Long-form arguments about privileged access, agent identity, and the architecture of the agentic era.
2026-07-10 · [email protected]
The identity platforms now selling ‘agent trust’ have the right primitive and the wrong layer. A short-lived certificate answers who an agent is. It does not answer whether this agent may take this action right now, or how fast you can stop it mid-flight.
Read →2026-04-28 · [email protected]
A new category is forming under the privileged-access stack. The incumbents were designed for human session management, role activation, and MSP-scale subscription delegation. None of them were designed for software that asks for a 90-minute Owner-equivalent on a single App Service and disappears.
Read →Subscribe
We don't run a newsletter yet. Add /feed.xml to your RSS reader to get future essays. The feed will be live alongside the next essay.
Ephemeral Identity Is Not Access Control