project
Open Policy Agent (OPA) is an open-source, CNCF-graduated policy engine that uses the Rego language to enforce authorization rules across cloud-native systems.
Keeping the Iceberg table format governance-unaware was a deliberate call. That leaves the catalog as the only thing standing on the path of every read. A dev.to guide lists six pieces an operator has to source above it.
Reality
A dev.to design post puts a per-task scope check under every tool invocation and caps the agent's cloud credentials at fifteen minutes. The restrictions work by taking capability away from the model.
Reality
Arcjet's new product evaluates an agent's next action inside application code, returning an allow or deny before the tool call runs, with policies written in Rego and managed centrally by the security team.
Reality
Arcjet's new runtime security takes agent activity in through the OpenTelemetry pipelines platform teams already run, then evaluates each tool call against Open Policy Agent rules before it executes and again after.
Reality
A dev.to checklist of ten software delivery gates for AI agents insists every check be automated, fast, blocking and observable. The gate its author calls no replacement for human review cannot meet that bar.
Reality
Mandatum signs each delegation link to its parent by hash and leaves the decision to an AuthZEN policy engine. The sequence check that blocks a write after an external read needs a single in-process enforcement point.
Reality
The New Stack's three-pillar recipe for cloud resource ownership pairs a CloudQuery inventory query with an env0 admission policy and a creation-time audit record. Two of them look for the owner in different places.
Reality
EU Cyber Resilience Act enforcement starts in September with personal liability for security leaders written in, according to JFrog, so the lag between an auditor's request and the proof now has a named owner.
Reality
A CNCF blog post walks through moving an authentication service that a whole region logged in through. The interesting part is that its internal DNS path and its ingress path have different tolerances for overlap.
Reality
Joint guidance from AWS and the SANS Institute argues that an agent's system prompt can be talked around, so retrieval has to be scoped to the requesting user's own entitlements and filtered before the model sees results.
Reality
The discovery sample walks the Identity Center instances in an organization and writes assignments to a queryable store plus CSV, which covers three of the four questions AWS poses and leaves last access to something else.
Reality
The pitch rests on a claim about your repository rather than about Harness's software, and with a free tier and click-through migration, the expensive part of testing it is the wiring you would have to move.
Reality
Amazon says you should be able to name every AI agent touching customer data in under a minute. Its own worked example explains why most teams cannot: the record is a file on a laptop.
Reality
The CNCF's argument is that the CLOUD Act reaches European soil, so "our servers are in Frankfurt" buys residency and not control. The boundary that holds is infrastructure you can run yourself.
Reality