Writing
Articles
Notes from IGA program and platform work — what held up in practice, and what didn't.
IGA
Access Certifications Are a Governance Control, Not a Compliance Checkbox
A certification campaign that reviewers rubber-stamp isn't providing the control it's supposed to. What changes reviewer behavior, and why that's the actual design problem.
IGA
RBAC in Practice: Where Role Models Actually Break Down
Role mining from years of ad hoc entitlement grants rarely produces a clean role structure. Notes on where role-based access control gets hard, and the trade-offs that keep a role model maintainable.
IGA
Why Mover Events Are Where JML Automation Actually Breaks
Joiner and leaver automation get most of the design attention. Mover events — transfers, promotions, department changes — are where access quietly accumulates instead of changing.
IGA
Running an Enterprise IGA Platform RFP: What Actually Differentiated SailPoint, Saviynt, and Oracle IDM
Notes from authoring the requirements, running proof-of-concept builds on SailPoint and Saviynt, and evaluating all three against a real requirements set — what mattered more than any feature comparison matrix.
IGA
What 'Modern IGA' Actually Means Beyond the Vendor Slide
IGA vendors converge on the same language. The differences that actually matter in a program are three design decisions, not the platform underneath them.