Skynarc is a small, independent publication. The articles here start with a question worth understanding — then a small lab is built to test it, and the results are written down as they came out. Nothing here is for sale.
Hands-on write-ups, mostly about AI agents and the security around them. Each one starts from a question, works through it on real infrastructure, and reports what the experiment showed — and what it didn't.
Topics are chosen because they are interesting to work through, not because they sell anything.
Ideas are checked against a working lab — real identities, real permissions, real audit logs.
Every article says what the lab shows and where it stops. Conclusions stay provisional.
So far the questions have clustered around AI agents and identity. More will follow wherever curiosity leads.
Least privilege caps what a compromised agent can do, but not how often it tries. A small sentinel reads the audit log, spots a burst of denials, and revokes the agent's identity.
Read the article → DelegationGiving an agent a second fact to carry — who it is acting for — with scoped delegation, a tiny may-act broker, and a refused confused-deputy attack.
Read the article → Non-human identityTwo AI agents, identical tasks, and identity as the only thing that separates them — Okta, Workload Identity Federation, and least-privilege IAM on Google Cloud.
Read the article →