Capability Governance ArchitectureHow Formal Verification and Token Integrity Are Transforming Enterprise SecurityOct 15Oct 15
Trust GovernanceIdentity Governance has failed. Iterating people and reviewing their entitlements doesn’t sufficiently ensure security. Too many security…Oct 10Oct 10
Zero Standing Privilege: Marginal Improvement on the Wrong Enterprise Security ParadigmZero Standing Privilege (ZSP) sounds like progress. After all, who wants “standing” privilege — lingering, unrevoked, over-provisioned…Oct 7Oct 7
Entitlements to CapabilitiesFor two decades, enterprises have built their access management strategies around entitlements catalogs. These catalogs — lists of roles…Oct 3Oct 3
From PARC to ARC: Policies Without PeopleModern access control thinking has revolved around PARC — Principal, Action, Resource, Context. It’s a tidy acronym: start with a…Sep 18Sep 18
Governor, Risk, Hub — The Cast of Enterprise AI DefenseThe Murderbot Apple TV series personifies cybersecurity systems into dramatic protagonistsSep 18Sep 18
Cedarling: The Governor Module for Autonomous AI AgentsWhy We Need a Governor Module for AI AgentsSep 15Sep 15
Multi-Token Authz (Revisited)I want to revisit the The Multi-Token Authz Challenge, in light of recent revisions to the design of the Cedarling’s new multi-issuer token…Sep 8Sep 8
Venn of Access Control Taxonomies: Why RBAC Isn’t Going Away, But Why We Need MoreFor decades, Role-Based Access Control (RBAC) has been the workhorse of enterprise identity systems. RBAC made it practical for IT teams to…Aug 29Aug 29