Long-form arguments about privileged access, agent identity, and the architecture of the agentic era.
2026-09-18 · [email protected]
Disabling the account ends the person's sessions. It does nothing to the app registrations they own, the secrets and federated credentials on those apps, the role assignments their object ID created, or the pipeline service connections still holding standing access. This is the inventory you can run against your own tenant today, and the cascade that inventory specifies.
Read →2026-07-10 · [email protected]
The identity platforms now selling ‘agent trust’ have the right primitive and the wrong layer. A short-lived certificate answers who an agent is. It does not answer whether this agent may take this action right now, or how fast you can stop it mid-flight.
Read →2026-04-28 · [email protected]
A new category is forming under the privileged-access stack. The incumbents were designed for human session management, role activation, and MSP-scale subscription delegation. None of them were designed for software that asks for a 90-minute Owner-equivalent on a single App Service and disappears.
Read →Subscribe
We don't run a newsletter yet. Add /feed.xml to your RSS reader to get future essays. The feed will be live alongside the next essay.
Your Offboarding Playbook Stops at the Human