GatekeeperID Research
Research, technical analysis, and studies on identity security, authorization, and autonomous agents. Evidence, real incidents, and architecture decisions for organizations that build secure systems.
See the risks of AI agents with excessive permissions, the 2026 research behind them, and how RBAC, human approval, and GatekeeperID Agents help protect databases.
GPT-6.1 Terra bypassed restrictions in 29.6% of the evaluated tests. GatekeeperID Agents separates asking for an operation from being allowed to run it on PostgreSQL.
Connecting an assistant to the database does not define its permissions. GatekeeperID Agents puts identity and control on the path between the agent and PostgreSQL.
How OAuth2 and OpenID Connect differ, when to use each, and how they show up in modern authentication and authorization.
What RBAC is, how roles differ from permissions, and how to keep access control organized in Java APIs.
How multi-tenant authentication works, where it gets hard, and how to separate customers, users, permissions, and settings.
Login looks small until you add passwords, tokens, refresh, recovery, social login, audit, and security. Here is what that costs.
How a JWT works, what claims such as sub, iss, aud, and exp mean, and what to watch when APIs rely on tokens.
How annotations simplify permission checks in Spring Boot APIs, instead of scattering rules through the code.
The ideas behind social login with Google, GitHub, or Microsoft, and how that flow fits a Java application.
What goes wrong when authorization is scattered across microservices, and how a central permission model improves security and maintenance.
Compare Keycloak and Gatekeeper on complexity, setup, developer experience, multi-tenant, SDKs, and permission control.
Technical decisions, hard parts, and lessons from building an identity and access management platform.
