Engineering
The Identity Latency Budget: Where 200 Milliseconds Actually Goes
A user clicks "Sign in." Somewhere between that click and the moment they see their dashboard, they've formed an opinion about your product.
Engineering
Engineering
The Hidden Cost of Audit Logs
Security teams say: log everything.
Engineering
The Hardest Problem in Identity Isn't Authentication. It's Recovery.
Every security team's threat model has an attacker trying to get in. Almost none of them have the scenario that actually generates the most difficult decisions: a legitimate user, locked out, who is telling the truth.
Engineering
The Great Password Myth: Why Forced Rotation Made Things Worse
For about twenty years, the 90-day password change was one of the least controversial things in enterprise IT. It appeared in every hardening guide, every audit checklist, every onboarding deck. Nobody had to defend it, because nobody attacked it.
Engineering
The Forgotten Side of SSO: Keeping Sessions in Sync
A support ticket from a real category of incident:
Engineering
The Extensibility Trap: Why Every Identity Platform Needs Opinions
Every enterprise deal eventually produces the same sentence, usually about forty minutes into a technical call, usually phrased apologetically:
Engineering
The Confused Deputy Problem Comes Back With Agents
In 1988, Norm Hardy wrote up a bug in a Fortran compiler that ran on a shared university mainframe.
Engineering
The Composability Test: Five Questions Before Adding a Feature
Arguments about scope are hard to win because both sides are reasonable.
Engineering
The Art of Load Testing: Why Most Performance Tests Fail Before They Start
Most teams load test a week before launch.
Engineering
The 10 Architectural Decisions That Define Every Identity Platform
Every identity platform is the sum of about ten decisions, most of which get made in the first six months and none of which get revisited cheaply. They're not implementation details. They're the load-bearing choices that determine what the system can do five years later — and more importantly, what
Engineering
Step-Up Authentication: The Right Way to Handle Sensitive Operations
A bank I worked with had a rule: transfers over £10,000 required a second factor.
Engineering
Signed, Encrypted, or Both: A Decision Guide for SAML
Somewhere in your SAML integration documentation there is probably a sentence like "assertions must be signed and encrypted." Somewhere in a customer's security questionnaire there is a question asking whether you support assertion encryption, and the only commercially viable answer is yes.