July 2026 Summaries

In the article, Shashwat Sehgal discusses the limitations of relying solely on authentication for securing AI agents, emphasizing the need for a comprehensive approach to agent security that considers the full chain of authority and runtime context. Traditional identity and access models fall short when dealing with the dynamic nature of agentic systems, where actions may begin with a requester and involve various agents, tools, and resources, creating a complex web of permissions that can easily lead to unintended authority. The article argues for the importance of runtime authorization, where security decisions are made based on the confluence of all involved elements at the moment of action, allowing companies to better govern agentic access and ensure compliance. The ultimate goal is to create a robust audit trail and control model that matches the operational realities of AI agents, enabling organizations to understand and manage the risks associated with agent actions effectively.

In the article "From MCP Tool Filtering to Runtime Access Control," Gergely Danyi discusses the limitations of traditional tool-level filtering in access control for AI agents interacting with enterprise infrastructure. The Model Context Protocol (MCP) gateway, commonly used to authenticate and forward requests from AI agents to tool servers, struggles to enforce true authorization due to its reliance on allowlists of tool names and arguments, which can be insufficiently specific and prone to drift out of sync with the actual resource policies. The article highlights the inherent challenges in parsing complex command strings and the difficulties of maintaining a secondary authorization system alongside the primary IAM (Identity and Access Management) provided by cloud services. Danyi argues for a more sophisticated approach involving intent-based, just-in-time access control, where ephemeral credentials are issued for specific sessions, allowing for precise authorization aligned with the resource owner's policies. This method leverages federation and runtime business context to ensure that access is granted on a need-to-know basis, thereby enhancing security and reducing the risk of unauthorized operations while maintaining the flexibility and speed required by agentic workloads.

Just-in-Time (JIT) access is a security concept designed to minimize longstanding access to sensitive systems, which can be architected in three main ways: credential check-in/checkout, timed group membership, and JIT permission assignment. While all methods aim to reduce the number of users with unused sensitive permissions, only JIT permission assignment effectively eliminates longstanding access by assigning and revoking specific permissions as needed. Credential check-in/checkout involves manually managing access keys but relies on shared credentials and offers limited security improvements. Timed group membership temporarily escalates privileges by adding users to groups but still involves longstanding roles. JIT permission assignment is the most secure and complex, as it directly attaches and detaches permissions for specific tasks, reducing overpermissioning and identity attack surfaces. Organizations are encouraged to integrate all three methods based on their systems, as each has its advantages and drawbacks, with the ultimate goal being the elimination of standing access.