Blog
IAM Chapter 10: One Page
On this page
Part of the IAM study series.
Ten chapters, seven ideas, and nine questions worth asking.
1. The Spine: Where Every Chapter Sits
An identity exists → proves → is granted → is decided → is used → is reviewed → is proven.
| Stage | What happens | Where |
|---|---|---|
| Exists | Identity created | Chapter 7 |
| Proves | Authentication | Chapters 2–6 |
| Is granted | Provisioning | Chapters 6 and 7 |
| Is decided | PDP, PEP, PIP | Chapter 6 |
| Is used | Continuously evaluated | Chapter 9 |
| Is reviewed | Recertified | Chapter 8 |
| Is proven | Evidence | Chapter 8 |
And every stage runs three times over: for humans, for machines (ten to fifty times as many, and governed least), and for partners (whose lifecycle events you never receive).
Export control cuts across all seven. Zero Trust is a stance on the middle three, not a stage of its own.
2. Seven Ideas That Kept Coming Back
1. The revocation window. Every system decides at one moment and enforces for a while after. The gap is the control you're actually operating, whatever the policy says. It appeared in Kerberos service tickets, JWT lifetime, PDP cache TTL, HR→directory sync, a failed SCIM call, a group membership nobody re-reads, and an 8-hour VPN session. Choose it deliberately, or inherit it by accident.
2. Expiry beats review. A review needs a human to act to remove. An expiry needs a human to act to keep. Only one of those is self-correcting when nobody is paying attention.
3. Duration beats scope. Exposure is scope × time held. Narrowing the grant is the obvious move; shortening how long it's held is the bigger one, and usually the cheaper.
4. The weakest path defines the control. A proxy in front of 60% of apps with a VPN carrying the rest is a second door to the same room. An SoD gate bypassed by role membership. A PLM export policy bypassed by a nightly copy job. Enumerate the paths, not the controls.
5. Preventive or detective, chosen by reversibility. Recoverable, bounded harm → detective is a fair trade for speed. Irreversible harm → preventive only, and you pay the latency. A payment can be clawed back; an export can't be un-exported.
6. A token does not defend itself. A signature proves origin and integrity. Every other claim is descriptive: the issuer writing down the intended conditions and trusting the recipient to honour them. The check that always passes is the signature; the one that matters is aud.
7. Design for the party you don't control. The vendor who rotates keys with no notice. The supplier who never sends the leaver event. The app team who reads the access token anyway. Their discipline is their choice; yours is yours. So build the control that survives their decision: re-fetch on an unknown kid, roster reconfirmation instead of leaver notification, and default to lapse, not to continue.
And three distinctions people merge, at a cost:
- Disable ≠ deprovision. The B2B guest, its groups and its entitlements all survive the home account being disabled.
- Authentication ≠ lifecycle. A federated sign-in failing fast isn't a leaver event.
- Unauthorised ≠ unlawful. Alerting catches a control failing; only reconstruction catches a control working exactly as configured, wrongly.
3. Nine Questions: What to Ask When a Team Tells You It's Fine
| When they say… | Ask | Because |
|---|---|---|
| "We validate our tokens" | Which of the four checks? | The signature is the one that always passes; aud is the one that stops substitution |
| "We use PKCE, so we don't need state" | Where is the code verifier stored? | In the browser session it protects you; in a shared cache it does nothing |
| "We set a 15-minute token" | What is checked at refresh, and how long does the refresh token live? | Silent refresh renews a decision nobody re-made; the refresh token is the real window |
| "Access reviews came back 97% approved" | What was in scope, and what was the median time per decision? | 97% is healthy on a pre-filtered scope and meaningless on a raw one; 2 seconds means nobody reviewed |
| "We've moved to Zero Trust" | After the proxy says yes, what can I reach? | A better decision isn't a smaller trust zone, and the weakest path defines it |
| "We use managed identities" | And a vault for what the platform can't issue? | Platform identity gets you through the door; the vault holds the rest |
| "We switched to Kerberos instead of a password" | Where does the keytab live, and when was it last rotated? | Same shape, different format: a real improvement on the wire, none at rest |
| "Export control is enforced in PLM" | What copies data out of PLM? | Enforcement follows the data, not the application |
| "PIM means nobody holds standing privilege" | From which device, and what persists past the window? | JIT and tiering are orthogonal; the window of elevation isn't the window of consequence |
4. The Map
| Chapter | What it was for |
|---|---|
| 1 | Identity, authentication, authorization, credential, and why conflating them causes everything later |
| 2 | Authorization, identity providers and directories |
| 3 | Passwords, MFA, and what a factor actually proves |
| 4 | SSO and federation with SAML: the assertion, the session, the trust |
| 5 | OAuth 2.0 and PKCE: delegation without credential sharing (Part 1, Part 2). OIDC: who logged in, the four checks, JWKS, discovery, nonce vs state (Part 3, Part 4) |
| 6 | ACL → RBAC → ABAC, PDP/PEP/PIP/PAP, Kerberos, AD and LDAP |
| 7 | Joiner-mover-leaver, populations, SCIM, reconciliation, non-human identity, vaults |
| 8 | Recertification, SoD, least privilege, PAM and tiering, export control, evidence |
| 9 | Zero Trust: the implicit trust zone, NIST 800-207, continuous evaluation |
| 10 | This page |
The determination belongs to the function that owns it. Your job is to make it enforceable, and provable.
