Archive
What changes when software can act: the six-part threat model for autonomous agents, seven controls that hold, four that do not, a 90-day sequence, and how to verify each control by attempting what should be refused.
Read the guide →A complete guide to MCP security and governance: threat model, authentication, tool poisoning, injection defence and audit evidence.
Read the guide →An MCP server exposes tools; an MCP gateway governs access to many servers. What each does, and when you need the gateway.
Read the guide →A practical review process for third-party MCP servers: inventory, tool risk scoring, policy authoring and simulation before enforcement.
Read the guide →Indirect prompt injection explained: how instructions hidden in data reach a tool call, and the controls that stop them at execution.
Read the guide →Four MCP authentication patterns compared: shared keys, per-user OAuth, delegated tokens and dynamic scopes, with the tradeoffs of each.
Read the guide →