Volume 2

Build AI systems that can act without giving them authority they should never have.
When an AI agent calls a tool, retrieves a document, or acts on someone's behalf, a valid login is only the beginning. You also need to control which resources it can access, which actions it can perform, and where an unauthorized operation will actually be stopped.
This book helps you turn those questions into practical engineering decisions.

What You Will Gain
Protect sensitive data. Learn how to enforce ownership, tenant isolation, and resource-level authorization so an authenticated agent cannot simply access another user's records.
Keep identities and permissions clear. Distinguish human identity, application identity, workload identity, and delegated authority. Understand how OAuth, OpenID Connect, JWTs, and JWKS fit together without treating every credential as interchangeable.

Secure MCP tool and resource boundaries.
Understand resource-specific tokens, audience validation, policy enforcement, and the importance of matching implementation behavior to the selected protocol revision.
Contain prompt-injection damage. Design controls that treat model-generated arguments and retrieved content as untrusted input. Move critical authorization decisions outside the model and into components that can prevent access or side effects.
Control consequential actions. Explore narrowly scoped delegation, exact-action approvals, replay resistance, and authorization checks for queued or retried work.

Choose security mechanisms deliberately.
Evaluate where application checks, OPA policies, PostgreSQL row-level security, workload identity, and Istio-based controls can help, including their limitations and operational tradeoffs.
Test the denied path, not just the successful request. Develop negative tests for wrong audiences, cross-tenant access, policy failures, dependency outages, and other boundary violations.
Make security evidence useful. Learn to connect threats, controls, tests, audit events, and release decisions so you can explain what has been demonstrated and what remains unverified.

Learn Through a Running Code
A learning-assistant scenario makes abstract security concepts concrete: a learner requests their progress, an agent selects a tool, and a service must enforce the correct access boundary.
Across 24 chapters, 14 appendices, and 87 technical figures, you will find implementation examples, adversarial challenges, decision tables, attack catalogues, and verification procedures. A focused Python reference lab supports selected authorization patterns; broader integrations are presented with their implementation and acceptance requirements.

Who Will Benefit
Software developers, AI and agent engineers, solution architects, platform engineers, and security reviewers who need to design or assess systems where agents call tools and access protected resources.
The central benefit: a clearer method for deciding who may do what, to which resource, under which conditions, and how to prove that the boundary holds.