Learning Center

What Is a Non-Human Identity (NHI)? A Complete Guide

Non-human identities like service accounts, API keys, and AI agents now far outnumber people. Learn why NHIs are a top risk and how to secure them at scale.

OAuth 2.1: What Changed, and What It Means for AI Agents

OAuth 2.1 consolidates OAuth 2.0 and its security best practices: mandatory PKCE, no implicit grant, exact redirect matching. Plus what it means for AI agents.

OAuth Token Exchange (RFC 8693): Delegated Access Explained

OAuth token exchange (RFC 8693) swaps a broad token for a narrow, audience-bound one. How delegation, impersonation, and the act claim work for AI agents.

Human in the Loop AI: When Agents Must Stop and Ask

Human in the loop AI puts a person on the calls an agent should not make alone. Which actions need approval, how to design the checkpoint, what auditors want.

Agent Authorization: How to Decide What AI Agents May Do

What agent authorization is, which model to use, how delegated authority travels in a token, and where the decision belongs so a prompt cannot move it.

Ephemeral Credentials: How Short-Lived Access Works

What ephemeral credentials are, how they are issued, how long they should live, and how to move AI agents off static secrets without breaking production.

Step-Up Authentication: How It Works and When to Trigger It

Step-up authentication asks for stronger proof only when an action's risk earns it. How it works, when to trigger it, and how it extends to AI agents.