#governance

The whole series on one page: ten chapters, seven ideas, and nine questions worth asking when a team tells you it is fine.

• iam
• capstone
• identity

Privilege is not a job title. It is how far the damage reaches. The four-question test for a privileged account, tiering as the one structural control, PAM as three separable things, what JIT elevation does and does not buy, and break-glass.

• iam
• governance
• pam

IAM is not supporting export control. IAM is the enforcement mechanism. Deemed exports, why it had to be ABAC, the licence that silently expires, where these programmes actually fail, and why enforcement working does not produce audit evidence.

• iam
• governance
• export-control

Provisioning has an event for everything except "this is no longer needed". Why recertification campaigns mostly do nothing, separation of duties as a combination problem, and least privilege made measurable.

• iam
• governance
• iga