Per-user tool authorization: never let the model become the policy engine addresses one concrete problem: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. The guide works from the actual objects — authorization, policy engine, tool call, user context, least privilege — and aims for a verifiable decision rather than a generic pattern.
The concrete problem: authorization meets policy engine
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c11 starts at user context and treats least privilege as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before policy engine can trigger the intended effect around tool call. The conclusion stays bounded by authorization and tool call: anything not demonstrated by scenario per-user-agent-tool-authorization-c11 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns user context into a reviewable decision point with a named input and a retained output. To test least privilege, fixture per-user-agent-tool-authorization-c11 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c12 starts at least privilege and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires policy engine to emit an observable result before tool call can trigger the intended effect around user context. Operations then observes the transition between policy engine and tool call, while security checks that user context receives neither implicit authority nor unnecessary data. If the tool call verification fails, rollback restores the configuration around user context, replays per-user-agent-tool-authorization-c12, and compares the new state with the control evidence from least privilege. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c13 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. The conclusion stays bounded by tool call and least privilege: anything not demonstrated by scenario per-user-agent-tool-authorization-c13 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns authorization into a reviewable decision point with a named input and a retained output. To test policy engine, fixture per-user-agent-tool-authorization-c13 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c14 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. Operations then observes the transition between user context and least privilege, while security checks that authorization receives neither implicit authority nor unnecessary data. If the least privilege verification fails, rollback restores the configuration around authorization, replays per-user-agent-tool-authorization-c14, and compares the new state with the control evidence from policy engine. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance.
Failure modes, signals, and diagnosis
The starting point is not a feature; it is an observable decision boundary.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c21 starts at least privilege and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires policy engine to emit an observable result before tool call can trigger the intended effect around user context. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by policy engine and user context: anything not demonstrated by scenario per-user-agent-tool-authorization-c21 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns least privilege into a reviewable decision point with a named input and a retained output.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c22 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. To test policy engine, fixture per-user-agent-tool-authorization-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call. Operations then observes the transition between tool call and user context, while security checks that least privilege receives neither implicit authority nor unnecessary data. If the user context verification fails, rollback restores the configuration around least privilege, replays per-user-agent-tool-authorization-c22, and compares the new state with the control evidence from authorization.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c23 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by user context and authorization: anything not demonstrated by scenario per-user-agent-tool-authorization-c23 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns policy engine into a reviewable decision point with a named input and a retained output.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c24 starts at tool call and treats user context as an explicit boundary rather than an implicit assumption. The first control requires least privilege to emit an observable result before authorization can trigger the intended effect around policy engine. To test user context, fixture per-user-agent-tool-authorization-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to least privilege. Operations then observes the transition between least privilege and authorization, while security checks that policy engine receives neither implicit authority nor unnecessary data. If the authorization verification fails, rollback restores the configuration around policy engine, replays per-user-agent-tool-authorization-c24, and compares the new state with the control evidence from tool call.
Progressive rollout and rollback
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c31 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. If the user context verification fails, rollback restores the configuration around least privilege, replays per-user-agent-tool-authorization-c31, and compares the new state with the control evidence from authorization. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to policy engine, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and least privilege: anything not demonstrated by scenario per-user-agent-tool-authorization-c31 is labeled as a limitation or inference, never promoted to fact.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c32 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns policy engine into a reviewable decision point with a named input and a retained output. To test tool call, fixture per-user-agent-tool-authorization-c32 contains both an allowed state and a rejected state; rejection must occur before any change attributed to user context. Operations then observes the transition between user context and least privilege, while security checks that authorization receives neither implicit authority nor unnecessary data.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c33 starts at tool call and treats user context as an explicit boundary rather than an implicit assumption. The first control requires least privilege to emit an observable result before authorization can trigger the intended effect around policy engine. If the authorization verification fails, rollback restores the configuration around policy engine, replays per-user-agent-tool-authorization-c33, and compares the new state with the control evidence from tool call. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to user context, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by least privilege and policy engine: anything not demonstrated by scenario per-user-agent-tool-authorization-c33 is labeled as a limitation or inference, never promoted to fact.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c34 starts at user context and treats least privilege as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before policy engine can trigger the intended effect around tool call. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns user context into a reviewable decision point with a named input and a retained output. To test least privilege, fixture per-user-agent-tool-authorization-c34 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization. Operations then observes the transition between authorization and policy engine, while security checks that tool call receives neither implicit authority nor unnecessary data.
Production decision criteria
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c41 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. Operations then observes the transition between user context and least privilege, while security checks that authorization receives neither implicit authority nor unnecessary data. If the least privilege verification fails, rollback restores the configuration around authorization, replays per-user-agent-tool-authorization-c41, and compares the new state with the control evidence from policy engine. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c42 starts at tool call and treats user context as an explicit boundary rather than an implicit assumption. The first control requires least privilege to emit an observable result before authorization can trigger the intended effect around policy engine. The conclusion stays bounded by least privilege and policy engine: anything not demonstrated by scenario per-user-agent-tool-authorization-c42 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns tool call into a reviewable decision point with a named input and a retained output. To test user context, fixture per-user-agent-tool-authorization-c42 contains both an allowed state and a rejected state; rejection must occur before any change attributed to least privilege.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c43 starts at user context and treats least privilege as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before policy engine can trigger the intended effect around tool call. Operations then observes the transition between authorization and policy engine, while security checks that tool call receives neither implicit authority nor unnecessary data. If the policy engine verification fails, rollback restores the configuration around tool call, replays per-user-agent-tool-authorization-c43, and compares the new state with the control evidence from user context. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to least privilege, a concrete condition, and evidence instead of a generic assurance.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c44 starts at least privilege and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires policy engine to emit an observable result before tool call can trigger the intended effect around user context. The conclusion stays bounded by policy engine and user context: anything not demonstrated by scenario per-user-agent-tool-authorization-c44 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns least privilege into a reviewable decision point with a named input and a retained output. To test authorization, fixture per-user-agent-tool-authorization-c44 contains both an allowed state and a rejected state; rejection must occur before any change attributed to policy engine.
Trust boundaries around tool call
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c51 starts at tool call and treats user context as an explicit boundary rather than an implicit assumption. The first control requires least privilege to emit an observable result before authorization can trigger the intended effect around policy engine. To test user context, fixture per-user-agent-tool-authorization-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to least privilege. Operations then observes the transition between least privilege and authorization, while security checks that policy engine receives neither implicit authority nor unnecessary data. If the authorization verification fails, rollback restores the configuration around policy engine, replays per-user-agent-tool-authorization-c51, and compares the new state with the control evidence from tool call.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c52 starts at user context and treats least privilege as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before policy engine can trigger the intended effect around tool call. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to least privilege, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by authorization and tool call: anything not demonstrated by scenario per-user-agent-tool-authorization-c52 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns user context into a reviewable decision point with a named input and a retained output.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c53 starts at least privilege and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires policy engine to emit an observable result before tool call can trigger the intended effect around user context. To test authorization, fixture per-user-agent-tool-authorization-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to policy engine. Operations then observes the transition between policy engine and tool call, while security checks that user context receives neither implicit authority nor unnecessary data. If the tool call verification fails, rollback restores the configuration around user context, replays per-user-agent-tool-authorization-c53, and compares the new state with the control evidence from least privilege.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c54 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to policy engine, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and least privilege: anything not demonstrated by scenario per-user-agent-tool-authorization-c54 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns authorization into a reviewable decision point with a named input and a retained output.
Build the decision path with user context
The starting point is not a feature; it is an observable decision boundary.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c61 starts at user context and treats least privilege as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before policy engine can trigger the intended effect around tool call. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns user context into a reviewable decision point with a named input and a retained output. To test least privilege, fixture per-user-agent-tool-authorization-c61 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization. Operations then observes the transition between authorization and policy engine, while security checks that tool call receives neither implicit authority nor unnecessary data.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c62 starts at least privilege and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires policy engine to emit an observable result before tool call can trigger the intended effect around user context. If the tool call verification fails, rollback restores the configuration around user context, replays per-user-agent-tool-authorization-c62, and compares the new state with the control evidence from least privilege. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by policy engine and user context: anything not demonstrated by scenario per-user-agent-tool-authorization-c62 is labeled as a limitation or inference, never promoted to fact.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c63 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns authorization into a reviewable decision point with a named input and a retained output. To test policy engine, fixture per-user-agent-tool-authorization-c63 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool call. Operations then observes the transition between tool call and user context, while security checks that least privilege receives neither implicit authority nor unnecessary data.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c64 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. If the least privilege verification fails, rollback restores the configuration around authorization, replays per-user-agent-tool-authorization-c64, and compares the new state with the control evidence from policy engine. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to tool call, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by user context and authorization: anything not demonstrated by scenario per-user-agent-tool-authorization-c64 is labeled as a limitation or inference, never promoted to fact.
Verify least privilege with observable evidence
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c71 starts at least privilege and treats authorization as an explicit boundary rather than an implicit assumption. The first control requires policy engine to emit an observable result before tool call can trigger the intended effect around user context. The conclusion stays bounded by policy engine and user context: anything not demonstrated by scenario per-user-agent-tool-authorization-c71 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns least privilege into a reviewable decision point with a named input and a retained output. To test authorization, fixture per-user-agent-tool-authorization-c71 contains both an allowed state and a rejected state; rejection must occur before any change attributed to policy engine.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c72 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. Operations then observes the transition between tool call and user context, while security checks that least privilege receives neither implicit authority nor unnecessary data. If the user context verification fails, rollback restores the configuration around least privilege, replays per-user-agent-tool-authorization-c72, and compares the new state with the control evidence from authorization. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to policy engine, a concrete condition, and evidence instead of a generic assurance.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c73 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. The conclusion stays bounded by user context and authorization: anything not demonstrated by scenario per-user-agent-tool-authorization-c73 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns policy engine into a reviewable decision point with a named input and a retained output. To test tool call, fixture per-user-agent-tool-authorization-c73 contains both an allowed state and a rejected state; rejection must occur before any change attributed to user context.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c74 starts at tool call and treats user context as an explicit boundary rather than an implicit assumption. The first control requires least privilege to emit an observable result before authorization can trigger the intended effect around policy engine. Operations then observes the transition between least privilege and authorization, while security checks that policy engine receives neither implicit authority nor unnecessary data. If the authorization verification fails, rollback restores the configuration around policy engine, replays per-user-agent-tool-authorization-c74, and compares the new state with the control evidence from tool call. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to user context, a concrete condition, and evidence instead of a generic assurance.
Evidence point: Model Context Protocol documents that for HTTP authorization, MCP requires resource-bound tokens, server-side audience validation and PKCE, and forbids insecure token passthrough patterns. This source anchors verify least privilege with observable evidence but does not replace local verification. [S7]Controls that remain after launch
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c81 starts at authorization and treats policy engine as an explicit boundary rather than an implicit assumption. The first control requires tool call to emit an observable result before user context can trigger the intended effect around least privilege. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to policy engine, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool call and least privilege: anything not demonstrated by scenario per-user-agent-tool-authorization-c81 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns authorization into a reviewable decision point with a named input and a retained output.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c82 starts at policy engine and treats tool call as an explicit boundary rather than an implicit assumption. The first control requires user context to emit an observable result before least privilege can trigger the intended effect around authorization. To test tool call, fixture per-user-agent-tool-authorization-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to user context. Operations then observes the transition between user context and least privilege, while security checks that authorization receives neither implicit authority nor unnecessary data. If the least privilege verification fails, rollback restores the configuration around authorization, replays per-user-agent-tool-authorization-c82, and compares the new state with the control evidence from policy engine.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c83 starts at tool call and treats user context as an explicit boundary rather than an implicit assumption. The first control requires least privilege to emit an observable result before authorization can trigger the intended effect around policy engine. This detail makes “Per-user tool authorization: never let the model become the policy engine” reviewable because each operational statement points to user context, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by least privilege and policy engine: anything not demonstrated by scenario per-user-agent-tool-authorization-c83 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Make application code decide whether a user may invoke a tool with specific parameters, while the model only proposes actions. It turns tool call into a reviewable decision point with a named input and a retained output.
In “Per-user tool authorization: never let the model become the policy engine”, scenario per-user-agent-tool-authorization-c84 starts at user context and treats least privilege as an explicit boundary rather than an implicit assumption. The first control requires authorization to emit an observable result before policy engine can trigger the intended effect around tool call. To test least privilege, fixture per-user-agent-tool-authorization-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to authorization. Operations then observes the transition between authorization and policy engine, while security checks that tool call receives neither implicit authority nor unnecessary data. If the policy engine verification fails, rollback restores the configuration around tool call, replays per-user-agent-tool-authorization-c84, and compares the new state with the control evidence from user context.
Evidence point: Docker documents that docker BuildKit can attach SBOM and provenance attestations so consumers can inspect image contents and build origin. This source anchors controls that remain after launch but does not replace local verification. [S8]Operational checklist
- The control around authorization has an input, a rule, a rejection behavior, and evidence.
- The control around policy engine has an input, a rule, a rejection behavior, and evidence.
- The control around tool call has an input, a rule, a rejection behavior, and evidence.
- The control around user context has an input, a rule, a rejection behavior, and evidence.
- The control around least privilege has an input, a rule, a rejection behavior, and evidence.
Sources and control points
- [S1] Configuring OpenID Connect in cloud providers — GitHub Actions OIDC lets workflows obtain cloud access without storing long-lived cloud credentials, provided trust conditions constrain token issuance. source
- [S2] OpenID Connect reference - GitHub Docs — GitHub documents OIDC token claims such as issuer, audience and subject that cloud trust policies can evaluate. source
- [S3] Secure use reference - GitHub Actions — GitHub recommends pinning third-party actions to full-length commit SHAs to obtain an immutable reference. source
- [S4] REST Security Cheat Sheet — OWASP REST guidance emphasizes HTTPS, explicit access control and careful handling of tokens, methods, inputs and security headers. source
- [S5] Application Security Checklist - Kubernetes — Kubernetes application guidance covers secure workload practices from the developer perspective. source
- [S6] Policies - Kubernetes — Kubernetes policy objects include NetworkPolicies for traffic controls and admission mechanisms for validating or mutating API requests. source
- [S7] Authorization - Model Context Protocol — For HTTP authorization, MCP requires resource-bound tokens, server-side audience validation and PKCE, and forbids insecure token passthrough patterns. source
- [S8] Build attestations - Docker Docs — Docker BuildKit can attach SBOM and provenance attestations so consumers can inspect image contents and build origin. source
- [S9] SBOM attestations - Docker Docs — Docker can generate SPDX SBOM attestations during BuildKit builds and provides local inspection workflows. source
- [S10] OWASP API Security Top 10 2023 — OWASP API Security Top 10 2023 highlights authorization failures, authentication weaknesses, resource abuse, SSRF, misconfiguration and unsafe API consumption. source
Comments
No published comment yet.
Sign in to comment