Getting Granular with Access, Attributes, and Intent - Alex Olivier - ASW #403

The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been approaching new standards, guidelines, and practical deployment patterns to make it easier for orgs to establish more refined and correct access policies. It's a problem that predates LLMs, but also one that agents and MCPs made all the more acute. We talk about what intent means when trying to constrain agents' activities, what role LLMs have in policy decisions, and how LLMs can help create a much-needed inventory of access controls.

Segment Resources:

• https://www.cerbos.dev/blog/dimmer-switch-not-a-kill-switch-rethinking-ai-agent-governance
• https://www.cerbos.dev/blog/multi-hop-delegation-ai-agents
• https://openid.net/wg/authzen/

Show Notes: https://securityweekly.com/asw-403