Articles on identity architecture, Zero-Trust and AI security by Craig Bull, Principal IAM Domain Architect.https://www.craigbull.co.uk/https://www.craigbull.co.uk/articles/fine-grained-access-control/https://www.craigbull.co.uk/articles/fine-grained-access-control/Most estates guard the front door and trust everything behind it. FGAC moves authorisation from 'can you enter the application' to 'can you see this record, this field, this row, right now' - and it is fast becoming the control that separates defensible architectures from hopeful ones.Wed, 19 Aug 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/securing-enterprise-ai-systems/https://www.craigbull.co.uk/articles/securing-enterprise-ai-systems/A plane-by-plane reference architecture for securing chatbots, agentic AI, and multi-agent systems - distributed PEPs, a central PDP, and identity as the correlation key for everything. Aligned to NIST SP 800-207, XACML 3.0, OWASP LLM Top 10 and MITRE ATLAS.Mon, 10 Aug 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/identity-for-agentic-ai/https://www.craigbull.co.uk/articles/identity-for-agentic-ai/AI agents are joiners you never onboarded and leavers who never resign. Twelve months of writing enterprise IAM controls for AI taught me that agent identity is a lifecycle problem first and a technology problem second.Tue, 21 Jul 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/zero-trust-identity-enforceable/https://www.craigbull.co.uk/articles/zero-trust-identity-enforceable/Zero-Trust fails as a slogan and succeeds as an enforcement topology. PDP, PEP, PIP and PAP roles, where they live in a Microsoft-centric estate, and how to sequence the journey without breaking the business.Tue, 30 Jun 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/retiring-adfs/https://www.craigbull.co.uk/articles/retiring-adfs/I have designed global ADFS farms and I have decommissioned them. Here is the honest decision framework for moving to cloud authentication - and the traps that keep federation servers alive years past their welcome.Tue, 09 Jun 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/conditional-access-at-scale/https://www.craigbull.co.uk/articles/conditional-access-at-scale/Forty-plus overlapping policies is not a security posture, it is an archaeology project. A repeatable method for redesigning Conditional Access as a small, governed policy framework.Mon, 18 May 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/rbac-abac-pbac/https://www.craigbull.co.uk/articles/rbac-abac-pbac/Role explosion is not an RBAC failure, it is a modelling failure. Where each access control model earns its keep, how they combine, and why the enforcement architecture matters more than the acronym.Mon, 27 Apr 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/identity-fabric/https://www.craigbull.co.uk/articles/identity-fabric/Real enterprises run Entra ID next to Google Identity next to two IGA platforms they meant to consolidate. Fabric thinking replaces the fantasy single-vendor end state with an architecture that governs heterogeneity.Mon, 06 Apr 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/jml-done-properly/https://www.craigbull.co.uk/articles/jml-done-properly/Most access risk is manufactured on day one and never revoked. Designing JML as an architecture - authoritative source, event-driven orchestration, birthright discipline and leaver guarantees - rather than a set of helpdesk tickets.Mon, 16 Mar 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/tiered-administration/https://www.craigbull.co.uk/articles/tiered-administration/Attackers do not hack in, they log in and move up. The tiered administration model - Tier 0 isolation, PAWs and credential hygiene - remains the highest-value control set in any hybrid AD estate.Mon, 23 Feb 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/ciam-is-not-workforce-iam/https://www.craigbull.co.uk/articles/ciam-is-not-workforce-iam/Workforce IAM manages people you pay; CIAM courts people who can leave. Journey design, progressive profiling, GDPR-aligned consent and B2B federation - and why treating customers like employees fails at both security and revenue.Mon, 26 Jan 2026 00:00:00 GMThttps://www.craigbull.co.uk/articles/federation-protocols-field-guide/https://www.craigbull.co.uk/articles/federation-protocols-field-guide/Which protocol, when, and the failure modes in between. A working decision guide for application onboarding, written from the position of the person who has to govern the estate afterwards.Mon, 15 Dec 2025 00:00:00 GMThttps://www.craigbull.co.uk/articles/documentation-is-architecture/https://www.craigbull.co.uk/articles/documentation-is-architecture/Undocumented architecture is opinion. Twenty years of HLDs, LLDs and ArchiMate models distilled into a documentation stack that survives handover, audit and your own departure.Mon, 24 Nov 2025 00:00:00 GMT