https://alexandrecarrasco.dev/Recent content on Alexandre CarrascoHugoen-usSat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-1-fundamentals/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-1-fundamentals/AI agents act for people, choose their own actions at runtime, and read content that may be hostile. This post sets out the problem, the three layers needed to handle it, and a reference architecture built on standards that exist today.https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-2-agent-identity/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-2-agent-identity/An agent needs an identity of its own, separate from the user it works for. Without one, every call it makes looks like the user made it, and you cannot revoke, rate-limit or audit the agent without doing the same to the person. This part covers how an agent gets that identity, as an OAuth client and as a workload, and how it proves it on every request.https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-3-delegation/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-3-delegation/Part 2 gave the agent an identity. This part is about what happens when that agent acts for someone, and when the work passes through more services than the one the user consented to. The core tool is OAuth 2.0 Token Exchange (RFC 8693). Two OAuth working-group drafts extend it: one inside a trust domain, one across trust domains.https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-4-mcp-authorization/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-4-mcp-authorization/This part walks through the MCP authorization specification, revision 2026-07-28, as an implementer would meet it: what to discover, how to register, how to get a token, and what the server must check. Every requirement here comes from the spec or from the RFCs it cites.https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-5-tool-call-authorization/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-5-tool-call-authorization/Part 4 ended where the MCP spec ends: the token is valid for this server. This part covers the question that comes next on every request. May this agent, for this user, call this tool with these arguments, right now? The standard for asking it is the OpenID AuthZEN Authorization API 1.0, Final since January 2026. The standard for mapping MCP onto it is the COAZ-MCP binding, Draft 1.https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-6-human-in-the-loop/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-6-human-in-the-loop/Agents act while the user is somewhere else. Sooner or later a decision needs a person: to grant access in the first place, to prove it is really them, to approve something they cannot approve alone, or to confirm one specific action. This part maps each of those moments to the standard that handles it, and to the one rule that cuts across all of them.https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-7-operating-in-production/Sat, 14 Nov 2026 00:00:00 +0000https://alexandrecarrasco.dev/blogs/agentic-authn-authz-part-7-operating-in-production/Parts 1 to 6 built the controls. This part is about keeping them working once agents are live: recording what happened in a way you can trust, changing policy without breaking everything, noticing when a signal stops arriving, and pulling one agent out without taking its user down with it.