I have previous experience at Stripe in IAM, have been working on this for a while. If you have any questions or suggestions let me know here, on Github or wherever else you find me.
On a more theoretical level, I’m interested in the idea of building customized access subsets through a templated schema on individual APIs. The mechanisms are a little different, git is local with a remote mirror handled by the daemon, Stripe is more simple with more-or-less static requests, and the Vercel CLI opens a connection where it runs through a series of requests within a window with a pre-defined grant. But underneath the technical aspects remains the same idea of customizing access with an almost arbitrary precision.
There’s a quote from the West Wing about money in politics that I’ll paraphrase here. “Money in politics is like water on pavement, it will find every crack.” I believe this to be increasingly true for authorization surfaces in the age of agentic AI. Pre-defined roles and keys will have extraneous permissions for any one task you might trust an agent with. You couple these excess permissions across a number of providers and the combinatorial growth in possible actions start getting more and more dangerous. Cermet is an attempt to get ahead of that.
I have previous experience at Stripe in IAM, have been working on this for a while. If you have any questions or suggestions let me know here, on Github or wherever else you find me.
On a more theoretical level, I’m interested in the idea of building customized access subsets through a templated schema on individual APIs. The mechanisms are a little different, git is local with a remote mirror handled by the daemon, Stripe is more simple with more-or-less static requests, and the Vercel CLI opens a connection where it runs through a series of requests within a window with a pre-defined grant. But underneath the technical aspects remains the same idea of customizing access with an almost arbitrary precision.
There’s a quote from the West Wing about money in politics that I’ll paraphrase here. “Money in politics is like water on pavement, it will find every crack.” I believe this to be increasingly true for authorization surfaces in the age of agentic AI. Pre-defined roles and keys will have extraneous permissions for any one task you might trust an agent with. You couple these excess permissions across a number of providers and the combinatorial growth in possible actions start getting more and more dangerous. Cermet is an attempt to get ahead of that.