Identerati Office Hours
A livestream about identity standards and the people who write them. Every episode is archived here.
Identity work has gotten good at saying who an agent is: keys, delegation, mandates, verifiable credentials. It says much less about what the agent then did, and that's where disputes, audits and…
Identity and access management has quietly become critical enterprise infrastructure. Yet organizations still buy IAM capabilities from a fragmented market that introduces and promotes new categories…
Google’s Facade uses deep contextual anomaly detection to find suspicious insider activity hiding among billions of legitimate access events. Trained only on normal historical activity, it compares…
Google’s ground breaking Beyond Zero architecture could influence the security landscape for the next decade. And it signals a shift from identity to capability based access governance--principle #1…
Most identity governance assumes someone owns identity. But often at a startup nobody does, yet you still need to provision access to new users, and still need to complete access reviews for SOC 2.…
AI agents are already inside the enterprise — booking meetings, processing invoices, querying databases, publishing content — and not one of them has a password. They authenticate through OAuth…
Across the planet, Digital ID Ecosystems are being built using technology from all of us in this community. They all face common questions that no technology can answer: “Once launched... How do we…
"May your agent touch my stuff?" Answering it needs an authority on the owner's side, one the resource server does not control, and it needs a negotiation to fill that authority in while the owner is…
A lot has happened since Tanu's talk at Identiverse a few months back: "Runtime Identity: Trust at the Speed of AI". Although it's just been four human months, it's been four years in agent time.…
We had the answer to authorization 20 years ago. Most organizations just never implemented it properly. From XACML to UMA to Zero Trust to APIs, microservices, and now AI agents, we'll talk through…
With it's first release, OWASP GovOps officially starts iterating three deliverables: (1) a new standard for inventorying enterprise authorization capabilities; (2) an architecture describing GovOps;…
AI agents escaping sandboxes make great headlines—but what do these incidents actually tell us about enterprise AI risk? Mike and Henrique examine the OpenAI/Hugging Face incident, the hype around…
We use analytics cookies to measure which pages are useful, so we can improve them. They are only set if you accept. Essential cookies needed for the site to work are always on. See our privacy policy.
