Identity
7 posts
20 min read
OAuth scopes weren't built for AI agents: the delegation model that holds up under prompt injection
OAuth scopes assume a human approves once, an app does narrow work, and the trust horizon is months. AI agents break every part of that assumption. The architecture that holds is a two-principal model with short-lived delegation tokens, ReBAC for structure, ABAC for context, and per-action consent gating destructive operations. Here is the design and the rollout.
- AI agents
- Authorisation
- ReBAC
12 min read
Digital employees on the platform: the eight integration decisions nobody briefs
When a business unit deploys a digital employee, the platform engineering team gets the bill, the audit findings, and the on-call ticket, usually without being involved in the decision. The integration decisions that protect both sides are not the ones the AI vendor's solution architect will brief you on.
- Digital employees
- Platform engineering
- Identity
3 min read
MCP and the new authorisation surface nobody is reviewing
Model Context Protocol turns every internal API into a tool an agent can call on a user's behalf. The authorisation model most teams ship with is naïve, and the audit log usually proves it.
- MCP
- Agents
- Authorisation
5 min read
Digital employees, with the governance attached
Why most digital employee deployments fail their first audit, and what a governance-first build looks like: identity, data access, supervision, and the accountability question almost no-one is answering well.
- Digital employees
- Agents
- Governance
5 min read
Zero trust without vendor capture
Most zero-trust programs we review are vendor roadmaps in disguise: a sequence of product purchases dressed up as architecture. The actual zero-trust shift is a procedural one, and it doesn't need a million-dollar identity overhaul to start.
- Zero trust
- Identity
- Network architecture
5 min read
Identity-first security for hybrid Microsoft 365 environments
If you run M365 with on-prem AD synchronised via Entra Connect, your security perimeter is the identity. Most mid-market environments have an Entra tenant configured in 2018 that hasn't been seriously revisited since. Here's the catch-up.
- M365
- Entra ID
- Identity
6 min read
Just-in-time privileged access for mid-market
Standing administrative privilege is the largest avoidable risk in most mid-market environments. The fix is a procedural change supported by tooling you probably already own. The work is mostly the policy, not the technology.
- PAM
- Just-in-time
- Privilege
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.