Notes
Working notes on identity when the thing signing in isn't a person. Written by the people building IdenAxis, mostly about problems we hit before we had a product.
Your AI agent has a service account problem
Every agent demo ends the same way: someone pastes an API key into a config file and calls it integration. We gave software a credential good for a year and told ourselves it was a user. Here's what that actually costs.
Scan later, or score now
Posture tools read your configuration back weeks after it was written. By then the intent is gone, the alternatives are gone, and fixing anything costs a change window. There is exactly one moment when a fix is free.
The MFA you deployed is not the MFA you think you deployed
You rolled out push notifications and the dashboard went green. Then someone phoned the help desk, answered three questions about a birthday, and walked straight past all of it. Your recovery lane is your real authentication policy.