Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
Tokens & SessionsThe Persistent Problem This isn t about a single breach. It s about a widespread issue: the ongoing use of static credentials for machine-to-machine authentication, despite the existence of ephemeral
OAuth & OIDCWhen your AI agent needs to book a hotel, approve a transaction, or access member-only data, you re managing authentication, authorization, and transaction approval across different trust levels. OAut
Governance & ComplianceIf you ve ever tried to report your IAM program s progress to a board, you ve probably hit the same wall: which maturity model do you use? And once you pick one, how do you know if your score actually
OAuth & OIDCThe OpenID Foundation has launched self-certification for OpenID4VP and OpenID4VCI conformance tests. Some teams will certify quickly, while others will face delays due to preventable errors. The key
Get weekly security insights and compliance updates delivered to your inbox.
Federation & SSOScope This guide explores the technical requirements and implementation considerations for mobile driver s license (mDL) presentation under ISO/IEC 18013-5 (in-person) and ISO/IEC 18013-7 (remote). Yo
FIDO & PasskeysOpenAI s September 1 deadline for hardware-backed passkeys in its Trusted Access for Cyber program isn t just policy housekeeping. It s a critical shift for organizations handling sensitive capabiliti
Zero Trust ArchitectureThe Question at Hand Your AI agents need to query production databases, modify cloud resources, and execute privileged commands. How do you secure that access? Traditionally, agents are treated like a
Federation & SSOIf your team manages identity federation across trust boundaries, you re about to encounter two new OpenID Federation extension specifications. The OpenID Foundation s review and voting process runs f
FIDO & PasskeysYou ve read the vendor whitepapers. Passkeys eliminate phishing, improve user experience, and align with FIDO2 standards. The business case looks solid. Then you brief your architecture team, and the
OAuth & OIDCThe Challenge A customer-support chatbot needs to access payment history and account details from multiple backend services. The user initiates the conversation, but an AI agent decides which tools to
FIDO & PasskeysYou re not alone if you saw the YubiKey 5.8 announcement and wondered, What does this mean for my AI deployment? Many have asked similar questions in enterprise Slack channels, architecture review mee
OAuth & OIDCYou ve spent years building OAuth flows, SPIFFE identities, and OIDC federation. Now, AI agents are spinning up in production, and your first instinct is to treat them as a new problem needing new sta
Governance & ComplianceYour organization has an IAM program. You have tools deployed, processes documented, and policies approved. But when your CISO asks, Where do we stand? or the board wants to know, How mature is our id
OAuth & OIDCUnderstanding the Issue This isn t about a security breach. It s about a common architectural oversight that occurs before incidents happen, when teams deploy agentic systems without using token excha
FIDO & PasskeysTrust isn t something you add to an authentication flow after the fact. It s what happens when your identity system works the way users expect it to work, every time. Most IAM architects inherit syste
FIDO & PasskeysYou ve read the headlines. Passkeys eliminate phishing. They re faster than passwords. They re the future. If you re a CISO or IAM architect, you re probably already fielding questions about when your
FIDO & PasskeysThe Challenge In 2025, Japan s financial sector was hit by a wave of phishing attacks targeting securities firms. The Financial Services Agency (FSA) responded with guidelines mandating phishing-resis
