Securing HelixWorks: Enterprise Agent Authorization

Harden the same HelixWorks product across twelve security-focused days. Progressively add tenant-aware identity, exact capability grants, workload identity, connector and MCP policy, delegation, approvals, revocation, audit evidence, threat models, and release gates.

1. 01Create, Own, Version, and Bind an AgentMake agent logic portable across teams while keeping ownership durable, releases immutable, credentials local, and every share independently revocable.Published 04 Aug 20268 sections
2. 02Application Knowledge and Two-Plane AuthorizationSource: How Enterprise Authentication and Authorization Work in an Agent Platform, sections 24–30; extends “Two Planes of Authorization” with provider, hosted-runtime, and generated-application ownership.Published 04 Aug 20268 sections
3. 03Connector Credentials and Workload IdentityProvision durable connector authority without placing reusable secrets in an agent runtime, then prove that team-owned automation stays bounded, attributable, and independently revocable.Published 04 Aug 20268 sections
4. 04Identities and Effective AuthoritySeparate every principal in an enterprise agent run, then calculate authority as an intersection rather than an inheritance chain.Published 04 Aug 20268 sections
5. 05Enterprise Login, Teams, OAuth 2.0, and OpenID Connect (OIDC)Turn an enterprise sign-in into a current organization-and-team context, then distinguish platform login from machine and human connector delegation.Published 04 Aug 20268 sections
6. 06Run Authorization and Capability TokensAuthorize one immutable deployment before execution, keep broad credentials out of the runtime, and issue short-lived proof for exactly one downstream action.Published 04 Aug 20268 sections
7. 07Model Context Protocol (MCP) Tool and Argument AuthorizationTreat every model tool call as an untrusted proposal, filter MCP discovery before it reaches the prompt, and authorize the exact arguments again at execution time.Published 04 Aug 20268 sections
8. 08Delegated and Managed Model Context Protocol (MCP) AccessChoose and prove the right MCP authority mode: durable team-owned service access for automation first, optional user delegation for on-behalf-of work, and enterprise policy for discovery.Published 04 Aug 20268 sections
9. 09Human Approval and Agent DelegationPause exact high-risk tool intents for accountable human review, then let one agent invoke another without expanding the original user’s or team’s authority.Published 04 Aug 20268 sections
10. 10Network Trust, Infrastructure, and DeliverySource: How Enterprise Authentication and Authorization Work in an Agent Platform, sections 28–33; extends “Two Planes of Authorization” into workload identity, infrastructure ownership, and release controls.Published 04 Aug 20268 sections
11. 11Revocation, Audit, and ObservabilitySource: How Enterprise Authentication and Authorization Work in an Agent Platform, sections 30 and 35; preserves the generated-application revocation model migrated from the former Sharing, Roles, and Revocation lesson.Published 04 Aug 20268 sections
12. 12Threat Model, Tests, and RolloutSource: How Enterprise Authentication and Authorization Work in an Agent Platform, sections 34 and 36–39; turns the final architecture and implementation order into release evidence.Published 04 Aug 20269 sections