security

1. November 9, 202620 min read

   Agent Gateway Control Matrix: What A2A and MCP Gateways Enforce Before an Agent Touches Lakehouse Data

   SAP Agent Gateway, agentgateway 1.7.0 and Databricks MCP servers compared on six controls, with checks you can run against any endpoint.

2. November 9, 202620 min read

   Lakehouse Dependency CVE Ledger, November 2026: Arrow 26.0.1, Parquet Java 1.18.2 and What to Patch First

   Arrow 26.0.1 fixes a critical bundled Brotli CVE in PyArrow wheels, and Parquet Java 1.18.2 bumps its shaded Jackson. What to patch first.

3. October 27, 202630 min read

   MCP in Regulated Environments: What the Toronto MCP Dev Summit Agenda Says About Production Agents

   Registries, gateways, delegated identity, and audit: MCP Dev Summit Toronto 2026 patterns for production agents over lakehouse data.

4. September 21, 202631 min read

   CVE-2026-73334 and the Trust Boundary Inside an Encrypted Parquet File

   CVE-2026-73334 lets a tampered Parquet footer route a reader's KMS token to an attacker. Here's the fix, Iceberg's safe path, and how to audit your lakehouse.

5. September 21, 202630 min read

   Keeping Lakehouse Traffic Off the Public Internet With Apache Polaris

   A private Polaris lakehouse still leaks data if the storage hop goes public. How to bind vended credentials to private networks on AWS, Azure, and GCP.

6. August 25, 202630 min read

   Securing the Agentic Lakehouse Gateway: Preventing Prompt Injection and Data Exfiltration

   Agentic lakehouse gateways face prompt injection and exfiltration through query results. A threat model and defenses for the layer in front of data.

7. August 19, 202632 min read

   Securing the Agentic Lakehouse Gateway: A Threat Model for Prompt Injection, Exfiltration, and the Firewall That Reads Sentences

   A threat model for the agentic lakehouse gateway covering prompt injection, exfiltration, and the firewall that reads sentences.

8. August 4, 202621 min read

   Building Apache Iceberg Lakehouses That Run Without an Internet Connection

   How to build an Apache Iceberg lakehouse that runs fully offline: storage, catalog, compute, cross-zone transfer, compliance, and the failure modes that bite.

9. August 4, 202620 min read

   Cross-Cloud Credential Vending in Apache Polaris and the End of Permanent Storage Keys

   How Apache Polaris vends short-lived, prefix-scoped storage credentials across AWS, Azure, and GCP, and how to retire permanent storage keys for good.

10. August 4, 202620 min read

    Defending the Lakehouse Gateway Against Prompt Injection and Data Exfiltration

    Defending the lakehouse gateway against prompt injection and data exfiltration: per-user identity, no-SQL tool surfaces, volume bounds, and detection.

11. July 13, 202617 min read

    Policy Layer for Autonomous AI Data Agents

    An in-depth exploration of policy layer for autonomous ai data agents

12. July 13, 202616 min read

    REST Catalog Credential Vending for Iceberg

    An in-depth exploration of rest catalog credential vending for iceberg

13. July 6, 202627 min read

    File Encryption for the Lakehouse: The Terminology, the Machinery, and the Hard Problem of Interoperable Encrypted Tables

    For years, the open lakehouse had an honest gap that practitioners whispered about and slide decks skipped: encryption. Not the checkbox kind, ever...

14. July 6, 202630 min read

    Designing Private, Air-Gapped Data Lakehouses: Scaling Iceberg in Highly Secure, On-Premises Clouds

    Some of the most important lakehouse work happens in environments that will never look like a simple public-cloud reference architecture. Defense...

15. June 8, 202614 min read

    Securing Agent Identities in the Lakehouse

    How OAuth 2. 0 token exchange, OAuth 2. 1 device authorization grant, credential vending, and fine-grained access control secure AI agent identities.

Browse all posts