Blog
Writing
On AI agent authorization, prompt injection, policy design, and the token-lifecycle infrastructure underneath it.
AI SDK human-in-the-loop approval for tool calls.
Use needsApproval for a local confirmation. Put shared authorization around execute when the decision also depends on user, resource, arguments, or budget.
Read →MCP server authorization needs one check at the tool boundary.
Use OAuth for server access and scopes. Derive identity from verified transport context, then authorize the exact tool, resource, and arguments before its handler runs.
Read →Agent tool permissions for multi-tenant SaaS start with the session.
Take user and tenant from authenticated application state. Treat model arguments as untrusted, then recheck the named resource at execution.
Read →OpenAI Agents SDK approval workflow.
Resolve needsApproval interruptions on RunState, resume the run, and bind the approved call ID to application policy before execution.
Read →Mastra human-in-the-loop tool approval.
Use requireApproval for a tool-local gate. Let shared policy trigger Mastra's native suspend and resume flow when the rule belongs to the application.
Read →Least-privilege credentials for AI agents.
Authorize first, request the provider's narrowest practical scopes, fetch a fresh credential at execution, and keep raw tokens outside model context.
Read →LangChain JS tool permissions.
Filter tool visibility, pause selected calls for review, and enforce the trusted user, tenant, resource, and exact input inside the tool callback.
Read →To verify an agent audit trail, recompute the hash chain. Grep is not verification.
Hash each row over its body plus the previous hash. Between trusted checkpoints, a gap or edit fails; tail deletion needs an external tip. Tamper-evident, not a certification.
Read →How to require approval before an AI agent's tool call.
The naive way is an if-statement and a Slack DM. Here's where that breaks, and a policy-rule version that pauses the call, waits for an authenticated human, and receipts the decision either way.
Read →How to stop an AI agent from deleting production data.
An allow-list of read-only tools is the naive fix, and it's often the right one. Here's when it stops being enough, and how a deny rule blocks a destructive call before the function that would run it is ever invoked.
Read →How to make an agent's pending approval survive a restart.
Awaiting a promise for an hour-long approval works until the process redeploys mid-wait. A persisted action id instead of an in-memory callback — and two stores that both have to survive, not just one.
Read →A per-user agent budget is a counter on tool calls, not a max-tokens slider.
Count allowed execution attempts per tenant and user. After N, escalate to a human. Provider RPM caps and prompts are a different budget.
Read →An engineering pattern for Article 14 human oversight and record-keeping for agent actions.
Article 14 and related high-risk obligations apply from December 2027 or August 2028, depending on classification. What the text requires, a worked approval-and-receipt example, and what tamper-evident receipts do not prove.
Read →How to test an agent policy: table-drive the decision, then lint the names.
You do not need a model in the loop. Assert allow/deny/ask on a table, lint rule patterns against real tools, and keep one test that proves a deny never entered execute.
Read →An audit log for AI agent actions is a record of every tool it tried — including the ones you refused.
Log before execute, in your process, including denials. When console.log is enough, where it goes silent, and a hash-chained receipt if you need to notice a rewritten row.
Read →Contain prompt-injection blast radius in the tools, not in the prompt.
Assume the model will obey the injected instruction. Deny dangerous calls in code before execute. That is containment, not detection.
Read →Your agent logs in as you. It shouldn't get to be you.
Authentication is solved; authorization isn't. A prompt-injected agent tries to exfiltrate your inbox and physically can't — the deny fires before the tool runs, with a hash-chained (HMAC) receipt of the attempt. Why nominee is the missing half.
Read →Your AI agent's OAuth token refresh is probably broken.
Short-lived access tokens break grab-up-front across an approval pause. Rotating refresh tokens break naive refresh under concurrency — 7/8 calls fail with invalid_grant. A runnable proof, and the tiny no-SaaS fix.
Read →Your agent authenticates at 9am. By 3pm its token is dead.
OAuth tokens expire. AI agents don't stop. Here's why this is a harder problem than it looks, and how nominee solves it without locking you to a single identity provider.
Read →