MCP Resources and Prompts: The Primitives Your Policy Engine Never Learned to Gate
9 min read
MCP tools aren't the only way to reach data. Resources and prompts are separate RPC methods a tool-call policy engine never sees go by.
Read more →Fullmakt Blog
Guides and deep-dives on brokering credentials for AI agents: scoped, short-lived access, continuous verification, and tamper-proof audit.
-
-
Indirect Prompt Injection: The Attack That Lives in the Data, Not the Prompt
9 min read
Indirect prompt injection hides instructions in tool results and A2A messages, not the prompt. Why it evades detection, and how credential-layer containment limits the damage.
Read more → -
The act Claim Nobody Checks: OAuth Token Exchange and the A2A Delegation Chain
8 min read
RFC 8693 gives OAuth a real mechanism for chained delegation — the act claim. Most A2A deployments don't use it, and the ones that do rarely verify it. Here's what that costs, and how a broker closes the gap.
Read more → -
MCP Elicitation and Sampling: The Handshake That Skips Your Credential Broker
9 min read
MCP lets a tool server ask the human directly for input, or borrow the host's model for a completion — both a legitimate way around every control a credential broker enforces.
Read more → -
GDPR and AI Agents: Data Ownership Doesn't Survive an A2A Handoff by Default
9 min read
GDPR draws a clean line between controller and processor. An AI agent that delegates a subtask to another agent over A2A can cross that line mid-task, invisibly. Why that's a compliance gap, and how a broker keeps it visible.
Read more → -
Bearer Tokens Weren't Built for Agents: DPoP and the Sender-Constrained Login Handshake
9 min read
A stolen bearer token works for anyone who holds it. DPoP binds it to the key that requested it — why that matters far more for AI agents than browsers.
Read more → -
A2A Push Notifications Are a Second Front Door — and Most Agents Leave It Unlocked
8 min read
A2A's push-notification webhooks let a long-running task call back when it's done. Most teams harden the handshake that starts a task and wave through the one that ends it.
Read more → -
contextId Isn't a Trace ID: The Gap in A2A and MCP's Own Correlation Fields
7 min read
A2A gives you contextId and taskId. MCP gives you Mcp-Session-Id. Neither was built to follow a request past the hop it was issued for — here's the gap that leaves, and how a broker closes it.
Read more → -
The Ratchet Effect: Why AI Agent Permissions Only Go Up
6 min read
Every AI agent's access grows over time and almost never shrinks. Why permission creep is a data-ownership risk hiding in plain sight, and how scoped, short-lived credentials fix it by design.
Read more → -
The Alert Fired. The Agent Kept Spending.
7 min read
An alert isn't a stop. Runaway agentic spend is a governance gap identity checks and allow/deny policies both miss — and what actually halts the loop.
Read more → -
SOC 2 for AI Agents: The Control Matrix Wasn't Built for a Caller That Isn't a Person
8 min read
SOC 2's access controls assume a human logging in, reviewed quarterly. An agent making thousands of calls a day breaks that model — here's what auditors actually need instead.
Read more → -
Approval Fatigue: When Human-in-the-Loop Becomes a Rubber Stamp
8 min read
Human approval gates are the standard answer to risky agent actions. At volume, review turns into a reflex click — and the control quietly stops controlling anything.
Read more → -
One Login, Many Users: How Cached Tokens Leak Across Sessions in Agentic AI
9 min read
Agent middleware authenticates once and reuses the connection for speed — standard practice for a service credential. When the cached token belongs to one end user, that same pattern quietly hands their login handshake to the next request.
Read more → -
After the Agent Goes Wrong: What Incident Forensics Actually Needs From Your Audit Trail
7 min read
When an AI agent goes wrong, most audit setups can only tell you an API call happened — not what authorized it, what order it fired in, or how far the damage spread.
Read more → -
When One Agent Becomes Ten: Parallel Sub-Agent Fan-Out Breaks Credential Attribution
8 min read
Orchestrators spin up parallel sub-agents that share one task credential. When ten branches call the same API in the same second, audit logs collapse into an unattributable blur and budget checks race each other. Why fan-out needs per-branch tokens, not a bigger session ID.
Read more → -
The 202 Pattern: Why Agentic AI Needs a Pause Button, Not Just a Policy
8 min read
Allow and deny cover most agentic actions. The ones that don't fit either box need a third answer: pause, notify a human, and let a short-lived, one-shot approval — not a standing yes — unlock the call.
Read more → -
Non-Human Identity Governance Wasn't Built for Agents That Improvise
7 min read
NHI programs inventory service accounts and rotate API keys on a schedule. AI agents break both assumptions. Why non-human identity governance needs a broker for agentic AI, not just a bigger spreadsheet.
Read more → -
The Kill Switch Nobody Built: Stopping an AI Agent Mid-Incident
8 min read
A login handshake proves an agent can start acting. Almost nothing in most stacks proves you can make it stop. Why agentic AI needs a real-time kill switch, not just revocation after the fact, and where a broker makes that possible.
Read more → -
The MCP Server You Just Installed: A Supply-Chain Problem Wearing a Tool Icon
8 min read
An MCP server is third-party code with a direct line to your credentials. Why MCP's supply chain needs the scrutiny of any dependency — and why the fix belongs at the credential broker, not the install step.
Read more → -
Decision Tokens: Why 'Allowed' and 'Here's the Secret' Must Be Two Different Answers
9 min read
Most AI agent credential systems check permission and hand over the secret in the same step. Splitting authorization from dispensing — with a short-lived decision token in between — closes the gap that lets a revoked agent keep acting.
Read more → -
The Agent Retried the Call: Idempotency and the Duplicate-Action Failure Mode
8 min read
An AI agent that can't tell if its last call succeeded will retry it. Without idempotency, that retry is a second refund, a second email, a second production deploy. Why this agentic-AI-gone-wrong pattern needs a broker-level fix.
Read more → -
The MCP Rug Pull: When the Tool Your Agent Approved Isn't the Tool It's Calling
5 min read
A human approves an MCP server's tools once. Nothing stops the server from changing them afterward. What an MCP rug pull actually does, why the login handshake can't catch it, and how per-call verification does.
Read more → -
A2A Skill Poisoning: A Legitimate Agent Card Can Still Talk Your Agent Into Too Much
8 min read
A2A skill poisoning: the destination is legitimate, but a skill's free-text description talks a well-authenticated agent into an oversized or misconfigured call.
Read more → -
MCP Rug Pulls: When the Tool You Approved Isn't the Tool You're Calling
8 min read
An MCP tool reviewed once can be silently rewritten later. Why login handshakes and one-time approval miss a rug pull, and how per-call verification catches it.
Read more → -
Agent Card Spoofing: The A2A Discovery Step Your Login Handshake Doesn't Protect
8 min read
A2A agents discover each other via an unauthenticated Agent Card. If that step is spoofed, a valid login handshake still authenticates to the wrong party.
Read more → -
The Refresh Token Nobody Should Give an AI Agent
9 min read
OAuth's refresh token exists so a human who steps away doesn't have to log in again. An AI agent never steps away. Why that mismatch recreates the standing-credential problem — and the login handshake that avoids it.
Read more → -
On Whose Behalf? The Identity Question Agentic AI's Login Handshake Skips
8 min read
An AI agent's login handshake proves which agent is calling. It rarely proves who the agent is acting for. Why that gap matters for A2A and MCP delegation chains, and how a broker closes it.
Read more → -
The Observability Trap: When Watching Your AI Agents Becomes the Leak
7 min read
Teams build detailed logs and traces to catch AI agents gone wrong — then those same logs end up holding the credentials and customer data they were meant to protect. Here's the redaction gap, and how to close it.
Read more → -
Login Handshake Procedures for AI Agents: API Keys, OAuth, mTLS, and Token Exchange Compared
7 min read
API keys, OAuth client-credentials, device flow, mTLS, and token exchange all authenticate AI agents differently. What each handshake actually proves, where it breaks down, and why the handshake was never the hard part.
Read more → -
Six Real AI Agents Gone Wrong, and the Governance Failure Behind Each One
8 min read
From a coding agent that deleted a production database to a chatbot that invented a policy — six real AI agent incidents and the credential, authorization, and audit gaps behind each.
Read more → -
AI Agents Need an Offboarding Process Too: The Login Handshake Nobody Revokes
6 min read
Every AI agent outlives the task it was built for. Why agent offboarding is a governance and data-ownership gap, not just security hygiene, and how a credential broker makes revocation instant.
Read more → -
SSRF and Agentic AI Gone Wrong: The Login Handshake Was Never the Problem
7 min read
An AI agent can pass every login handshake and still be tricked into calling your cloud metadata endpoint. How SSRF turns a legitimate agentic action into an incident, and where the guard actually has to live.
Read more → -
The Lethal Trifecta: Closing Agentic AI's Data-Exfiltration Gap
7 min read
Private data, untrusted content, and an exfiltration path — the 'lethal trifecta' behind agentic AI gone wrong, and why credential-layer observability closes it.
Read more → -
MCP Tool Poisoning: The Confused-Deputy Failure Mode Behind Agentic AI Gone Wrong
4 min read
A malicious tool description can turn a well-authenticated AI agent into a confused deputy. How MCP tool poisoning works, why login handshakes alone don't stop it, and the broker pattern that does.
Read more → -
MCP Tool Poisoning Is a Login Handshake Problem, Not a Prompt Problem
6 min read
MCP's OAuth handshake proves an agent connected to your server. It says nothing about what a tool description talked the agent into doing next. Why MCP incidents keep happening at the tool layer, and how a broker closes the gap.
Read more → -
The MCP Confused Deputy: How 'It Has a Valid Token' Still Goes Wrong
5 min read
A valid MCP token doesn't mean a wise call. The confused deputy problem in agentic AI, and how a broker enforces policy on every tool call, not just the connection.
Read more → -
The A2A Protocol Changes the Login Handshake: Governing Agents That Manage Agents
9 min read
A2A lets one AI agent configure another system, not just call its tools — a bigger blast radius than MCP. Here's the handshake and credential carve-out that makes it safe.
Read more → -
The A2A Handshake: What Agent2Agent Authentication Actually Proves
8 min read
The A2A protocol standardizes how AI agents authenticate to each other. What the handshake proves, what it doesn't, and why every call still needs a broker behind it.
Read more → -
Shadow AI Agents: The Governance Blind Spot Nobody's Counting
9 min read
Every team wiring an AI agent to an API mints its own credential. Nobody centrally counts them. Here's why shadow AI agents are a data-ownership and traceability problem, not just a security one — and how a broker fixes it.
Read more → -
Data Ownership in Agentic AI: Three Failure Patterns, and the Broker That Stops Them
8 min read
AI agents rarely fail by being unauthenticated. They fail by losing track of whose data they're touching. Three real failure patterns in agentic AI, and how a credential broker enforces data ownership on every call.
Read more → -
Observability vs. Traceability for AI Agents: Why One Audit Log Isn't Enough
8 min read
Agentic actions rarely stay inside one agent. Here's the difference between observability and traceability for multi-agent AI, and how to trace one task across every hop it triggers.
Read more → -
When AI Agents Go Wrong: Authentication, Data Ownership, and the Governance Gap
9 min read
A sloppy login handshake is how an AI agent ends up reading data it never should have touched. What authentication and data ownership need to look like for agentic AI — and where a credential broker fits.
Read more → -
1Password just bought into the credential broker category for AI agents
7 min read
1Password acquired Apono and shipped a Credential Broker for AI agents. Standing keys are over — here's why, and where brokering at issuance differs from brokering every call.
Read more → -
ISO/IEC 42001 and AI agents: what a credential broker covers for you
7 min read
ISO/IEC 42001 asks you to govern what your AI systems do. A credential broker turns several Annex A controls into enforced policy — here's the honest mapping.
Read more → -
Fullmakt vs. Auth0: what's the difference for AI agents?
5 min read
Auth0 is an identity platform for users and services; Fullmakt is a credential broker for AI agents. How the two differ — and how they work together.
Read more → -
MCP and OAuth: giving agents access without giving away secrets
3 min read
How the Model Context Protocol and OAuth 2.1 fit together to let AI agents call your tools with scoped, revocable access — and where a broker fits in.
Read more → -
Auditing every agent API call with tamper-proof logs
3 min read
When an AI agent acts on your behalf, you need to answer which agent did what, when, and for whom. Here's how a cryptographically chained audit log makes that answer trustworthy.
Read more → -
Scoped credentials for AI agents: least privilege by default
3 min read
Why handing an AI agent a long-lived API key is a liability, and how short-lived, scoped credentials give agents exactly the access they need — and nothing more.
Read more →