Engineering deep dives on iddio's security architecture, implementation decisions, and the road ahead.
Why we chose Connect over raw gRPC, deferred OIDC device flows, and built a fail-closed policy engine for the new Control Server.
Why traditional binary access control fails for AI agents, and how Iddio solves this with a four-tier risk classification model.
How we avoided reinventing the wheel by using the classifier's generated method identities directly in our policy engine, instead of building a redundant resource matching DSL.
Why Iddio intentionally hangs HTTP connections while waiting for human approval instead of building an async negotiation protocol, and why simplicity often beats correctness in proxy design.
How Iddio implements Observe Mode to record 'would-be' decisions and safely tune transparent proxy interception without disrupting developer tools.
Why intercepting all local HTTPS traffic breaks cert-pinned apps and kills performance, and how Iddio solves this using a selective inspect list.
Kubernetes native audit logs record what hits the API server. Iddio records what left the workstation, what risk tier it falls into, and whether a human approved it. Here's why you run both.