Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: Authorization
MCP and OAuth2: Who Authorized the Agent's Action on Your MCP Server?
OAuth2 covers only part of agent authorization in the Model Context Protocol. How OIDC, scopes, confused-deputy rules, GNAP and capabilities fit together.
12 min readSafe Tool Discovery for Enterprise AI Agents: Registry, Gateway and Policy
A design for financial-services agents: a Tool Registry, filtered discovery, a deterministic Tool Gateway, intent-level authorization and durable side effects.
7 min readThe Two Ways MCP Servers Fail and a Guardrail Layer to Stop Them
MCP servers fail through over-broad tokens and task-blind tools. Scoped tokens, audience checks, sanitized errors and tool caps make a guardrail layer.
8 min readSecuring Write-Enabled MCP Tools: Seven Layers Beyond the Token
Why an MCP token does not authorize downstream writes, and the seven control layers, credential separation, exact-request approval and retry rules that do.
8 min readSecure MCP: when an AI agent gets keys to your systems
Treat Model Context Protocol tools as capabilities, not endpoints—separate authn from authz, fix confused deputies, minimize tool output, and assume the model is powerful and untrusted.
12 min readMapping the Auth Vocabulary: API Keys, Sessions, JWT, OAuth2, OIDC, SSO
Learn how API keys, sessions, JWTs, OAuth2, OpenID Connect and SSO fit together by sorting each one under a single question: who is calling, or what may they do.
10 min readBenchmark the Failure Path: Next.js, Remix and Stale Authorization Data
A case study of how a stale-permission bug reframes a Next.js versus Remix decision, and how to evaluate frameworks on mutations, cache lifetimes and debuggability.
9 min readRole-Based Access Control in Express with JWT and Two Middlewares
Learn how to enforce role-based access in an Express API by pairing JWT authentication middleware with a reusable authorize() guard, and when to answer 401 versus 403.
4 min readWhy Next.js Server Actions Need Authorization Inside Every Function Body
A dissected account-takeover case shows how unauthenticated Next.js Server Actions expose privileged operations, and where the authorization check has to live to stop it.
4 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.