Articles on identity, Zero-Trust and AI security
Patterns, decision frameworks and lessons from real programmes. Opinions are my own. Every article is shared on LinkedIn - join the discussion there.
Fine-Grained Access Control: From Front-Door Security to Decisions That Understand Context
Most estates guard the front door and trust everything behind it. FGAC moves authorisation from 'can you enter the application' to 'can you see this record, this field, this row, right now' - and it is fast becoming the control that separates defensible architectures from hopeful ones.
Read article →Securing Enterprise AI Systems: A Zero-Trust Reference Architecture
A plane-by-plane reference architecture for securing chatbots, agentic AI, and multi-agent systems - distributed PEPs, a central PDP, and identity as the correlation key for everything. Aligned to NIST SP 800-207, XACML 3.0, OWASP LLM Top 10 and MITRE ATLAS.
Read article →Non-Human and Agentic AI Identity: Governing What You Cannot Interview
AI agents are joiners you never onboarded and leavers who never resign. Twelve months of writing enterprise IAM controls for AI taught me that agent identity is a lifecycle problem first and a technology problem second.
Read article →Zero-Trust Identity: From Slideware to Enforceable Architecture
Zero-Trust fails as a slogan and succeeds as an enforcement topology. PDP, PEP, PIP and PAP roles, where they live in a Microsoft-centric estate, and how to sequence the journey without breaking the business.
Read article →Retiring ADFS: A Pragmatic Migration Path Off Federation Infrastructure
I have designed global ADFS farms and I have decommissioned them. Here is the honest decision framework for moving to cloud authentication - and the traps that keep federation servers alive years past their welcome.
Read article →Conditional Access at Scale: Consolidating Policy Sprawl into a Framework
Forty-plus overlapping policies is not a security posture, it is an archaeology project. A repeatable method for redesigning Conditional Access as a small, governed policy framework.
Read article →RBAC, ABAC, PBAC: Choosing an Access Model That Survives Contact with Reality
Role explosion is not an RBAC failure, it is a modelling failure. Where each access control model earns its keep, how they combine, and why the enforcement architecture matters more than the acronym.
Read article →The Identity Fabric: Multi-Vendor IAM Without the Chaos
Real enterprises run Entra ID next to Google Identity next to two IGA platforms they meant to consolidate. Fabric thinking replaces the fantasy single-vendor end state with an architecture that governs heterogeneity.
Read article →JML Done Properly: Architecting the Joiner-Mover-Leaver Lifecycle
Most access risk is manufactured on day one and never revoked. Designing JML as an architecture - authoritative source, event-driven orchestration, birthright discipline and leaver guarantees - rather than a set of helpdesk tickets.
Read article →Have an identity challenge worth solving?
I take a small number of freelance and contract engagements each year.