Notes on identity, security and infrastructure, from someone who builds them.
-
The CAP theorem of security: business, growth, security
Right now, most companies get to pick two of business, growth and security. That's a state, not a law, which makes it an opportunity.
Security · 2 min read -
Your MFA guards the door. Your session cookie opens it.
Security isn't a one-time thing. If your authenticated session cookie is shared across every subdomain, your marketing vendors are holding the keys too.
Security · Identity · 2 min read -
Approval prompts aren't security: delegating access to AI agents
An AI agent is neither the resource owner nor the service provider. Real control comes from scoped, time-bound delegation built into the services themselves.
Security · Identity · AI agents · 2 min read -
The trouble with email magic links
A possibly controversial take: if your identity provider signs users in through email magic links, it may be time to reconsider it.
Security · Identity · 1 min read -
Identity management for agentic AI
Agents acting directly or on a user's behalf aren't new problems. The real gaps are auditing, authorization and granular access, and agents expose all three.
Identity · AI agents · 1 min read