Engineering // Blog

Blog

Engineering deep dives on iddio's security architecture, implementation decisions, and the road ahead.

Architecture 2026-06-25

Pragmatism Over Purity: Architecting Iddio Control Server v2.2

Why we chose Connect over raw gRPC, deferred OIDC device flows, and built a fail-closed policy engine for the new Control Server.

Architecture 2026-06-15

Four-Tier Classification Over Binary Allow/Deny

Why traditional binary access control fails for AI agents, and how Iddio solves this with a four-tier risk classification model.

Architecture 2026-06-07

One Vocabulary: Why Iddio Policy Uses Rule IDs Over a Custom DSL for GCP

How we avoided reinventing the wheel by using the classifier's generated method identities directly in our policy engine, instead of building a redundant resource matching DSL.

Architecture 2026-06-04

The Case for Blocking HTTP Approvals

Why Iddio intentionally hangs HTTP connections while waiting for human approval instead of building an async negotiation protocol, and why simplicity often beats correctness in proxy design.

Architecture 2026-06-04

Observe Mode: Safe Configuration for Selective MITM

How Iddio implements Observe Mode to record 'would-be' decisions and safely tune transparent proxy interception without disrupting developer tools.

Architecture 2026-05-28

Selective MITM: Why Iddio Doesn't Intercept Everything

Why intercepting all local HTTPS traffic breaks cert-pinned apps and kills performance, and how Iddio solves this using a selective inspect list.

Audit 2026-03-06

Kubernetes Audit Logging Is Not Enough

Kubernetes native audit logs record what hits the API server. Iddio records what left the workstation, what risk tier it falls into, and whether a human approved it. Here's why you run both.