Writing
Identity & Security · 5 min read
A mobile app cannot hide a client secret, so a stolen authorization code becomes free tokens. PKCE fixes this with a fresh, one-time proof invented at the start of each login — walked as diagrams, plus the full flow in one picture.
Identity & Security · 8 min read
Letting an app act for you, without handing over your password. The authorization code flow walked step by step, why the code is useless without a client secret, and the access-token-as-hotel-key-card analogy that makes refresh tokens click.
Identity & Security · 4 min read
Who are you, and how does a system prove it? Identity, attribute, account and authentication, pinned down with John Wick's first day at a fictional aerospace supplier.
Identity & Security · 5 min read
Being authenticated gets you in the door. Authorization decides which rooms you can open. Covers authorization vs AuthN, coarse vs fine-grained access, Active Directory, and how an identity provider makes SSO work.
Identity & Security · 6 min read
Passwords, OTPs, push approval, number matching, FIDO2. Each MFA method exists because the one before it broke — walked through the attacks that forced each upgrade, ending with why AAL3 requires a hardware key.
Identity & Security · 8 min read
The signed statement behind SSO, opened up: SP-initiated vs IdP-initiated flows, why SAML assertions resist replay, why certificate expiry is the most common SAML outage, and where the standard starts to break.
Identity & Security · 2 min read
Start here for a living study series on Identity and Access Management. Each chapter has my handwritten notes as a one-page image, built around one running example: John Wick, a design engineer at a fictional aerospace supplier.
Agentic AI · 5 min read
How an agent actually works: the LLM decides, the runtime validates and executes, and the loop repeats until the goal is met. Walked through turn by turn with the iPhone 18 launch-day example.
Agentic AI · 4 min read
The model never runs a tool. It only asks for one in a structured format, and the runtime validates and executes it. Explained with the iPhone 18 launch-day example.
