The Identity Jedi Show
David Lee talks with founders, architects, and practitioners about non-human identity, agentic AI governance, and runtime authorization. Opinionated and strategy-focused.
- Host
- David Lee
- Publisher
- Independent · Independent
- Pillar
- Machine, Workload & Secrets, Privileged & Governance
- Level
- Practitioner
- Format
- Interview
- Cadence
- Irregular (stated as biweekly), 30 to 60 min
- Status
- Active, last episode 2026-11-04
- Since
- 2022
- Episodes
- 78
What it is
The Identity Jedi Show, subtitled "Where Identity Meets Strategy", is hosted by David Lee, who has spent two decades in identity and access management. The feed lists its focus as non-human identity, agentic AI governance, runtime authorization, and unsolved permission boundaries. Some episodes are recorded live at events such as Identiverse.
Who it suits
Identity leaders and architects thinking about where programs are heading, especially around AI agent identity and machine credentials.
Editor note
Strong on opinion and strategy, lighter on step-by-step implementation. The stated cadence is every two weeks, but the real gaps have run from two weeks to four months, so subscribe rather than check in. Lee works at Saviynt; the show is his own, but that context is worth knowing when governance tooling comes up. Earlier seasons (2023 to 2024) had a co-host, Sameer Sait.
Where to start
- ITDR Deep Dive with Matt Caufield - Exploring the Next Big Thing in Identity & Access Management2023-05-18 · 31 min · Learner · Identity threats and ITDR
Discusses ITDR as an emerging category and how it differs from traditional identity and access management controls.
- Redefining Access: The Convergence of IGA and PAM in Identity Security2024-05-08 · 53 min · Practitioner · Privileged access management
Why identity vendors are consolidating PAM and IGA into platforms, the security risks of stitching acquired products together, and why just-in-time entitlements beat separate admin accounts.
- The Co-Inventor of Tor on Why Your NHI Strategy Is Already Behind2026-05-26 · 63 min · Practitioner · Non-human and AI agent identity
Why non-human identity risk built up while human identity matured, covering service accounts, unrotated API keys, hardcoded credentials, and zero trust for AI agents.
Last verified 2026-09-30 against the show's feed, recent episode notes, and the publisher's own pages. Status and last-episode date update weekly from the feed.
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.
Related on Start with Identity
- BlogAgent identity just got a protocol, which is the easy half
Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The
- BlogAgentic AI Identity Is the Next Frontier (And Your IAM Stack Isn't Ready)
AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was
- BlogBank of America tells customers not to give AI agents their banking password
Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to a
- PodcastCyberArk
CyberArk's identity security interview show, launched as Trust Issues and renamed Security Matters. Silent since March 2026, after Palo Alto Networks' acquisiti
- GlossaryEntity Analytics
Entity analytics is the behavioural analysis of every identity in an environment, human and non-human, to learn what normal activity looks like for each one and
- CVEFreeIPA idp-add evaluates input before checking the caller's rights
Any authenticated FreeIPA principal could push --organization or --base-url values into an eval() call that ran before the access check, reading the server proc