< BACK_TO_INDEX

TECHNICAL_ARCHIVE

[AGENT SECURITY]2026.08.20 // 17 MIN READ

Your Agent Can Run Code. What Can That Code Reach?

Sandboxing is not one control. A practical way to choose isolation, network, identity, and runtime boundaries based on what an agent can actually affect.

[IAM]2026.08.12 // 16 MIN READ

Building an IAM Agent: Start With the Data, Not the LLM

How I built an IAM agent by treating the data and analytics layer as the source of truth, with skills and LLMs acting as a controlled interface.

[AGENT SECURITY]2026.08.08 // 12 MIN READ

Your Prompt Isn't the Security Boundary

A practical way to think about harness safety when agents can actually execute.

[AI AUTHORIZATION]2026.07.20 // 7 MIN READ

Authorization Beyond Tool Calling

Why enterprise authorization is about capabilities, identity, and resource boundaries, not just tool permissions.

[AI IDENTITY]2026.07.12 // 7 MIN READ

Rethinking Identity for Agentic Systems

The mental model I use to reason about identity controls across the originating principal, the agent, and the infrastructure running it.

[IAM]2024.01.14 // 12 MIN READ

Streamline Policy Documentation with Automation and AI

Policy documentation goes stale the moment someone edits a rule in the admin console. I built a pipeline that pulls policies straight from Okta's API, renders them as Mermaid diagrams, and lets me query the whole thing in plain English — full walkthrough, code included.

[IAM]2023.12.30 // 7 MIN READ

Okta Policies: Best Practices for Secure Access Controls

Best practices for configuring Okta policies, including session controls, phishing-resistant MFA, managed devices, passwordless authentication, and application-specific access policies.

[IAM]2023.12.29 // 5 MIN READ

Introduction to Okta Policies

An introduction to Okta Policies, how policies, rules, and conditions fit together, and how Global Session and Application Access Policies are evaluated.

[Cryptography]2023.10.21 // 3 MIN READ

Quantum Computing: The Next Frontier in Cybersecurity

Shor's algorithm doesn't threaten AES the way people assume — it threatens the key exchange and signatures wrapped around it. What's actually at risk, what NIST has already standardized, and how to check if your own stack has a post-quantum-safe cipher suite available yet.

[Career]2023.08.11 // 2 MIN READ

What's Actually in My Security Backpack

The tools I carry matter less than the skills that decide which tool to reach for. A rundown of what's actually in rotation: risk assessment, networking, CLI fluency, automation, incident response, and the two soft skills that tie it together.

[Data]2023.05.28 // 4 MIN READ

Data Storytelling in Cybersecurity

Making sense of the noise by turning cybersecurity data into a clear story that helps people understand what matters and what action to take.

[IAM]2023.03.31 // 5 MIN READ

The Power of Automation and Intelligence

A practical look at using automation, HR integrations, risk-based authentication, AI, and IAM metrics to make an identity program more responsive and easier to manage.

[Identity Management]2022.09.29 // 6 MIN READ

Discovery: Who Has Access to What and How?

Understanding your authentication landscape by mapping identity sources, access paths, applications, and lifecycle processes before designing IAM controls.

[Identity Management]2022.09.23 // 5 MIN READ

MFA Fatigue: How to Protect Your Users

MFA fatigue attacks rely on stolen credentials and repeated authentication prompts. A layered approach using phishing-resistant MFA, device context, application policies, and clear user guidance can reduce the risk.