Book
Identity & Access
Authentication versus authorisation, federation, the joiner-mover-leaver lifecycle, entitlements, privileged access, secrets, and machine identity.
Deliberately not framed through AI — this is a discipline in its own right. The last chapter is where the two meet.
CHAPTER 1
Authentication, authorisation, audit
Three different questions. Conflating them is the root of most identity incidents.
CHAPTER 2
Federation, SSO, SAML and OIDC
The acronym soup, deflated. Four ideas, and you only need one mental model.
CHAPTER 3
The lifecycle — joiner, mover, leaver
The least fashionable part of identity and the source of the most real exposure.
CHAPTER 4
Entitlements, RBAC and ABAC
How permission models actually decay, and why role explosion is a design failure rather than bad luck.
CHAPTER 5
Privileged access — why admin is different
The single highest-value control surface in an enterprise, and what PAM products actually sell.
CHAPTER 6
Secrets management
The problem every engineering organisation has, and most solve badly.
CHAPTER 7
Machine and agent identity
Non-human identities already outnumber humans. AI agents are about to make that worse — and it is becoming a job title.
CHAPTER 8
Zero trust, honestly
The most over-marketed term in security, wrapped around a genuinely good idea. This chapter separates the two.
CHAPTER 9
OAuth 2.0 and OIDC, properly
The protocol behind every ‘sign in with’ button. Four token types, one flow that matters, and the validation step whose absence is a complete authentication bypass.
CHAPTER 10
SAML and enterprise federation
XML, assertions, and three signature attacks that broke real products. Still the backbone of enterprise SSO, and worth understanding precisely rather than avoiding.
CHAPTER 11
Kerberos, LDAP and Active Directory
The protocol running inside almost every enterprise on earth, and the four attacks every red team tries first.
CHAPTER 12
Passwordless: FIDO2, WebAuthn and passkeys
The first authentication technology that makes phishing structurally impossible rather than merely harder — and the honest trade-off inside the passkey.
CHAPTER 13
The IAM product landscape
Who sells what, who leads, what it costs, and the four structural changes that reshaped this market between 2024 and 2026.
CHAPTER 14
Getting a password out of a vault, in code
You have been told to fetch it from Vault or CyberArk and given no further instructions. This is the rest of that sentence.
CHAPTER 15
MFA architecture, and how it actually gets bypassed
Which factor where, when to ask again, and the attack that makes most multi-factor deployments worth less than their owners think.
CHAPTER 16
Authentication and authorisation for AI agents
An agent is neither a user nor a service. How it should prove who it acts for, and what to do about everything it reads and everything it can reach.