October 2025 Summaries

Oso is featured in two reports highlighting the complexities and evolving landscape of agentic AI security, focusing on the challenges of authorization for both human-operated and autonomous agents. The key issue is over-permissioning, particularly as agents can access data far faster than humans, necessitating a robust authorization system that constrains permissions to only what is necessary for each task. Oso is investing in its core platform to enhance agentic authorization, which includes developing an Automated Least Privilege system to monitor and control agent actions dynamically. While deterministic rules currently govern authorization, Oso is exploring future possibilities where AI agents could potentially manage authorization more reliably than humans. The company stresses the importance of flexibility in authorization models to adapt to the rapidly changing market and technological advancements in intelligent software, aligning with insights from Ansa and Insight Partners.

OAuth, a widely accepted standard for authorization, is increasingly seen as inadequate for managing access permissions for AI agents due to its limitations in handling complex and dynamic permissions, auditing actions at runtime, and addressing security risks associated with static tokens. OAuth's token-based model, which is effective for access delegation in conventional applications, struggles with the granularity and flexibility required for managing AI agents that interact with multiple services and data sources. This inadequacy is highlighted by the potential for data breaches, as demonstrated by incidents where compromised OAuth tokens led to unauthorized access to sensitive data. Moreover, OAuth lacks the capability to record and audit agent actions in real-time, which is crucial for maintaining security and compliance in environments where agents are actively making decisions and accessing data. As a result, there is a call for a new approach to authorization that can accommodate the unique requirements of AI agents, such as a real-time policy engine capable of handling complex policy modeling and providing detailed logging and alerts to support human oversight and intervention.

Employers seeking engineers skilled in microservices often focus on evaluating candidates through various technical interview questions, exploring their understanding and approach to distributed systems. These questions can be categorized into three main areas: system design for hyperscale systems, the trade-offs between monolithic and microservices architectures, and handling specific microservices challenges. Senior engineering leaders, such as Steve Briskin and Antoine Patton, emphasize the importance of assessing a candidate's ability to design scalable architectures and manage data consistency. Questions around the decision-making process, as highlighted by Sam Weaver and Jeff Doll, probe candidates' reasoning on when to adopt microservices over monoliths, considering architectural readiness and service boundaries. Practical challenges, as noted by Jared Rosoff and Justin Helmer, focus on infrastructure scaling, dependency management, and maintaining service integrity, reflecting the real-world complexities of operating microservices at scale. This comprehensive approach helps identify engineers who not only understand microservices theoretically but also can apply their knowledge to practical scenarios.

Model Context Protocol (MCP) is an open standard that connects AI agents with external tools, data, and services, standardizing interactions and providing a secure interface through MCP servers. However, these servers introduce significant security risks, including credential theft, server compromise, prompt injection, and overly-broad permissions. Real-world examples from companies like Notion, Anthropic, and GitHub highlight vulnerabilities such as credential misuse and unauthorized data access. To mitigate these risks, it is crucial to implement strong authentication, fine-grained authorization, tool registry integrity, operational guardrails, and comprehensive observability. These measures ensure that MCP servers remain secure and reliable while unlocking the potential of AI agents.

Oso's system architecture is designed for high reliability and resilience, with a focus on ensuring seamless authorization processes for its customers. Utilizing a cell-based architecture, each Oso instance operates alongside a local SQLite database, minimizing network latency and external dependencies. This setup allows for quick scalability in response to traffic spikes and maintains system availability, achieving over 99.99% uptime as monitored from October 21, 2024, to October 21, 2025. The write process employs a global Kafka cluster to handle high write volumes while maintaining data consistency, though at the cost of increased baseline write latency. In case of network outages or application issues, Oso provides a failover mechanism through a local Fallback cluster that syncs data every 30 minutes to ensure continuity. The system's performance is continuously monitored and optimized, with authorization query latencies consistently maintained under 10ms. These architectural decisions are guided by the need to prevent disruptions and maintain customer trust, with ongoing improvements driven by customer feedback and detailed performance monitoring.

Oso's Authorization-as-a-Service platform, Oso Cloud, has been recognized as a finalist for Foundry InfoWorld's 2025 Technology of the Year Award in the Application Security category, highlighting its innovative approach to permissions in software development. The platform addresses the longstanding challenges of fragile, homegrown permissions systems by providing a centralized, declarative control plane for defining and enforcing policy across microservices, multi-tenant SaaS, and AI workflows. Oso's recognition underscores its impact on engineering and security teams, enabling them to build secure, scalable systems efficiently. Co-founded by Graham Neray, Oso is supported by prominent investors and serves a diverse clientele, including startups and Fortune 500 companies like Duolingo and PagerDuty. InfoWorld, a leading technology publication, focuses on helping IT professionals understand and leverage the latest technologies in software development, cloud computing, and data analytics.

Oso recently transitioned its documentation platform from a custom Nextra/React setup to Mintlify to enhance speed, collaboration, and reliability, addressing the need for a stable and easily maintainable system amid outdated dependencies and complex navigation. By choosing Mintlify over alternatives like Docusaurus and Fern, the team benefited from built-in features such as AI search, analytics, and a visual editor, which streamlined authoring and collaboration while maintaining integration with their Git workflows. The migration involved a comprehensive audit of the existing information architecture and a structured evaluation process, ensuring minimal complexity and operational impact. With Mintlify's support for CI/CD and SEO optimization, Oso achieved a seamless transition with zero downtime, enabling faster content updates and improved user experience. The revamped documentation now offers better discoverability and clarity, meeting high standards for security software documentation while preserving the site's DomainRank and facilitating ongoing feedback and improvements.