Identity, object ownership, delegated authority, and specific approvals belong in the same review. This reading path connects API authorization to the permissions used by AI agents. Pay attention to when a decision is made, what resource context is authoritative, and whether the same rule applies to exports and queued work. Use the guides to build allowed and denied test cases with owned accounts. The useful outcome is a permission boundary another engineer can explain and reproduce, not an assumption that a valid credential authorizes every action.
AI agent least privilege: let the model propose, let policy decide
A permission model for tool-using agents, with scoped identities, specific approvals, and auditable execution.
Prevent BOLA in multi-tenant APIs: authorize the object, not just the route
Turn tenant boundaries into explicit resource checks, negative tests, and safer background-job behavior.
API security checklist: build a stronger first line of defense
A practical path from endpoint inventory to access controls, resource limits, and a release process your team can repeat.