Hey, I'm Riya, a product marketer working at MonoCloud. We're building a developer platform that brings together identity for users, APIs, services, and AI agents, so teams don't have to stitch together separate tools as they scale beyond basic auth.
I'm relatively new to this space (about 8-9 months in SaaS PMM), and I'm writing here to learn in public, sharpen my thinking, and connect with people building in auth, AI, and infra.
This first post is part intro, part take. Bear with me:)
We've already seen what happens when agents go wrong.
An AI agent with write access deletes an entire production database. Another exfiltrates customer data because nothing was scoping its permissions. A workflow automation tool acts on behalf of a user, but with way more access than that user ever intended to grant.
These aren't hypotheticals anymore. And every time it happens, the postmortem says the same thing: the auth layer wasn't built for this.
Here's the uncomfortable truth: most teams treat authentication and authorization as a checkbox, not an architecture decision. You pick a library, slap on JWTs, call it done, and move on to shipping features. And for a while, it works fine.
But modern SaaS isn't a single user logging in from a browser anymore. It's:
AI agents acting autonomously on behalf of users
Multi-tenant systems where one misconfigured policy exposes the wrong customer's data
Third-party integrations that each need scoped, revocable access
Audit requirements that make "we just check a session token" not good enough
Auth was designed for humans. We're now handing it to machines.
Why this is also an AI problem
The AI layer makes this harder in ways most people haven't fully processed yet. When a human logs in and does something destructive, there's a decision trail. When an agent does it, because it had the keys and the instructions told it to, the question of who authorized what gets genuinely murky.
Identity for AI agents is an open, unsolved problem. Things like: what does "least privilege" mean for an LLM that needs to reason across data? How do you revoke an agent's access mid-task? How do you audit what an AI actually did with its access? These are questions the industry is actively figuring out, and the answers will shape how SaaS products get built for the next decade.
What I'll be writing about
I'm not a dev, but I work closely with the people building this infrastructure every day. My angle is less "here's the code" and more "here's how to think about this": the tradeoffs, the mistakes teams make, the patterns that actually hold up at scale.
Topics I'll be covering, auth and beyond:
Auth architecture for multi-tenant SaaS
Identity and access for AI agents
How AI products are actually being built under the hood
Infra and platform engineering trends worth paying attention to
Developer experience and what makes or breaks a dev tool
SaaS growth, GTM, and the product decisions behind them
Honest takes on tools, standards (OAuth, OIDC, FIDO2), and where the ecosystem is heading
Basically, things I find genuinely interesting as someone sitting at the intersection of product, infra, and AI. If any of that overlaps with what you're building or thinking about, follow along.
Top comments (0)