Tag
least-privilege
- Aug 20, 2026 Role Assumption and the Shape of a Temporary Session How a caller exchanges long-lived identity for short-lived credentials, what the issued token actually carries, and why revocation is harder than expiry. cloud infrastructure
- Aug 5, 2026 Capability References and the Absence of Ambient Authority Why naming a resource by path or file descriptor grants more than the caller needs, and how unforgeable references make authority a property of what a program holds rather than who it claims to be. language runtimes
- Jul 4, 2026 Constrained Delegation and Token Exchange in OAuth 2.0 How the token exchange grant carries a subject through a chain of services, what scopes and audience restrict, and why impersonation and delegation differ in what the audit log records. security
- Mar 3, 2026 Deciding Whether a Policy Set Grants More Than Intended How an access policy becomes a logical formula, what an SMT solver can answer about it, and why the answer is only as good as the model of the request. cloud infrastructure
- Feb 27, 2026 Delegating Provisioning Without Delegating the Account How a self-service pipeline obtains cloud credentials through workload identity federation, what the trust policy must pin, and how the blast radius stays bounded. devops
- Feb 24, 2026 Trust Policies, External IDs, and the Confused Deputy Why a trust policy naming a principal is not enough when that principal acts for many customers, and how a shared secret in the assumption request closes the gap. cloud infrastructure
- Jan 27, 2026 Deny Wins: How One Request Is Evaluated Against Many Policy Documents The order in which identity policies, resource policies, boundaries, and organization policies combine to produce a single allow or deny, and why that order is not additive. cloud infrastructure
- Jan 17, 2026 Install Scripts: The Code That Runs Before the Package Does What package managers execute at install time, why lifecycle hooks exist, and how their privilege, ordering, and failure semantics make them a separate trust boundary from the code being installed. software engineering
- Jul 30, 2025 Object Capabilities and the Confused Deputy How unforgeable references replace identity checks, why ambient authority enables the confused deputy, and what membrane and revocation designs cost in a capability system. security
- Jun 13, 2025 Permission Boundaries and Service Control Policies as Independent Ceilings How two documents that grant nothing restrict what other documents grant, what each one cannot cap, and how their scopes differ by blast radius. cloud infrastructure
- Feb 12, 2025 Attribute Conditions: Constraining Access by Tag Instead of by Name How principal tags and resource tags become condition keys, why the two-sided check needs both halves, and what happens when a tag is missing or renamed. cloud infrastructure
- Sep 11, 2024 Deriving Least Privilege from Recorded Access Instead of from Intent Why an audit trail is an incomplete oracle for permissions, how to turn call history into a candidate policy, and what such a policy systematically omits. cloud infrastructure
- May 30, 2024 Attenuation and Revocation of Delegated Authority How a capability can be narrowed before it is passed on, why revocation in a capability system is either impossible or requires indirection, and what each indirection costs. language runtimes
- Jan 16, 2024 Wildcard Semantics in Resource ARNs and Why They Span Separators How the star and question-mark metacharacters match against ARN strings, where their reach exceeds the intent of the author, and how policy variables substitute before matching. cloud infrastructure