TECHNICAL_ARCHIVE
Your Agent Can Run Code. What Can That Code Reach?
Sandboxing is not one control. A practical way to choose isolation, network, identity, and runtime boundaries based on what an agent can actually affect.
Building an IAM Agent: Start With the Data, Not the LLM
How I built an IAM agent by treating the data and analytics layer as the source of truth, with skills and LLMs acting as a controlled interface.
Your Prompt Isn't the Security Boundary
A practical way to think about harness safety when agents can actually execute.
Authorization Beyond Tool Calling
Why enterprise authorization is about capabilities, identity, and resource boundaries, not just tool permissions.
Rethinking Identity for Agentic Systems
The mental model I use to reason about identity controls across the originating principal, the agent, and the infrastructure running it.
Streamline Policy Documentation with Automation and AI
Policy documentation goes stale the moment someone edits a rule in the admin console. I built a pipeline that pulls policies straight from Okta's API, renders them as Mermaid diagrams, and lets me query the whole thing in plain English — full walkthrough, code included.
Okta Policies: Best Practices for Secure Access Controls
Best practices for configuring Okta policies, including session controls, phishing-resistant MFA, managed devices, passwordless authentication, and application-specific access policies.
Introduction to Okta Policies
An introduction to Okta Policies, how policies, rules, and conditions fit together, and how Global Session and Application Access Policies are evaluated.
Quantum Computing: The Next Frontier in Cybersecurity
Shor's algorithm doesn't threaten AES the way people assume — it threatens the key exchange and signatures wrapped around it. What's actually at risk, what NIST has already standardized, and how to check if your own stack has a post-quantum-safe cipher suite available yet.
What's Actually in My Security Backpack
The tools I carry matter less than the skills that decide which tool to reach for. A rundown of what's actually in rotation: risk assessment, networking, CLI fluency, automation, incident response, and the two soft skills that tie it together.
Data Storytelling in Cybersecurity
Making sense of the noise by turning cybersecurity data into a clear story that helps people understand what matters and what action to take.
The Power of Automation and Intelligence
A practical look at using automation, HR integrations, risk-based authentication, AI, and IAM metrics to make an identity program more responsive and easier to manage.
Discovery: Who Has Access to What and How?
Understanding your authentication landscape by mapping identity sources, access paths, applications, and lifecycle processes before designing IAM controls.
MFA Fatigue: How to Protect Your Users
MFA fatigue attacks rely on stolen credentials and repeated authentication prompts. A layered approach using phishing-resistant MFA, device context, application policies, and clear user guidance can reduce the risk.