Hey everyone, happy Friday ☺️ We just published a new blog on the 5 authorization blind spots auditors find most often in enterprise access control. It walks through the things that come up again and again in real audits - scattered authorization logic across codebases, policies that exist on paper but no proof of enforcement, quarterly access reviews that check role labels instead of actual permissions, non-human identities running with standing privileges, and AI agents deployed without an authorization model. Each section has a “what to do now” piece with practical steps to close the gap before the next audit cycle. Hoping it’s useful for anyone working through SOC 2, ISO 27001, HIPAA, or similar frameworks, or just generally rethinking how authorization fits into their Zero Trust setup 🙂 Full blog: https://www.cerbos.dev/blog/5-authorization-blind-spots-auditors-find-and-how-to-fix-them Have a great weekend!