Further reading (external)

Curated third-party writing on policy enforcement, authorization, and agent runtimes, complementary to the Governance Blueprint series.

HOW TO USE THIS PAGE

Start with Policy engines & PEP/PDP, then jump to the section matching what you are building.

Policy engines & PEP/PDP

Resource	Why read it
Open Policy Agent (OPA)	Rego policies, decoupled PDP, JSON decision API
Amazon Cedar	Authorization policy language, entity-based access
Auth0 FGA / Zanzibar models	Relationship-based access for fine-grained entitlements
NIST ABAC guide (SP 800-162)	Attribute-based access control vocabulary

Resource	Why read it
OAuth 2.0 RFC 6749	Token flows, client vs resource owner
OpenID Connect Core	ID tokens, claims, session binding
RFC 8693 Token Exchange	Delegation patterns for agent acting-on-behalf-of

Resource	Why read it
Model Context Protocol spec	Tool surface conventions (still need PEP for side effects)
OWASP LLM Top 10	Injection, excessive agency, supply chain

Topic	Page
PGAR reference design	Governance Blueprint
Governance principles	G.A.I.N Governance
Eval Action plane	Eval plane Action
Identity	G.A.I.N Identity · Token & session
Tool contracts	Manifest registry · Manifest lifecycle
MCP (transport)	MCP playbooks · G.A.I.N MCP
RAG	RAG playbooks · G.A.I.N RAG
Memory	Memory · G.A.I.N Agents