← Back
Home › Systems › AI and agent security

agent-identity

agent identity and delegated authorization

MCP OAuth, Okta for AI agents

SystemTechniques · 25Primitives · 77 agent-identity Model context protocolagentic-ai · medium: JSON-RPC protocol exposing tools, resources and prompts from servers to LLM clients, with capability negotiationConfig distributiondistributed · medium: A control plane pushes versioned resource changes over long-lived streams; each node validates, ACKs or NACKs and keeps its last good copy, so a bad change stops at a canary.›Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Certificate revocationsecurity · medium: CRLs, OCSP, OCSP stapling, short-lived certificates and CRLite-style filters for revoked certificatesCoverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Hardware security module (HSM)security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.›Json rpcnetworking · low: JSON-RPC 2.0 requests, notifications and batchingOAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›Leasesdistributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.›X509 certificatessecurity · low: Certificate chains, path validation, SANs, revocation and short-lived issuancePasskeys (WebAuthn)security · low: Phishing-resistant login with a per-site key pair held by the device or password manager; the server stores only a public key.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Digital signatures (Ed25519)security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.›JSON Web Token (JWT)security · low: A signed, URL-safe token carrying claims; the verifier's job is the checklist (pinned algorithm, key by kid, exp, aud, iss), not the format.›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Capability tokenssecurity · low: Unforgeable, attenuable tokens granting specific rights (macaroons, biscuits, object capabilities)Ldap directorysecurity · low: LDAP directory model, bind, search filters and group membership queries for enterprise identityReplay protection windowsecurity · low: A highest-seen counter plus a bitmap of the last W numbers rejects duplicates and stale messages in O(1) with a few hundred bytes of state.›Sessions vs tokenssecurity · low: Opaque server-side sessions in cookies for browsers, short-lived signed tokens between services; revocation decides most cases.›Graceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›+ 18 more techniques+ 61 more primitives

Similar systems

Share the most building blocks with this one.

agent-credentials 48 %zero-trust 43 %identity-provider 41 %e-id 35 %e-prescription 34 %