An adversarial review across two different AI models caught a real OpenFGA semantics bug in the model behind this series, and also produced confident, specific-sounding nonsense that didn't survive being checked. Both outcomes are worth writing up.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
AI agents, approval gaps, and the edges of a persona model
· Auth0, Customer Identity Products, Auth0 FGA
The model from this series has humans and businesses as principals, but not agents, and no way to represent a delegation that's been requested but not yet approved. Both turned out to need real additions, not workarounds.
Delegation you can put a number on
· Auth0, Customer Identity Products, Auth0 FGA
Every delegation in this series so far has been bounded by time. This post covers the other kind: bounded by a dollar figure, or a dollar figure and a category together, checked fresh against every attempted spend rather than a stored running total.
Verified directors and public registries: identity proofing meets FGA
· Auth0, Customer Identity Products, Auth0 FGA
A company registry needs three things a subscription service doesn't: a public entry anyone can search, a governance role distinct from day-to-day admin, and proof that whoever holds that role is who they say they are.
Building Embedded Passkey Login with Auth0
· Auth0, Customer Identity Products, passkey
Auth0's Passkey APIs let you build passkey sign-in directly into your own UI instead of redirecting to Universal Login. Here's how that fits alongside Universal Login, what self-service passkey management looks like hand-rolled versus with Auth0's official pre-built components, and one Allowed Origins (CORS) setting worth checking before you go looking for a WebAuthn bug that isn't there.
One authorisation model, a dozen industries
· Auth0, Customer Identity Products, Auth0 FGA
It's easy to claim an authorisation model is generic. It's more convincing to run the exact same model, unmodified, across media, healthcare, financial services, telco, retail and legal case management, and show the tests passing every time.