Security

RBAC for AI agents in Kubernetes

Give each AI agent its own service account, bind it to a narrow Role, and point its pod at that account. RBAC has no deny rules, so grants are the limit.

November 5, 2026 · 5 min read

How to map AI agents and humans to one identity model with OIDC

Put AI agents and people behind one OIDC issuer, register each agent as its own client, and map claims to the username your Kubernetes API server records for delegated…

November 5, 2026 · 7 min read

What is agent identity?

Agent identity gives each AI agent its own auditable principal. A Kubernetes service account names a workload, but cannot show which agent acted or for whom.

November 4, 2026 · 5 min read

How to allowlist MCP servers in Cursor

Allowlist MCP servers in Cursor by command or URL pattern in the team dashboard, then limit tools and network access for each server. Enterprise plans only.

November 3, 2026 · 6 min read

Cursor rules vs enforced policy: what stops an agent

Cursor rules are guidance, not enforcement. Learn which Cursor controls block a tool call or command, which only advise, and how to configure each one of them.

November 3, 2026 · 8 min read

How to onboard 1,000 developers to Claude Code without manual setup

Onboard many developers to Claude Code with one managed policy, delivered by server, MDM or file, then checked per machine with /status and claude doctor.

November 1, 2026 · 5 min read

How to govern Claude Cowork in the enterprise

Govern Claude Cowork with managed keys for egress, folders and tools, per-group policies, OpenTelemetry export and Compliance API transcript retrieval.

November 1, 2026 · 7 min read

Using Claude on Amazon Bedrock with Claude Code and Cowork

Set up Claude Code and Claude Cowork on Amazon Bedrock with AWS sign-in, pinned model IDs, a managed model allowlist and the IAM policy that each one needs.

October 31, 2026 · 10 min read

How to run Claude Code in a sandbox

Turn on Claude Code's Bash sandbox, set its file and network limits, or run the whole session in a dev container. Settings and commands from the docs.

October 31, 2026 · 7 min read

Governing Claude Code, Cursor and Copilot with one policy

Claude Code, Cursor and Copilot each have different admin controls. Compare their permissions, MCP, hooks and network limits, and see where each one stops.

October 31, 2026 · 8 min read

Prompt injection defense for agents: what actually works

Prompt injection defense for agents that holds: deny rules, hooks that exit 2, sandboxed shell and MCP approval, each with the limits its docs spell out.

October 30, 2026 · 7 min read

AI coding agent security risks (and the controls for each)

The main risks of AI coding agents, from prompt injection to leaked secrets and unvetted MCP servers, each paired with a control and the point where it stops.

October 30, 2026 · 5 min read