#security

1 post.

Authentication isn't authorization: guarding Rails MCP tools with Reeve

Oct 15, 2026

A bearer token tells your Rails app who's at the door, not which records an agent may touch. Reusing Pundit, rolling back denied writes, chaining the audit log.