IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Cheat sheet & pop quiz
Here is the whole track on one page: one idea per lesson, a checklist for shipping day and five scenarios to test yourself.
Twelve ideas that secure an agent
| # | If you remember nothing else… |
|---|---|
| 1 | Every tool call has two principals: the human it runs for and the agent that made it. A scope says what KIND of action. FGA says WHICH one. A scope is a hard limit; a prompt is only a request. An MCP server accepts only tokens issued for it and never passes a token on. |
| 2 | Roles ask "what is this person?" ReBAC and FGA ask "may this person touch this thing?" Each fact is one tuple (user, relation, object). Each decision is one Check, made at use time. |
| 3 | Retrieval ranks by similarity and is blind to permissions. Check every chunk for the human who asks, never the bot's service account, before the model reads. Change the retriever, keep the check. |
| 4 | Reads run free. Writes wait for a human. CIBA pushes to a channel the agent cannot touch. A binding message shows what you approve. RAR (RFC 9396) gives policy and audit a machine-readable record. |
| 5 | You cannot govern what you cannot see. The audit ledger IS the registry. Version stamps show library drift. The kill switch disables the agent's OAuth client. Absence is the signal. |
| 6 | Your agent needs your calendar, not your password. OAuth delegation and a federated token vault keep the refresh token. The agent gets a short-lived, scoped token for each call and drops it. |
| 7 | A copilot reads and acts as YOU, never with a master key (the confused deputy). Authorize the read, govern the act, and let delegation only narrow authority. |
| 8 | The five controls fit together in one assistant you can trust. It sees only what you may. It acts only through the pipeline. It stops for you on spending. It hands on only less power. |
| 9 | A model cannot tell data from commands. Assume it will be fooled. Put the controls outside it: least-privilege tools, human approval, output allow-lists. Never let retrieved text raise permissions. |
| 10 | Notes are stored text that Kai trusts later. Save only what the user said, label the source and let notes expire. A tool that changed after you approved it needs a fresh review: pin a hash and re-approve on change. |
| 11 | At every hop use token exchange (RFC 8693). The token keeps sub = the user, plus a growing act chain. Scope only shrinks down the chain. |
| 12 | Record who (agent and human), what, why (approval reference), when and outcome in an append-only, hash-chained log. A quiet edit then breaks the chain. |
Before you ship an agent, ask…
| The question | Where it is answered |
|---|---|
| Does it have its own identity, or does it hide behind a user's login? | Governing MCP · Non-human identities |
| Does each MCP server accept only tokens issued for it, and never pass them on? | Governing MCP |
| Does retrieval use the caller's permissions and filter before the model reads? | Permission-aware RAG · FGA / ReBAC |
| Can a human veto actions that move money, on a channel the agent cannot touch? | Human-in-the-loop (CIBA and RAR) |
| Can you see every agent, and switch them off, from one place? | The agent registry and kill switch |
| Do third-party keys live in a vault, never in the agent's own database? | Delegated third-party access |
| Does delegation only narrow authority, with an exchanged token and the agent named in the act claim? | Token exchange (RFC 8693) · Agent-to-agent delegation |
| Is every call written to one audit ledger: user, agent, tool, verdict, version? | The agent registry · Agent audit trails |
| Does the agent always run as the human, so it cannot be a confused deputy? | A secure copilot, step by step |
| Are saved notes labeled with their source, and is a changed tool reviewed again? | Poisoned memory and changing tools |
Pop quiz: five questions
Q1 · Kai is answering a billing question for Maya. Kai needs to read her invoices through a billing tool. What token should Kai show, and how is it made?
An on-behalf-of (token exchange) token (RFC 8693). The subject (sub) is Maya. Kai is named in the act claim. The token has one read-only scope and works for that one server. The scope check reads the new token, not the old one. So delegation only narrows authority (MCP governance · secure copilot).
Q2 · Priya's copilot gets the top-K chunks for "executive pay". The confidential board pack ranks first, but Priya may not see it. What stops the leak, and where?
A per-chunk FGA check, Check(priya, can_view, chunk's document), run before the model reads. Denied chunks are dropped. The check is for Priya, never the bot's service account that can read everything. It runs at use time, so a share revoked a minute ago is already gone (permission-aware RAG built on relationship checks).
Q3 · Kai wants to buy Maya a ₹500 add-on at 3 a.m. while she sleeps. How can she approve it without a code that can be phished and without a pop-up nobody watches?
CIBA: a backchannel push to her enrolled phone, a device Kai does not control. It carries a binding message (BUY-4821 · 5 GB · ₹500) on both screens. So she approves one specific deal. RAR's authorization_details (RFC 9396) gives policy and audit a readable record. The pending request stays on the server, and the token covers that one action only (human-in-the-loop).
Q4 · Zara needs one view of every AI agent, and a way to stop one at once. Where does the list come from? What does the kill switch disable? Why might a rogue agent be missing?
The registry is the audit ledger, grouped. It has one row per governed call (agent · tool · verdict · library version). The kill switch disables the OAuth client the agent uses to get its token by the on-behalf-of exchange. No token means no governed call, and you can undo the switch. A rogue agent that does not use the library leaves no rows and shows zero forever. Absence is the signal (the registry and kill switch).
Q5 · Sam, a partner agent, wants to summarize Maya's calendar. How does it get in without her calendar password or a long-lived refresh token?
OAuth delegation, not passwords and not screen-scraping. Maya agrees once at the provider (calendar scope only). The refresh token lives in the federated token vault at the IdP. For each call, Sam shows its own session and gets a short-lived, scoped access token. It uses the token and drops it. Connect once, check out per call (delegated third-party access).
You can now govern an agent from end to end. You can control its identity, what it reads, what it does and who approves. And you know how to switch it off. Next up is the day-to-day work that keeps this running: joiner-mover-leaver at machine speed, telemetry, and forgetting on request. Start with the Identity Operations intro.
Put the whole track to work. Browse our free security micro-tools on the tools shelf. Explore our AI and agent security services. Talk to our team when you are ready to design the real thing.