6 ms·

Authorization for sub-entities is what is needed. Having to define what an agent can do when it identifies on my behalf is cumbersome, especially when you star

by _puk 25d ago

Authorization for sub-entities is what is needed. Having to define what an agent can do when it identifies on my behalf is cumbersome, especially when you start to get specialised agents. Pattern based would be too easy for AI to game, but there's got to be a service independent way to limit permissions based on role. I am Jack's right ear - awesome you get to hear stuff. I am jack's right hand - great you get to input stuff.

kelseyfrog 25d ago
I am Jack's synaesthesia.
- ethbr1 25d ago
  What people who care about security want -- finely grained permissions that guarantee security boundaries, at the expense of bad UX What most end users want -- for the machine to do what they want, as often as possible, while bothering them as little as possible Windows' UAC journey is a microcosm of the space. The real long-term win is defining ground level permissions around common use cases, so that when composed they can alert as rarely as possible. But that's an all-of-ecosystem change: the OS (providing usable boundaries), applications (updating to use minimal boundaries), and users (understanding what they'll need to approve/deny).
  - mooreds 25d ago
    Yeah. If we want fine grained "intelligent" authorization, there's a lot of work to be done. You can't simply slap a gateway on existing systems. I wrote about this more on my employer's blog[0]. > The real long-term win is defining ground level permissions around common use cases, so that when composed they can alert as rarely as possible. And this is an even larger effort to implement, especially as agent capabilities change over time (and they are changing rapidly). 0: https://fusionauth.io/blog/ai-authorization https://fusionauth.io/blog/ai-authorization
niyikiza 24d ago
This. Especially when you have agents calling other agents. Just published an article about that yesterday: https://niyikiza.com/posts/agents-to-agents/ https://niyikiza.com/posts/agents-to-agents/
sudharsanes694 17d ago
[dead]

by _puk 25d ago

kelseyfrog 25d ago

I am Jack's synaesthesia.

ethbr1 25d ago
What people who care about security want -- finely grained permissions that guarantee security boundaries, at the expense of bad UX What most end users want -- for the machine to do what they want, as often as possible, while bothering them as little as possible Windows' UAC journey is a microcosm of the space. The real long-term win is defining ground level permissions around common use cases, so that when composed they can alert as rarely as possible. But that's an all-of-ecosystem change: the OS (providing usable boundaries), applications (updating to use minimal boundaries), and users (understanding what they'll need to approve/deny).
- mooreds 25d ago
  Yeah. If we want fine grained "intelligent" authorization, there's a lot of work to be done. You can't simply slap a gateway on existing systems. I wrote about this more on my employer's blog[0]. > The real long-term win is defining ground level permissions around common use cases, so that when composed they can alert as rarely as possible. And this is an even larger effort to implement, especially as agent capabilities change over time (and they are changing rapidly). 0: https://fusionauth.io/blog/ai-authorization https://fusionauth.io/blog/ai-authorization

niyikiza 24d ago

This. Especially when you have agents calling other agents. Just published an article about that yesterday: https://niyikiza.com/posts/agents-to-agents/ https://niyikiza.com/posts/agents-to-agents/

sudharsanes694 17d ago

[dead]