Identity & security - Keymate Blog
Category: Identity & security
How Keycloak Password Policies Work
A password rule that only exists in your signup form is a suggestion, not a policy. Here is how Keycloak enforces password policies server-side, and which rules are worth enabling.Muhammed Oğuz
September 2026
What Is IAM? Identity and Access Management Explained
Identity and access management decides who gets in, what they can touch once inside, and how you prove later that the decision was right. Here is the whole picture in one page: the vocabulary, the standards, the parts that break, and where access is actually decided.Israfil Coskun
August 2026
Runtime Protobuf Schemas in Keycloak's Embedded Infinispan
Keycloak offers no supported, configuration-only way to load runtime-mounted Protobuf schemas into its embedded Infinispan. This post walks through the extension pattern that bridges that gap through ProtoStream's documented initializer lifecycle, reviewed through a security and platform-engineering lens, with a runnable public demo.Ali Tuğrul Pınar
July 2026
Inside Keycloak Authorization: Resources & Policy Engine
A deep dive into Keycloak Authorization Services: how Resource Servers, Resources, Scopes, Policies, and Permissions fit together, and exactly how Keycloak decides permit or deny.Eren Kan
June 2026
Fine-Grained Authorization for AI Agents: How It Works in Production
How Keymate enforces fine-grained authorization for AI agents: declarative policies, a centralized engine, and consistent design-time/runtime enforcement.Hüseyin Akdoğan
June 2026
Why AI Agents Need Fine-Grained Authorization
Authentication tells us who the agent is. The harder question is what data it can reach, under what conditions, and on whose behalf. The April 2026 PocketOS incident, in which an autonomous coding agent deleted a production database in nine seconds, showed what happens when no one is answering it.Hüseyin Akdoğan
May 2026