What topics does the APort blog cover?

The blog covers AI agent authorization, policy enforcement, MCP security, SOX/GDPR/HIPAA evidence workflows, attestations, and best practices for securing AI-orchestrated APIs.

How often is the blog updated?

We publish new articles regularly on AI agent governance, integration guides, and audit evidence updates. Subscribe or check back for the latest insights.

APort Blog

Latest articles, guides, and updates about AI agent trust, security, and the Open Agent Passport specification

Showing 1-12 of 44 posts

September 21, 2026

16 min read

by Uchi Uchibeke

Research

The model believed a forged receipt. APort checked the payment.

An attacker asked Alibaba's Qwen3.8 Max to pay an IT provider. Inside the user message, the attacker pasted text pretending to be a recipient-verification...

ai-agent-security payment-authorization prompt-injection pre-action-authorization benchmark open-agent-passport

April 9, 2026

12 min read

by APort

Comparison

Best AI Agent Guardrails for Pre-Action Authorization

Summary: The best AI agent guardrails for a team are the ones that cover its actual action paths. A filter that rejects harmful text, a sandbox that restricts...

ai-guardrails comparison pre-action-authorization agent-security galileo nemo microsoft llamafirewall guardrails-ai

April 8, 2026

22 min read

by Uchi Uchibeke

Guide

AI Agent Authorization: The Complete Guide to Pre-Execution Guardrails

TL;DR AI agent authorization is the runtime decision layer that answers a single question: "Is this specific agent allowed to execute this specific tool call,...

ai-agent-authorization pre-execution-guardrails agent-security policy-enforcement ai-identity oap

April 2, 2026

5 min read

by Uchi Uchibeke

Explainer

What Is APort? Pre-Action Authorization for AI Agents, Explained

TL;DR APort is pre-action authorization infrastructure for AI agents. It enforces policy before a tool call executes — not after. The core spec is the Open...

aport pre-action-authorization ai-agent-security what-is-aport ai-agents identity authorization

October 4, 2026

5 min read

by APort

Security

Web Fetch SSRF in AI Agents: URL Checks Are Not Egress Control

Summary: A team letting an agent fetch URLs needs to prevent private-network access through destinations that look acceptable before execution. A URL policy...

ssrf-ai-agent pre-action-authorization

October 3, 2026

4 min read

by APort

Governance

Agentic AI Governance for Employee AI Tools

Summary: An IT team governing employee AI tools needs to know who owns each agent, which actions it may take, and who can change that authority. A tool...

ai-agent-governance pre-action-authorization

October 3, 2026

3 min read

by APort

Enterprise

How to Roll Out Claude Code for a Developer Team

Start with the workflow the team wants to keep Pick a repository where developers use Claude Code for a concrete task, such as a reviewed code change. Write...

claude-code-rollout enterprise-ai-governance

October 3, 2026

3 min read

by APort

Enterprise

Manage AI Agent Rollout Scripts Across Enterprise Devices

One entry point still needs a deployment owner A managed rollout script can reduce manual setup across developer machines. It still needs a chosen framework,...

mdm-agent-rollout enterprise-deployment

October 2, 2026

4 min read

by APort

Security

AI Agent Security Starts at the Tool Call

Summary: A security buyer needs to know which action an agent can take, where it can be stopped, and what evidence remains afterward. Model behavior alone does...

ai-agent-security pre-action-authorization

October 1, 2026

5 min read

by APort

Security

MCP Authorization vs MCP Security: Where OAuth and OAP Fit

Summary: A platform team can authenticate an MCP client and still lack a check on the operation the agent proposes. The MCP authorization specification dated...

mcp-authorization pre-action-authorization

September 30, 2026

5 min read

by APort

Security

Claude Code Security: What Hooks Can and Cannot Enforce

Summary: A security team needs evidence that Claude Code cannot bypass a restriction through an unguarded tool or an editable policy. Installing a hook is only...

claude-code-security pre-action-authorization

A payment request is not a policy decision: 4,371 human attacks, 14 models, one question

September 23, 2026

15 min read

by Uchi Uchibeke

Research

A payment request is not a policy decision: 4,371 human attacks, 14 models, one question

An attacker asked Alibaba's Qwen3.8 Max, acting as a bank teller, to pay an IT provider. Pasted inside the user message was text pretending to be a tool...

benchmark pre-action-authorization payment-authorization prompt-injection open-agent-passport ai-agent-security

APort Blog

The model believed a forged receipt. APort checked the payment.

Best AI Agent Guardrails for Pre-Action Authorization

AI Agent Authorization: The Complete Guide to Pre-Execution Guardrails

What Is APort? Pre-Action Authorization for AI Agents, Explained

Web Fetch SSRF in AI Agents: URL Checks Are Not Egress Control

Agentic AI Governance for Employee AI Tools

How to Roll Out Claude Code for a Developer Team

Manage AI Agent Rollout Scripts Across Enterprise Devices

AI Agent Security Starts at the Tool Call

MCP Authorization vs MCP Security: Where OAuth and OAP Fit

Claude Code Security: What Hooks Can and Cannot Enforce

A payment request is not a policy decision: 4,371 human attacks, 14 models, one question

Filter by Category

Popular Tags

The model believed a forged receipt. APort checked the payment.

Best AI Agent Guardrails for Pre-Action Authorization

AI Agent Authorization: The Complete Guide to Pre-Execution Guardrails

What Is APort? Pre-Action Authorization for AI Agents, Explained

Web Fetch SSRF in AI Agents: URL Checks Are Not Egress Control

Agentic AI Governance for Employee AI Tools

How to Roll Out Claude Code for a Developer Team

Manage AI Agent Rollout Scripts Across Enterprise Devices

AI Agent Security Starts at the Tool Call

MCP Authorization vs MCP Security: Where OAuth and OAP Fit

Claude Code Security: What Hooks Can and Cannot Enforce

A payment request is not a policy decision: 4,371 human attacks, 14 models, one question