Posts on ISH.SYS

Open Agent Policy Developer Guide

Sat, 30 May 2026 00:00:00 +0000

This is the technical companion to the introductory Open Agent Policy posts.

The earlier posts explain the problem in plain English:

agents need scoped access, not broad API keys
agent identity must be proven, not claimed
policy should answer agent + actor + action + resource + context
resource APIs should validate grants before serving data

This post is about the developer path.

The goal is to protect one agent action end to end:

Where Open Agent Policy Is Today

Sat, 30 May 2026 00:00:00 +0000

Open Agent Policy is not just an idea anymore.

It has a server, schemas, a policy evaluator, a Python SDK, LangChain integration, MCP proxy support, an HTTP gateway, sessions, runs, scoped grants, Postgres storage, audit query, OPA and Cedar backend work, and a local validation environment.

That is enough to try the model seriously.

It is not the same thing as being enterprise-ready.

This post is the honest status.

The short version

OAP is useful today if you want to:

How Developers Can Use Open Agent Policy

Fri, 29 May 2026 00:00:00 +0000

Security frameworks only matter if developers can use them.

If protecting an agent requires rewriting the whole application, most teams will not do it. If the docs begin with distributed policy theory, most people will leave before they run the first example.

Open Agent Policy needs to be useful in a normal developer workflow:

I have an agent.
The agent has tools.
Some tools touch sensitive systems.
I want policy checks before those actions happen.
I want the resource API to verify proof before returning data.

That is the adoption path.

Why Resource APIs Should Check Grants

Thu, 28 May 2026 00:00:00 +0000

The easiest place to add agent security is inside the agent.

Before a tool runs, ask the policy server for permission. If the answer is deny, do not run the tool.

That is a good start.

But it is not enough.

The resource still needs to protect itself.

The bypass problem

Imagine this flow:

Agent -> OAP -> ticket API

The agent asks OAP, “Can I read ticket T-100?”

OAP says yes.

Policy for AI Agents, in Plain English

Wed, 27 May 2026 00:00:00 +0000

Policy can sound abstract.

In practice, an agent policy is just a clear answer to a practical question:

Is this agent allowed to take this action on this resource right now?

That question has to be answered before an agent reads customer data, sends an email, creates a refund, modifies a repository, runs a database query, or calls an internal API.

Open Agent Policy is built around making that question explicit.

Agent Identity Is Not a String

Tue, 26 May 2026 00:00:00 +0000

Every agent access system eventually starts with a name.

For example:

agent://support/ticket-assistant

That name is useful. Policies need stable names. Audit logs need stable names. Humans need to know which agent did something.

But a name is not proof.

If a request says, “I am agent://support/ticket-assistant,” the server still has to ask:

Why should I believe you?

That is the identity problem Open Agent Policy has to solve before policy can mean anything.

Why AI Agents Need an Access Control Plane

Mon, 25 May 2026 00:00:00 +0000

AI agents are becoming useful because they can do things.

They do not just answer questions. They call tools. They read tickets. They query databases. They send emails. They open pull requests. They summarize customer records. They may run for several steps before a human looks at the result.

That is the moment where an agent stops being “just a chatbot” and starts looking like a small software service.

And once an agent can touch real systems, we have to ask a security question:

Graph Algorithms: Mathematics & Implementation

Wed, 31 Dec 2025 00:00:00 +0000

Graphs are one of the most versatile data structures in computer science. They model everything from social networks to routing protocols to dependency resolution. In this post, we’ll build up graph theory from first principles — formal definitions, mathematical analysis, and clean Python implementations for each algorithm. *This post assumes familiarity with basic data structures (arrays, hash maps, heaps) and Big-O notation.

Foundations

Formal Definition

A graph $G$ is an ordered pair $G = (V, E)$ where:

Mathematics in Web Publishing

Sun, 28 Dec 2025 00:00:00 +0000

One of the challenges of technical writing on the web is properly rendering mathematical notation. With KaTeX, we can render both inline and display math beautifully.

Inline Math

The quadratic formula $x = \frac{-b \pm \sqrt{b^2 - 4ac}}{2a}$ is one of the most well-known formulas in mathematics. We can also write Euler’s number $e \approx 2.71828$ inline.

Display Math

Euler’s identity is often cited as the most beautiful equation:

$$e^{i\pi} + 1 = 0$$