Opal 0 发布：给 AI agent 零常驻权限
Opal 推出 Opal 0，主张 agent 不持有常驻权限，改为按任务即时授予、任务结束即回收的临时权限，并自动完成审批判断。
Opal 0 gives AI agents zero standing permissions, on purpose. Every team I talk to that is shipping agents hits the same wall, and access is the part nobody plans for. Identity tooling grew up around a few hundred humans whose access sits untouched until the next review. An agent asks for access all day long, and every request is a small decision about what it should be allowed to touch right now. Opal frames the shift as a million micro-decisions versus a hundred human identities, and that framing lines up with what those teams describe. Broad permissions on a human get caught at review time, while the same permissions on an agent move at machine speed, so one bad prompt or one leaked key can burn through everything that access was ever allowed to touch. Opal's launch line is three zeros, zero standing permissions, zero human toil, zero friction. The mechanism, per Opal's launch post, is just-in-time scoped permissions granted per task and pulled back when the task ends. The approval judgment itself is automated, so security stops clicking through requests all day. Opal already reports the human version working, citing Databricks at 86,000+ time-bound access requests and Chronosphere with standing access down 88%. Their argument is that agents follow the same pattern, only much faster. The judgment layer is the part a security team will actually grade, and the part I'd watch. Every agent request is a decision, and whoever automates that decision well enough for a CISO to trust it in production decides how far agents get to go. My read is that over the next year the ceiling on agent deployment moves at whatever speed governance learns to say yes safely.
这条是引用着另一条写的：x.com/i/web/status/2100607288000324065