparalleled cybersecurity capabilities while the former is designed for general use with added safeguards. The availability of vulnerability discovery via API, once a domain requiring deep expertise, poses both an opportunity and a challenge as AI-generated code often introduces security vulnerabilities, with studies indicating AI can increase confidence without a parallel rise in competence. Anthropic's models employ classifiers to filter offensive security requests, but these safeguards are not foolproof, with significant false-negative rates observed in real-world stress tests. The text underscores the necessity for deterministic, rather than probabilistic, security measures within AI systems, advocating for a robust in-loop position enforcement to ensure comprehensive policy checks on all agent actions. It highlights the importance of established security principles such as least privilege and deny-by-default policies, and presents Ory Agent Security as a solution that ensures authenticated, authorized, and accountable agent actions through deterministic policy enforcement, offering integration with several agentic coding tools.

Ory has announced Ory Agent DX, a new toolset designed to integrate its identity platform into AI coding agents via Ory Agent Plugins, allowing developers to manage authentication and authorization workflows within their development environments. This innovation addresses the need for incorporating security measures such as authentication, authorization, and governance early in the AI-driven software development process, which is rapidly accelerating. Ory Agent DX supports AI-powered environments like Claude Code and OpenAI Codex, providing developers with the capability to scaffold authentication workflows using natural-language prompts and test within a local Ory environment, all without requiring an account or API key. This toolset streamlines the development process by offering single-command installation, built-in tracing, and observability for better management of identities and permissions. Together with Ory Agent Security, it enables organizations to build, deploy, and govern identity-focused applications efficiently, maintaining the necessary security and scalability standards. Ory is a well-established identity platform with widespread adoption, powering significant portions of the web and backed by major investors, offering robust solutions for diverse sectors.

Ory has introduced Ory Agent Security, an innovative IAM control plane designed to secure AI agents at the point of action, addressing a critical gap in traditional security measures that focus on perimeter defenses. This system incorporates identity, authorization, and governance controls directly into the agent harness, allowing organizations to evaluate and enforce policies before actions are executed. This approach is crucial as AI agents increasingly perform essential tasks, access sensitive data, and interact with business systems. Unlike conventional methods that concentrate on gateways or credentials, Ory Agent Security evaluates authorization decisions within the agent harness, ensuring precise control over agent actions. It offers a flexible framework for applying security policies, monitoring agent interactions, and capturing audit trails, helping organizations manage AI security risks associated with unauthorized tool usage and excessive permissions. As AI agents become integral to enterprise workflows, Ory's solution supports trust and accountability, providing a consistent security layer that operates independently of the underlying model or transport mechanism.

Ory Agent Security provides a comprehensive solution for managing AI coding agents within organizations by implementing authentication, authorization, and audit capabilities, addressing security concerns and governance gaps associated with these agents. The platform allows AI agents to operate with distinct identities separate from their human counterparts, ensuring actions taken by agents are properly authenticated, authorized, and tracked, which is crucial for compliance and security oversight. This system integrates seamlessly with existing AI agent tools such as Claude Code, Codex, and OpenClaw, enabling organizations to maintain their current workflows without disruption. By using Ory Agent Security, companies can monitor AI agent activities in a non-intrusive manner before transitioning to enforcement, thereby preventing unauthorized actions while maintaining developer efficiency. The solution leverages existing Ory infrastructure for identity and permissions, offering an accessible and low-friction approach for both current and new users to enhance agent governance across various platforms.

Software adoption has shifted to a bottom-up approach where engineers choose their tools, leading to organizations purchasing what developers are already using, and this trend is evident in the realm of AI coding agents like Claude Code, Codex, and Gemini CLI, which have become essential development environments. Despite advancements, authentication remains a complex process involving SDKs, redirect URIs, and local infrastructure setup, often leading to frustration among developers like Sam, who may resort to insecure workarounds when faced with cumbersome authentication processes. Ory Agent DX aims to revolutionize this experience by integrating seamlessly with existing AI coding agents, offering a swift and efficient authentication setup that does not require an account, API key, or extensive configuration. It enables developers to scaffold login systems via simple commands, run them locally without cloud dependencies, and manage identities and permissions directly from the chat interface, ultimately reducing time to market and enhancing security. This approach allows developers to maintain their preferred tools while effortlessly integrating comprehensive authentication solutions, thus bridging the gap between development and security with minimal friction and fostering widespread adoption in both individual and organizational contexts.

Ory has achieved PCI DSS (Payment Card Industry Data Security Standard) compliance, specifically the PCI DSS SAQ D for Service Providers, which enhances the company's identity and access management (IAM) capabilities by ensuring its infrastructure meets rigorous security standards. This compliance milestone, assessed by BARR Advisory, underscores Ory's dedication to providing secure and compliant services, allowing customers to benefit from reduced audit friction and strengthened security measures such as advanced encryption, strict access control, and continuous monitoring. CEO Jeff Kukowski emphasizes that this achievement reflects Ory's commitment to operational excellence and assures customers of the platform's capability to secure identities at scale, thereby aiding organizations in building secure and compliant identity experiences. Although Ory does not store or process financial cardholder data, the compliance is crucial for customers who need to maintain their own PCI DSS compliance, as it simplifies auditing processes and provides assurance of robust security controls. Ory encourages enterprise customers to request access to its Attestation of Compliance through their account manager or the Ory Trust Center, highlighting its transparency in security practices.

Ory has launched 'Ory Talos,' a solution aimed at securing API keys and generating dynamic tokens for non-human identities like AI agents, in response to the rapid deployment of AI agents that outpaces current security measures. With non-human identities now outnumbering human ones significantly, a recent survey highlights that while over 80% of organizations use AI agents in production, only 21% have policies to govern them, resulting in issues like unauthorized access and unplanned agent behavior. Ory Talos addresses these challenges by transforming standard API keys into programmable identities using Macaroon-based delegation and token derivation, providing fine-grained access control and immediate revocation capabilities. It is designed to handle high authentication throughput without performance degradation and offers deployment flexibility, allowing organizations to manage their security infrastructure either as Ory-managed SaaS or self-hosted solutions. This platform aims to provide organizations with the necessary tools to manage AI agents effectively and securely, as emphasized by Ory's leadership and collaborators.

Ory, a leading platform for identity management, has announced its compliance with the Payment Card Industry Data Security Standard (PCI DSS) SAQ D for Service Providers, highlighting its commitment to safeguarding sensitive data through stringent security controls and governance processes. The compliance, validated by BARR Advisory, a Qualified Security Assessor, involves comprehensive security practices including access management, encryption, and continuous risk assessment, serving as a benchmark of security maturity. This achievement enhances Ory's security and compliance program, reinforcing customer trust as they evaluate identity providers for critical applications. Built on a zero-trust architecture and aligned with major international privacy standards such as GDPR and ISO 27001, Ory is equipped to support organizations in modernizing their authentication and identity management processes. The platform, which manages over 2.5 billion identities and serves various sectors, underscores its capability with over 45,000 GitHub stars and 700 million downloads, backed by prominent investors like Insight Partners and Balderton Capital.

The financial sector is rapidly adopting artificial intelligence technologies to enhance efficiency and reduce costs, but this has exposed significant inadequacies in traditional Identity and Access Management (IAM) systems, which are not designed to manage the surge in non-human identities like APIs and automated AI agents that now outnumber human identities 144 to 1. According to a study by Enterprise Management Associates, many security leaders acknowledge their current IAM configurations are ill-equipped to handle this shift, leading to security incidents and operational disruptions, particularly in the financial industry where over-privileged access and rigid legacy systems exacerbate the problem. As financial institutions increasingly deploy AI solutions, the lack of customization and structural flexibility in existing IAM platforms presents a critical barrier to innovation, with 92.1% of enterprises reporting negative impacts due to hurried AI implementations. These challenges are compounded by the complex regulatory environment that financial firms must navigate, prompting experts to advocate for strategic IAM consolidation as a means to address security vulnerabilities, establish compliance, and support the rapid scaling of automation.