authzed

Creators of SpiceDB: how ChatGPT uses AuthZed for authorization:

[authzed @authzed]

Wondering what the fuss about Relationship Based Access Control is?

Here's an explainer using....a MIDI Keyboard?!

https://t.co/KdlHv1cAo0

[authzed @authzed]

We've been running AI agents at AuthZed that we actually trust. The platform behind them, Open Agent Primitives (OAP), is now open source.

We started where a lot of teams start: personal agents running with one person's credentials, hopefully scoped correctly, inside a sandbox that was hopefully configured correctly, and that was good enough to show us agents could be useful.

But we're an authorization company, and we knew there was a better way:

• Access controls could be more granular than whatever a given credential allows
• Actions could be permitted, rather than just contained by a sandbox
• An agent could act on behalf of someone or run independently with an identity of its own

• A team, not just an individual, could collaborate with an agent, and most importantly, the agent would stick to the permissions granted to that team

We distilled our observations and lessons into a set of primitives we think any enterprise needs to build and run agents it can trust with critical actions and data. Then we implemented them. Since every enterprise has its own infrastructure and requirements, components plug in through defined interfaces. You can swap in your own sandbox, LLM provider, memory system and other backends and the primitives still hold.

We've been running it internally for several months, building, deploying, and working with agents on it.

We're releasing two things:

1. The Agent Primitives: conceptual definitions you can use to evaluate any agent platform, including one you build yourself

2. Open Agent Primitives (OAP): our open source implementation. It ships with working defaults, so anyone can deploy it and start building agents within minutes (assuming you have a spare Kubernetes cluster handy). It includes example agents and tutorials to help you build your own.

We'll be following up with a series on how we built different types of agents on OAP. In the meantime, read the definitions, install OAP, and try it out.

• Read the definitions: https://t.co/OEBoaK9ZXJ
• Try OAP: https://t.co/IWXrlpyGLu
• Source: https://t.co/NPyg2YQvDC

[authzed @authzed]

Keycloak on one side. GitHub OAuth on the other. One permission model across both.

Our new post shows how to federate authorization across multiple IdPs with SpiceDB.

https://t.co/veMVaXzHBb

[authzed @authzed]

New in the SpiceDB Playground: Explain.

Toggle it on and get AI-generated, plain-language annotations for every definition and relation in your schema. Compact or Full detail.

Handy when you're learning the schema language or untangling a big schema.

https://t.co/GrsmuM000t

[authzed @authzed]

Full episode here: https://t.co/T2nrC0dLeH

[authzed @authzed]

Someone pointed a load test at Zanzibar's production environment by mistake. 10 million extra QPS.

"We didn't notice." Nobody got paged. Nothing fell over.

Episode 6 of base-layer, with Ari Shamash, formerly of Google's Zanzibar team, is out now.

[authzed @authzed]

AI that asks permission, not forgiveness.

At ClawCon Seattle, @samkim demoed SpiceClaw: fine-grained permissions for OpenClaw agents, so they only touch the data you intend.

Plus talks from @OpenClaw and @awscloud. Full recap: https://t.co/flbhSaCwdI

[authzed @authzed]

Rule from episode 5 of base-layer, worth remembering before episode 6 drops Thursday:

Don't let the agent decide if it needs authorization.

The moment the agent makes that call, your access control stops being deterministic.

[authzed @authzed]

Zoom's agentic search spans *many* third-party data sources, each with its own permissions. Their homegrown authz couldn't scale.

They chose AuthZed Dedicated. Now: sub-50ms checks at intense scale.

Full story: https://t.co/DXtYLW1OXH

[authzed @authzed]

Everyone's had the same idea this year: use more AI to secure AI.

Sohan Maheshwar says that's backwards. AI is probabilistic. Access control needs to be deterministic. Throwing more of one at the other doesn't make it more secure.

Episode 5 of base-layer is out now: https://t.co/JUuDgvSndr

[authzed @authzed]

When @Calendly's Notetaker AI needed to share recaps across users, groups, and workspaces, their ad hoc authorization couldn't keep up,

They adopted SpiceDB to standardize access control. Now GA, checks running 25-30ms.

https://t.co/yIoSxEVBNs

[authzed @authzed]

Taylor Dolezal's commit history used to sit near zero. Now a device in his family room shows the trailing 30 days: 2,700 commits.

Episode 4 of Base Layer, with @onlydole of @dosu_ai, is out now.

https://t.co/uex2oT0I0q

[authzed @authzed]

How it works, straight from Google's own Leopard index: https://t.co/dkX3NZbEqC

[authzed @authzed]

AuthZed Materialize is now Generally Available for AuthZed Dedicated 🎉

Precomputes your most expensive permission checks in advance. Single-digit millisecond responses, even at enterprise scale.

https://t.co/ccFlobsGBR

[authzed @authzed]

Spencer Kimball co-created GIMP in 1997, then went on to found @cockroachdb.

His take: governance, not capability, is what's actually blocking AI adoption.

Episode 3 of base-layer is out now.

https://t.co/uaELj1botm

[authzed @authzed]

She built a hair-care app for herself, used it for months, then deleted it.

Emilie Schario of @kilocode calls it selfieware: no users, no tracking, no authorization. Built because the cost of building dropped below the cost of caring.

Listen here: https://t.co/lmrnqpEBbx

[authzed @authzed]

Seats are still open for Thursday's roundtable on permissions in agentic AI, hosted by AuthZed CEO @JacobMoshenko

Past attendees have come from Pinterest, Turo, NBA, and Adobe.

If you're building internal AI systems, this is for you. https://t.co/5HgwpsdB1u

[authzed @authzed]

"I think you just can't trust pretty much any of your
infrastructure."

EP 01 of base-layer is live with @zsmithnyc of Datum on why the
internet needs an upgrade.

https://t.co/LLmmsn40yt

[authzed @authzed]

See it in action: https://t.co/b1voby632k

[authzed @authzed]

We once made a video modeling Discord's permissions in SpiceDB. It took over an hour.

This time, one prompt got us there. The SpiceDB Playground Assistant writes the schema, generates test data, and validates it, live in your browser. Ask it why a check fails and it shows the actual trace, not a guess.

[authzed @authzed]

"Why can't alice view budget.pdf?"

Ask the SpiceDB Playground Assistant and it won't guess. It pulls the real debug trace and names the exact relation that's missing.

Try it: https://t.co/GrsmuM000t