#identity-lifecycle
- Analysis · Oct 26, 2026Moving into IAM? Start with workforce identity and learn to trace one person's access
Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest way to become useful there is to learn the lifecycle end to end, from HR record to the last application, and then the protocols that carry it. A plan for help desk, sysadmin and developer crossovers.
- Analysis · Oct 21, 2026SCIM in practice: provisioning rarely breaks on create, it breaks on leave
SCIM 2.0 is a decade old and the create path works almost everywhere. The failures that leave access behind sit in deactivation, group membership and PATCH, where RFC 7643 and 7644 leave room for two correct implementations to disagree. What breaks, why, and a test plan for the leaver path.
- Analysis · Sep 29, 2026The credentials nobody owns: five September disclosures and the inventory that missed them
A spraying campaign that only worked on functional accounts, a service principal secret in a GitHub issue, an email address that commits code, a public database key with no authorization behind it, and a leaver's token kept alive on purpose. None needed a new exploit. All of them were credentials no person was accountable for.