Authentication proves who they are. ZTeasy decides what they're allowed to do next.
ZTeasy is a Zero Trust policy gateway that sits in front of every internal API call, service-to-service request, and AI/MCP agent tool call — so a stolen token, a stale credential, or a manipulated model can never become unrestricted access.
Open-source, MIT-licensed reference implementation · Java 21 · Keycloak · mTLS · YAML policy engine
# zte-policies.yaml — one rule, explicit and auditable schemaVersion: 1 agentMcpToolCalls: - id: agent-support-read-only effect: ALLOW source: client:support-agent target: crm.get_customer - id: agent-support-no-delete effect: DENY source: client:support-agent target: crm.delete_* # deny always wins — no match, no exception
The perimeter didn't fail. Authorization was never checked.
Across the incidents in our threat research, the common failure isn't a broken firewall — it's a valid identity, token, or AI agent that was implicitly trusted to reach far more than it needed to.
Authentication is not authorization
A valid credential proves identity — it doesn't define what that identity may touch. Every request needs an explicit, separate authorization decision.
Internal traffic isn't implicitly safe
Once an attacker is inside, the only question that matters is "what can this identity reach next?" That's an authorization problem, not a network-perimeter one.
AI agents multiply the blast radius
An MCP-connected agent can acquire tools across CRM, cloud infra, code, and payments. Each tool expands what a manipulated model can attempt — unless it's explicitly constrained.
Every request answers explicit questions before it's allowed through
One policy model, applied identically to interactive users, internal services, and AI agents.
Who is the user?
Keycloak-issued JWT (RS256), validated at the gateway on every request.
Is it allowed?
A single YAML policy document — hot-reloadable, deny-by-default, deny always wins.
Who's the internal caller?
mTLS client certificates verify every service-to-service hop, not just the edge.
On whose behalf?
A signed, short-lived on-behalf-of token carries user context through the call chain.
“Don't try to make the AI perfectly trustworthy. Make the AI's permissions impossible to exceed.”— ZTeasy Threat Research, 2026
Built for internal APIs and AI/MCP agents alike
Service-to-service policy
Every gateway-routed REST call is checked against who the caller is (user or service credential), what it's targeting, which path, and which HTTP method — with mTLS proving the internal caller's identity at every hop.
AI agent & MCP tool policy
The MCP proxy intercepts every tool call before it reaches a backend agent server, matching the caller's identity against per-agent, per-tool allow/deny rules. A denial never reaches the tool — regardless of what the model believes it's authorized to do.
See exactly which breach patterns ZTeasy addresses
Ten real-world incidents, mapped to the specific policy that could have blocked the next step of the attack.