Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “oauth”
14 publicationsAdmit MCP servers before agents can call their tools
An MCP server's tool descriptions can change after approval with no new release. Record provenance and execution context, hash the definitions per authorization context, enforce the pin at a gateway or allowlist, and watch for drift.
AI systems · MCP / AWS / Anthropic / GitHub / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskRoll out Entra token protection without breaking unsupported clients
Token protection makes Entra ID refuse token requests that a device-bound session does not back. Scope it to supported apps and platforms, triage report-only data by code and platform, and cover what stays unbound.
Identity & access · Microsoft Entra / Microsoft Intune / Microsoft Graph · By Cloud Security DeskInvestigate a SaaS integration breach through its OAuth tokens
A vendor that stores OAuth tokens for your SaaS tenants has been breached. Confirm from your own logs what the tokens did, revoke them on every platform, and search the exposed records for secrets.
Detection & response · Salesforce / Google Workspace / Microsoft Entra ID · By Cloud Security DeskSeparate API gateway JWT checks from backend authorization
A gateway that accepts a JWT has checked its signature, issuer, audience and time window. It has not checked token type, revocation, cached decisions or object ownership. This mapping shows which side owns each decision.
Workload security · Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskMap the OWASP Top 10 for Agentic Applications to cloud controls
Each OWASP agentic risk mapped to the controls AWS, Microsoft and Google document for their agent platforms, with a plain account of which risks no infrastructure setting can close.
AI systems · OWASP GenAI Security Project / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskPrepare Azure automation for mandatory MFA on resource management
Azure now requires MFA for user accounts that write through Resource Manager. Find the scripts and pipelines that still sign in as people and move each one to a managed identity or federated credential.
Identity & access · Microsoft Azure / Microsoft Entra / GitHub / Azure DevOps / HashiCorp Terraform · By Cloud Security DeskGive AI agents their own identity instead of borrowed user tokens
An agent that replays a user's token is invisible in logs and cannot be revoked on its own. Give it a principal, delegate narrowly through token exchange, and use what Entra, AgentCore and Google now provide.
Identity & access · Microsoft Entra / Amazon Web Services / Google Cloud / IETF / Model Context Protocol · By Cloud Security DeskRequire authentication between Cloud Run services
Configure Cloud Run service-to-service authentication with a dedicated caller identity, the right ID token audience, and useful negative tests.
Workload security · Google Cloud · By Cloud Security DeskBind OAuth tokens to the client that presents them
DPoP can make possession of an access token insufficient for use, provided the issuer, client and resource server implement the same proof and key-binding contract.
Identity & access · IETF / Google · By Cloud Security DeskRestrict device code sign-in without breaking approved clients
Restrict device-code authentication through an explicit client and resource policy, and test the tracked sessions that can outlive the initial browser approval.
Identity & access · Microsoft / IETF · By Cloud Security DeskWorkload federation across clouds needs separate trust decisions
Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.
Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security DeskWhere fine tuning data needs a trust boundary
A training dataset can preserve its checksum and still teach the wrong behavior. Admission controls need to separate origin, transformation, approved use and the model change they produce.
AI systems · By Cloud Security DeskInvestigate an Entra application through grants and sign-ins
A successful service-principal sign-in is one event in a larger sequence. Connect it to credential changes, permission grants and the resource involved.
Detection & response · Microsoft Entra · By Cloud Security DeskKeep MCP tokens bound to the intended resource
Keep token audiences, user consent, and downstream tool authority separate when reviewing a protected HTTP MCP service.
AI systems · MCP · By Cloud Security Desk