SECURING AI WITH IDENTITY
I write about agent identity, authorization, secure harnesses, AI workflows, models, and the controls enterprises need to trust autonomous systems.
[HUMAN] -- delegates --> [AGENT]
| |
+---- [IDENTITY] -------+
|
[AUTHORIZATION]
|
[TOOLS] [DATA] [MODELS]
|
[AUDIT_LOG]- subdirectory_arrow_right
Agent Identity & Authorization
Designing how agents authenticate, delegate access, and stay inside clear permission boundaries.
- subdirectory_arrow_right
Harness & Workflow Security
Securing the orchestration layer that connects prompts, models, tools, memory, and enterprise data.
Rethinking Identity for Agentic Systems
The mental model I use to reason about identity controls across the originating principal, the agent, and the infrastructure running it.
# BOOT SEQUENCE COMPLETE
Streamline Policy Documentation with Automation and AI
Policy documentation goes stale the moment someone edits a rule in the admin console. I built a pipeline that pulls policies straight from Okta's API, renders them as Mermaid diagrams, and lets me query the whole thing in plain English — full walkthrough, code included.
Okta Policies: Best Practices for Secure Access Controls
Configuring Okta policies isn't a setup task you do once and forget — it's the actual control surface between an attacker with a stolen password and an attacker with access to your systems. Here's what I check when hardening a tenant, end to end.
WHAT I WRITE ABOUT
This is where I document the security problems that show up when agentic systems move from demos into real enterprise environments. My focus is identity: how agents authenticate, receive authority, call tools, access data, and leave enough evidence behind for someone to understand what happened.
HOW I USE AI
I use AI as a research assistant, technical sounding board, and editor. The ideas come from my own engineering work, prototypes, and research. I challenge the output, verify technical claims, rewrite heavily, and take responsibility for everything published here.
ONE ARTICLE A WEEK
For the next year, I am publishing one practical article every week. Expect tool reviews, techniques, incident breakdowns, architecture notes, and lessons from things I am actively building. I will include the failure modes and trade-offs, not just the polished diagram at the end.