Engineering

What Does "Least Privilege" Mean for an Autonomous Agent?

The meeting had been going for forty minutes and the spreadsheet had one unfilled column.

Engineering

JWTs Don't Eliminate Server State. They Relocate It.

The pitch for JWTs is always the same: stateless authentication. No session store. No database lookup on every request. Just verify a signature and read the claims. Your API servers become stateless, which means they scale horizontally without a shared session backend.

Engineering

JWT vs Opaque Tokens: The Operational Trade-off

Almost every article on this subject explains what a JWT is, explains what an opaque token is, notes that JWTs are stateless and opaque tokens are revocable, and stops. That comparison is accurate and nearly useless, because it describes a property you'll read about once and skips the six properties

Engineering

IdP-Initiated vs SP-Initiated SAML: The Difference Is Where the Journey Starts

Put the two flows side by side at the protocol level and they look almost identical. Same assertion format. Same XML signature over the same elements. Same trust model — you configured the IdP's certificate, you check the signature, you accept the statement. If you diffed two Response documents from

Engineering

Identity Platforms Are Mostly Caching Problems

Here's a claim that sounds wrong until you've operated one: an identity platform is not primarily a cryptography system, a protocol implementation, or a database application. It's a cache coherence problem wearing a security costume.

Engineering

Identity Isn't Your User Database

This is the most violated boundary in the whole category, and it's violated for the most sympathetic reason: the identity platform already has a table with a row for every person, and you need somewhere to put a field.

Engineering

How to Evaluate an Identity Vendor Without Reading Marketing Pages

Every identity vendor supports SAML, OIDC, SCIM, MFA, and audit logging. Every one of them will tick every box on your RFP. Every one has a page that says "enterprise-grade" and a diagram with a shield on it.

Engineering

Hashing vs. Encryption vs. Encoding: Three Different Jobs Wearing Similar Clothes

These three terms get used interchangeably often enough that it's worth being precise about why that's a problem: they solve different problems, and picking the wrong one doesn't just mean using suboptimal terminology — it means building something insecure while feeling confident it's secure.

Engineering

Freedom Is Conserved: What LLMs and Identity Platforms Have in Common

I had two conversations in the same week that turned out to be the same conversation.

Engineering

Designing for Key Rotation Before You Need It

Here's a question worth asking your team today, while nothing is on fire:

Engineering

Delegated Administration: The Feature Nobody Scopes Correctly

The request arrives, in every enterprise deal, in almost identical words:

Engineering

Debugging SAML: A Field Guide

SAML errors are uninformative on purpose, and knowing why is the first step to debugging them.