we need new words for authn and authz that don't have anything to do with each other
December 22, 2024 at 7:13 PM
we need new words for authn and authz that don't have anything to do with each other
So anyways we implemented a new League of Legends spell for authz.
June 2, 2025 at 1:07 PM
So anyways we implemented a new League of Legends spell for authz.
This bambu stuff is so dumb. Why on earth did they make a proprietary "network" "plugin" solely to obfuscate communication with their servers? Why not just... design a proper web API with proper authn and authz?
May 22, 2026 at 3:29 AM
This bambu stuff is so dumb. Why on earth did they make a proprietary "network" "plugin" solely to obfuscate communication with their servers? Why not just... design a proper web API with proper authn and authz?
What are people using for authz in these chains of AI agents?
March 12, 2025 at 8:46 PM
What are people using for authz in these chains of AI agents?
I started an authz company, we use "identity" and "permissions"
December 22, 2024 at 7:20 PM
I started an authz company, we use "identity" and "permissions"
Okta is an oidc/oauth2 provider. I'm not familiar with Twitter's authN/authZ technology, nor can say whether this is real or not. But oidc does cover authZ (what can you do), so it's within possibility that if twitter has this special user authz it could be exposed by unprotected okta information.
July 24, 2024 at 10:06 PM
Okta is an oidc/oauth2 provider. I'm not familiar with Twitter's authN/authZ technology, nor can say whether this is real or not. But oidc does cover authZ (what can you do), so it's within possibility that if twitter has this special user authz it could be exposed by unprotected okta information.
after wasting like three days trying to deal with inconsistent behavior in oidc/oauth2 implementations i have become a radical transparency advocate
fuck authn, fuck authz
fuck authn, fuck authz
May 15, 2024 at 4:28 PM
after wasting like three days trying to deal with inconsistent behavior in oidc/oauth2 implementations i have become a radical transparency advocate
fuck authn, fuck authz
fuck authn, fuck authz
I've contemplated a separate subdomain for the authz endpoints in millipds (it's good for security™)
May 11, 2025 at 9:40 PM
I've contemplated a separate subdomain for the authz endpoints in millipds (it's good for security™)
authn is short for authentication, authz is short for authorization
December 22, 2024 at 7:32 PM
authn is short for authentication, authz is short for authorization
Folks also often miss the fact that CLIs are perfectly fine if you have an unrestricted local environment. What happens when I want to do something from my phone or a corporate machine that requires data exfil controls and fine-grained AuthZ?
I think this is functionally true not because MCP is bad but because most implementations are “CLI but worse”
MCP is actually an interaction design problem but most people are treating it as… not that
MCP is actually an interaction design problem but most people are treating it as… not that
this has been basically universally true in my experience. If there's a CLI, it beats the MCP. And I think most people are coming around to that.
May 10, 2026 at 5:51 PM
Folks also often miss the fact that CLIs are perfectly fine if you have an unrestricted local environment. What happens when I want to do something from my phone or a corporate machine that requires data exfil controls and fine-grained AuthZ?
this is my line: all agent work should be attributed to a human
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
I also DO like how an agent's "work" is now attributed to the dev kicking it off
As it should be!!
In the end, the dev still 100% responsible for shipping code. If they ship a regression: that was the DEV's decision. AI doesn't "decide" anything - it's a tool!
As it should be!!
In the end, the dev still 100% responsible for shipping code. If they ship a regression: that was the DEV's decision. AI doesn't "decide" anything - it's a tool!
May 24, 2025 at 7:04 PM
this is my line: all agent work should be attributed to a human
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
it’s a simple rule that vastly simplifies just about any authz/authn conversation around agents
it also provides clear guidance for how an agent fits into an organization (socially speaking)
September 7, 2025 at 6:55 PM
me when a software engineer is explaining why they put their web app's authZ logic in the front-end code
April 17, 2026 at 4:55 AM
me when a software engineer is explaining why they put their web app's authZ logic in the front-end code
You should expect hostile actors to be trying to exploit your agents going forward. This is why I'm building a whole authz / taint / IFC framework into my harness to protect against it.
August 30, 2026 at 12:41 PM
You should expect hostile actors to be trying to exploit your agents going forward. This is why I'm building a whole authz / taint / IFC framework into my harness to protect against it.
📦 gsebastiao/laravel-authz v3.1.0
Grupos e permissões (RBAC) para Laravel, simples de começar: cascata de prioridade, validade por data, multi-tenant, cache e auditoria opcionais.
🔗 https://github.com/gsebastiao/laravel-authz
Grupos e permissões (RBAC) para Laravel, simples de começar: cascata de prioridade, validade por data, multi-tenant, cache e auditoria opcionais.
🔗 https://github.com/gsebastiao/laravel-authz
September 22, 2026 at 1:22 PM
📦 gsebastiao/laravel-authz v3.1.0
Grupos e permissões (RBAC) para Laravel, simples de começar: cascata de prioridade, validade por data, multi-tenant, cache e auditoria opcionais.
🔗 https://github.com/gsebastiao/laravel-authz
Grupos e permissões (RBAC) para Laravel, simples de começar: cascata de prioridade, validade por data, multi-tenant, cache e auditoria opcionais.
🔗 https://github.com/gsebastiao/laravel-authz
Oh, so when people here say "authz" it's actually a proper term and not some slang for "authenticationz"… 🫠
August 21, 2024 at 1:36 AM
Oh, so when people here say "authz" it's actually a proper term and not some slang for "authenticationz"… 🫠
We had the wildest hallucination at work the other day. Asked it to define a authz method. Told us it was a League of Legends spell. LoL spell doesn’t exist. Ask 3 AIs, all say same. Ask each for source. Source is a Star Wars Galaxies forum post that doesn’t even contain the words.
June 2, 2025 at 1:07 PM
We had the wildest hallucination at work the other day. Asked it to define a authz method. Told us it was a League of Legends spell. LoL spell doesn’t exist. Ask 3 AIs, all say same. Ask each for source. Source is a Star Wars Galaxies forum post that doesn’t even contain the words.
Everything from Maps to Drive to Translate ran APIs on that infrastructure, which handled all authn/authz, logging, API key and OAuth token infra, routing, protocol translation (JSON/REST to Stubby), etc. And we were pretty proud of what it could handle.
February 19, 2026 at 12:22 AM
Everything from Maps to Drive to Translate ran APIs on that infrastructure, which handled all authn/authz, logging, API key and OAuth token infra, routing, protocol translation (JSON/REST to Stubby), etc. And we were pretty proud of what it could handle.
sometimes I build elaborate mental constructions in my mind of how a world could have all the digital stuff work completely free of any concept of authN and authZ even needing to be a thing and it ends up looking like big factory control substations and all I’ve done is recreated electromechanics
I continue to be so confused by people not liking passkeys.
I love the UX, such an improvement.
Do y'all have a magical password manager that works without 15 taps in mobile apps?
Or are you self-defeating by not using the built-in (Chrome or iCloud) authenticator? Is this a Linux desktop issue?
I love the UX, such an improvement.
Do y'all have a magical password manager that works without 15 taps in mobile apps?
Or are you self-defeating by not using the built-in (Chrome or iCloud) authenticator? Is this a Linux desktop issue?
May 2, 2026 at 9:12 PM
sometimes I build elaborate mental constructions in my mind of how a world could have all the digital stuff work completely free of any concept of authN and authZ even needing to be a thing and it ends up looking like big factory control substations and all I’ve done is recreated electromechanics
authz is where the auth zombies live
November 15, 2024 at 6:48 AM
authz is where the auth zombies live
There was a similar thing around tls-authz on ietf@ in early 2009 – maybe?
July 1, 2026 at 11:29 PM
There was a similar thing around tls-authz on ietf@ in early 2009 – maybe?
With AI agents on the horizon, we'll need better authn/authz primitives to grant access to agents in a fine-granular way beyond just "Login with Google".
Who is doing interesting work in this regard?
Who is doing interesting work in this regard?
February 2, 2025 at 10:23 AM
With AI agents on the horizon, we'll need better authn/authz primitives to grant access to agents in a fine-granular way beyond just "Login with Google".
Who is doing interesting work in this regard?
Who is doing interesting work in this regard?
Need some reading material to catch up on Ash and all the things it can do (a ton)? #ElixirLang
Ash has an upcoming book with PragProg that covers:
- Domain models and forms with LiveView
- Auth and authz
- dynamic search
- Rest and GraphQL APIs
- notifications (tbd)
pragprog.com/titles/ldash...
Ash has an upcoming book with PragProg that covers:
- Domain models and forms with LiveView
- Auth and authz
- dynamic search
- Rest and GraphQL APIs
- notifications (tbd)
pragprog.com/titles/ldash...
Ash Framework
Explore the power of Ash Framework by modeling and building the domain for a real-world web application.
pragprog.com
January 12, 2025 at 4:00 PM
Need some reading material to catch up on Ash and all the things it can do (a ton)? #ElixirLang
Ash has an upcoming book with PragProg that covers:
- Domain models and forms with LiveView
- Auth and authz
- dynamic search
- Rest and GraphQL APIs
- notifications (tbd)
pragprog.com/titles/ldash...
Ash has an upcoming book with PragProg that covers:
- Domain models and forms with LiveView
- Auth and authz
- dynamic search
- Rest and GraphQL APIs
- notifications (tbd)
pragprog.com/titles/ldash...
Can we just start using `authz` for authorization and keep `auth` for authentication 🙌?
June 6, 2025 at 4:02 PM
Can we just start using `authz` for authorization and keep `auth` for authentication 🙌?