Essays, field notes, and practical frameworks for identity systems that have to work in the real world.
Multi-tenancy is an authorization boundary, not just a tenant_id column. Identity must establish tenant context before every access decision.
RBAC works for stable job functions. AI agents often need ABAC's contextual, per-request authorization decisions.
Identity is not a security review item you bolt on before launch; for AI applications, it is architecture that needs to run through the whole system from the first commit.
Authentication answers who you are. Authorization decides what you can do, and AI agents need that decision checked continuously.
Four identity standards, four different jobs. A practical guide to understanding how OAuth, OIDC, SAML, and JWT fit together in modern applications and AI agent systems.
API keys prove that a caller knows a secret. AI agents need scoped, expiring, and auditable identity instead.
OAuth’s human-centered assumptions start to break when agents act unattended, delegate work, and chain decisions across services.
Enterprise identity solved many of the problems AI agents are creating today. Here are five lessons worth borrowing.