Security
AI Agent Permissions: Designing Least-Privilege Access
Design agent access like a capability system: narrow tools, scoped credentials, tenant boundaries, and separate read/write permissions.
Kirtesh Admute·3 days ago·6 min read
IndieFounder publication
Ideas for people who build.
Practical stories, product lessons, teardowns, and field notes for independent founders.
Security
AI Agent Permissions: Designing Least-Privilege Access
Design agent access like a capability system: narrow tools, scoped credentials, tenant boundaries, and separate read/write permissions.
Kirtesh Admute · 3 days ago · 6 min read
Read story Archive
Latest stories
Security
Human Approval in AI Agents: Where Should the Checkpoint Go?
Approval works best at the boundary just before a consequential side effect, with an exact operation, clear preview, and server-side verification.
Kirtesh Admute·4 days ago·6 min read
AI
MCP Prompt Injection Defense: How to Protect Agent Tools
MCP-connected content can contain instructions that attempt to influence an agent.
Kirtesh Admute·4 days ago·6 min read
Startups
How to Run a Weekly SaaS Review Without Creating Another Dashboard
A weekly review should reduce uncertainty rather than create reporting work. Keep a small set of revenue, activation, retention, acquisition, support, a…
Kirtesh Admute·4 days ago·5 min read
Security
AI Agent Guardrails: How to Stop Agents From Taking the Wrong Action
Guardrails should block unsafe tool calls, validate outputs, enforce budgets, and pause risky workflows before they create side effects.
Kirtesh Admute·4 days ago·6 min read
Product & SaaS
Same $2 Token Price, Ten Times the Bill: Budget the New Mid-Tier Models by Finished Job
Sonnet 5.5, GPT-6.1 Sol and Gemini 4 Argon now share a $2/$10 sticker. Independent task costs do not, and that is the invoice a solo SaaS actually pays.
Kirtesh Admute·4 days ago·8 min read
AI
MCP Production Deployment Checklist for Indie Developers
A local MCP demo can work perfectly while production introduces authentication, networking, quotas, and failure modes.
Kirtesh Admute·4 days ago·6 min read
Startups
How to Decide What a Solo Founder Should Never Build
The solo-founder constraint is a build-versus-buy filter. Build what differentiates the product or is impossible to buy well; integrate commodity infras…
Kirtesh Admute·4 days ago·5 min read
AI
MCP Observability: What to Log for Agent Tool Usage
When agents use multiple MCP servers, debugging requires a clear trail of discovery and execution.
Kirtesh Admute·4 days ago·6 min read
AI
MCP Multi-Tenant Security: How to Isolate Customer Data
A shared MCP server must never let one tenant's agent access another tenant's resources.
Kirtesh Admute·4 days ago·6 min read