Year
- 2026
Category
- Incident
- Insights
- Product
- Testimonial
- Engineering
Tag| Approvals
- AI governance
- Approvals
- Audit
- Compliance
- Execution control
- Identity security
- MCP
- Privileged access
- Work Sessions
- Zero standing privilege
The AlpacaX blog—security, product thinking, and what we're learning as we build AI agent execution control.
Insights
Loopjacking: what you approved isn't what ran
A researcher reproduced the bypass in tested setups across three released agent frameworks.
Product
Product update: how a request arrived, and what reaches you
Approval cards show how a request arrived and whether it was verified, alerts can be muted per server, and extending a session takes a reason.
Insights
Stay on Supabase and Vercel, or run your own servers?
Cost makes you look. Ownership makes you consider moving. What usually stops you is the same thing: no one owns infrastructure. That is starting to change.
Incident
A human caught the AI agent. That's not a control you can rely on
UK AISI's report: human vigilance held. A technical barrier that would reliably hold was never there.
Product
Product update: what gets decided before a command runs
Choose how far commands are gated, confirm the server account during approval, and give automation credentials of its own.
Insights
Out-of-band approval: why an agent's own channel can never be the one that approves
An AI agent that can approve a review on its own execution channel isn't gated at all. Why out-of-band approval separates the channel, not the person.
Product
Product update: what the audit log stops keeping—and stops missing
Command audit records are now safer, with more precise control over server access and approval requests.
Insights
AI governance on paper vs. governance during the task
A near-miss doesn't change your policy. It changes the question leadership asks about it.
Product
Product update: the judgment behind every approval
See the reasoning behind each approval request, without bringing agent runs to a halt.
Insights
JIT access control is for humans. What should we have for AI agents?
Just-in-time access governs whether an agent gets in, and when. It says nothing about what the agent does once inside.