Identity at the Center

Why PAM matters, how to sell a PAM program to management, how to choose PAM products, and ways to shrink the privileged attack surface.

What the FIDO Alliance is and which authentication problems its standards are meant to solve, explained by the Alliance's executive director.

An entry-level tour of access management: why OIDC and SAML exist, and how scopes and protocol flows fit into single sign-on.

How OAuth Transaction Tokens secure requests across microservices, including their claims, time to live, immutability, and use with AI agents.

CIAM design choices: progressive registration, balancing friction against usability, customization, risk-based MFA, and build versus buy for customer authentication.

Lessons from replacing a decade-old on-premises IGA system: person-based identity models, cleaning data first, and running old and new platforms in parallel.

How existing OAuth specifications such as JWT authorization grant, token exchange, and client ID metadata, plus SPIFFE, apply to securing AI agents as workloads.

Summarizes seven Q1 2026 threat reports and the identity patterns they share, including MFA gaps, machine identity abuse, deepfakes, and faster breach timelines.

Updates the state of the Shared Signals Framework and CAEP standards, including adoption by major technology companies.

A critique of the batch joiner-mover-leaver model and the case for continuous identity driven by shared signals.

Identity challenges raised by AI agents, the role of MCP, and recursive delegation and scope attenuation, drawing on the OpenID Foundation agentic AI whitepaper.

The capabilities of fraud reduction platforms and how identity verification, device intelligence, behavioral biometrics and shared signals combine in customer-facing fraud defense.

Covers why the FIDO Alliance is extending from passkeys into digital credentials and wallets, and how the two fit together.

A county government CTO explains how device identity fits into a zero trust program alongside human identity in a complex public-sector organization.

Common concerns about passkey security and adoption, discussed with the FIDO Alliance CTO, plus an overview of the Alliance's ongoing work.

How machine identities differ from human ones, why static credentials like API keys and service accounts create technical debt, and the case for dynamic, ephemeral credentials.

Two architects of the EUDI Wallet ecosystem explain the EU plan to give every citizen a digital identity wallet and its effect beyond Europe.

The practical trade-offs between SAML and OpenID Connect for SaaS single sign-on, and what it takes to modernize older applications onto newer federation protocols.

How a regulated financial firm runs user access reviews, with practical steps for better certifications and for governing service accounts.

How event-based standards such as the Shared Signals Framework, CAEP, RISC and SCIM events can make provisioning and governance react in near real time.

The history behind SAML through the Liberty Alliance and Kantara, and why trust frameworks and federations mattered as much as the protocol itself.

How cloud IAM differs between GCP and AWS, why resource hierarchy and policy inheritance matter, and the tradeoff between least privilege and zero standing privilege.

What is driving change in privileged access management, predictions for where PAM is heading, and how it relates to the identity governance market.

Describes how digital identity wallets work, the role governments play in issuing them, and where smart and roaming wallets may go next.

How TikTok rolled out passkeys for its users, including offering them at sign-up and the adoption and user messaging challenges, from its product manager.

Explains the Shared Signals Framework and CAEP with real examples, and how they connect continuous access decisions to identity threat detection.

Covers what decentralized identity means, why governments struggle to implement it, and how competing standards and politics shape digital wallets.

Security and user experience trade-offs of passkeys in financial services, including how platform vendors control passkey synchronization.

What the OAuth 2.0 Step Up Authentication Challenge Protocol (RFC 9470) does, from its co-author.

How just-in-time access works, how it relates to zero standing privileges, and where it fits across cloud, on-prem, Snowflake, and DevOps automation.

What customer identity is, how it differs from workforce IAM, the role of self-service, and common challenges when a business first adopts CIAM.

How OpenID Connect might be designed differently today and what the Grant Negotiation and Authorization Protocol (GNAP) aims to change.

Practitioners from banking, manufacturing and retail compare how they build and maintain role-based access control in real IAM programs.

What the federal GSA and CISA privileged identity playbook covers, explained by two government practitioners involved with it.

Why multifactor authentication for customers is a different problem from MFA for employees, and which of the two is harder to get right.

Why attackers increasingly bypass traditional MFA and how FIDO possession-based authentication gives IAM practitioners a phishing-resistant alternative.

A security chief who led zero trust programs explains what zero trust looks like in practice and how an organization can get started.