An adversarial review of a conference workshop's build plan found a genuine structural flaw in its Auth0 FGA model, not a polish problem. The check it ran on a citizen's own record was trivially always true, which meant the demo's actual premise - authorising an AI agent acting on someone's behalf - was never being tested at all.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
Building Genuinely Ephemeral Sessions with Auth0 Actions and Next.js
· Auth0, Customer Identity Products, Actions
Auth0's Manage Sessions with Actions APIs let a Post-Login Action set a non-persistent cookie mode and short expiry on the Authorization Server's own session. Getting a genuinely ephemeral login end-to-end took matching that on the app's own session too, and an access token that turned out not to be a JWT.
Auth0 Token Vault: Connecting Google Calendar and GitHub on a User's Behalf
· Auth0, Customer Identity Products, Identity Security
Auth0's Token Vault lets your app call Google or GitHub APIs with a user's own consent, without the user's password ever touching your app. Getting it working end to end took five separately-gated prerequisites, each with its own unrelated-looking error message.
Adversarial review, real bugs, and dead ends: building an OpenFGA model with Claude Code
· Auth0, Customer Identity Products, Auth0 FGA
An adversarial review across two different AI models caught a real OpenFGA semantics bug in the model behind this series, and also produced confident, specific-sounding nonsense that didn't survive being checked. Both outcomes are worth writing up.
AI agents, approval gaps, and the edges of a persona model
· Auth0, Customer Identity Products, Auth0 FGA
The model from this series has humans and businesses as principals, but not agents, and no way to represent a delegation that's been requested but not yet approved. Both turned out to need real additions, not workarounds.
Delegation you can put a number on
· Auth0, Customer Identity Products, Auth0 FGA
Every delegation in this series so far has been bounded by time. This post covers the other kind: bounded by a dollar figure, or a dollar figure and a category together, checked fresh against every attempted spend rather than a stored running total.