Episode 229: Oblique: IGA without an identity team

Most identity governance assumes someone owns identity. But often at a startup nobody does, yet you still need to provision access to new users, and still need to complete access reviews for SOC 2. In this episode we talk with Maya Kaczorowski of Oblique about what IGA looks like at small scale: teams still need onboarding, offboarding, access requests, and access reviews even where there is no formal identity function. At a small scale, you can't expect folks to do role mining, be familiar with standards, or build their own connectors - but they expect that access is fully self-serve, that it's explainable so that anyone can debug issues, and especially in 2026, AI.

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Co-Host: Rohit Khare, Product Manager & Software Architect
• Guest: Maya Kaczorowski, Co-Founder / CEO Oblique Security

#Homework

• Oblique Security
• Guide to user access reviews for small teams
• IOH #20 - Identity Governance for the Whole Enterprise

#Takeaways

• Small teams still need IGA. One security generalist may handle the same access reviews and provisioning work as an enterprise team.
• Start with useful coverage. Reasonable defaults and even screenshots can deliver value before every app has an integration.
• A complete user list is still hard. Employees, contractors and guests are scattered across HR systems, identity providers and apps.
• Use AI to focus human review. Suggest rules and surface exceptions; trace access paths to find the configuration that needs fixing.
• Agent access has two distinct cases: Agents using human credentials (impersonation) v. standalone workloads. They need different approaches to inventory and governance.