Latest / Identity at the Center / #410 - Sponsor Spotlight - Strivacity

Transcript

#410 - Sponsor Spotlight - Strivacity · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff and ask Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good.
0:17
I'm wearing my baseball hat. It's going to come up in the
0:20
lighter note as to why I'm doing that, so people are going to
0:24
have to stick around to the end to find out.
0:26
Yeah, I'm sure there will be plenty of discussion.
0:29
I'm just kind of like going to hand it off to you at that
0:31
point, Vic. All right, it's time for a
0:32
lighter note and take it away, Jim, because I think it's, I
0:35
think I'm pretty well established at this point that I
0:37
am not a baseball fan. Yeah, I think we all know that
0:40
you're an identity fan. I am an identity fan and you
0:44
know, like, like others that probably listen to this podcast,
0:47
a lot of identity fans that are out there today.
0:49
We do have a sponsored episode. We're sponsored by Strabacity.
0:53
We're going to talk with Steven Cox here in a minute, but just
0:54
make it clear, right? This entire episode is is
0:57
sponsored by them. We appreciate that.
0:59
That's how we're able to do first of all, so many podcasts,
1:01
you know, one every week, attend conferences and really get kind
1:05
of insights from the different folks that we talked to.
1:06
And and Steven is no stranger to this.
1:08
He's been with us multiple times.
1:10
So let me go ahead and get him on here.
1:12
But again, Stervacity, you can find him on the web, STRIVACIT,
1:18
y.com. I'll have that link in our show
1:20
notes so people can check it out there as well.
1:21
But let's welcome Steven. He's the Co founder and chief
1:24
technology officer at Strivacity.
1:26
Welcome back to the show, Steven.
1:28
Thanks so much. It's good to see you guys.
1:31
OK, so you've done 400 plus episodes now of which I have
1:36
done? 3 So you have a third timer
1:39
jacket coming to. You from a gym?
1:40
Oh wow. OK, so so where?
1:42
So where do I rank on the return guest?
1:45
Like, you know, meter I guess. I would say to come back on any
1:49
more than two or three times is that means we like you, we like
1:54
all of our guests, but the fact that you've come back and now
1:57
this is your second time sponsoring episode, we
1:59
definitely love that. So thanks for you know, thanks
2:01
for that. That definitely greases the
2:02
wheels. Absolutely.
2:04
We met you like way back in the past, like you've seen this
2:07
podcast grow over the years. We met in episode 1112, back in
2:13
2021, and then we talked to you again in your first sponsored
2:17
episode in episode 317 in 2024. Now you're back for another
2:20
sponsored episode here in 2026. So you've actually kind of seen
2:25
this thing grow, which is nuts. Totally.
2:27
Yeah. Seeing you guys go from, you
2:28
know, podcasts trying to sort of get off the ground to like
2:31
complete celebrities at Ideniverse, right?
2:33
So yeah. I struggle with that, but it's,
2:36
yeah, you could argue. I think we're still trying to
2:38
get it off the ground, but it'll never be good enough for me.
2:41
There you go. So we, we had you on before we
2:45
talked about Trivacity, but just to kind of refresh memories,
2:47
give us a little bit about Trivacity.
2:49
What do you guys are up to and what are the some of the
2:51
problems that you, you know, look to solve in the market?
2:53
Absolutely. So we're a customer identity
2:56
ACIM platform. You know, we, we help companies
3:00
manage how customers do things like register or authenticate or
3:06
access services, you know, sort of further back, you know,
3:09
within their application. So, you know, most consumer
3:12
facing systems need a reliable way to handle things like
3:16
registration, login, account recovery, identity verification,
3:20
but they need to do it in a way that scales to millions of users
3:23
in the customer side, right? You have a much larger scale for
3:27
for customers and you also have to meet data privacy
3:30
expectations. And so our, our role is to
3:34
provide that infrastructure so companies don't have to build
3:36
and maintain it themselves. You know, and in practice, that
3:39
means we're an identity provider, an authorization
3:42
server, and we handle the identity layer for, for these
3:46
businesses. And so we recently announced
3:49
support for AI agents within, within our platform.
3:53
So our approach there, and which we're going to talk about a lot
3:56
today is like kind of treats AI agents as delegated actors tied
4:01
to a real user identity. So, you know, orgs can sort of
4:05
authorize what an agent can do, enforce policies around it, and
4:10
maintain sort of a full chain of accountability between the human
4:13
down to the agent. So agentic identity is so hot
4:16
right now, and that's kind of the thrust of this conversation.
4:20
We did an episode with Tobin South in December of 2025.
4:25
It's episode 390 and it's he's the reason you're here.
4:31
What is it about that episode? You know, you know, Tobin, if
4:33
you're listening, it's your fault that Steven has come back.
4:35
He has something to say in regards to that episode.
4:37
But what was it about that episode that caught your
4:40
attention? Is like, hey, you know, I want
4:41
to talk to you guys about this. Totally.
4:43
Yeah, No, I mean, the episode really resonated with me.
4:45
I thought it was really good. I think Tobin did an awesome job
4:48
of laying out the the challenges that we're facing here, you
4:51
know, and sort of how fast we're sort of rushing into this and,
4:56
you know, as as we sort of move into this agentic model and, you
4:59
know, selfishly, a lot of what he talked about kind of maps
5:04
closely to what we're seeing as well.
5:06
So, you know, I think, you know, sort of the concept is that
5:09
we're sort of introducing a new actor into these systems.
5:13
You know, AI agents can operate on behalf of a person.
5:17
You know, I really appreciated that he grounded it in existing
5:21
standards work, you know, he's doing through the, you know,
5:23
through open ID foundation. One of the things we strongly
5:27
believe is that this problem doesn't necessarily require
5:30
inventing a new entirely a new, an entirely new identity model.
5:35
You know, a lot of the building blocks are already there and,
5:37
and things like O auth or open ID connect.
5:41
So we, we really just need to apply them thoughtfully to the
5:45
agent problem. So, you know, hearing, hearing
5:48
him talk about it from the standard side was encouraging to
5:50
me as well, because that's sort of the pathway we're taking it.
5:54
You know, it shows that the industry's kind of contemplating
5:57
really good ideas around this, you know, a strong delegation
6:00
model, constrained authority, you know, clear auditability of
6:05
agent actions. And I think these are, you know,
6:07
these are things that we're we're talking about as well.
6:09
So it just kind of resonated like, oh wow, we're talking
6:12
about the same things, you know what I mean?
6:14
Yeah. I mean, Jeff and I joke around a
6:16
lot and call this AI at the center.
6:19
We're talking about authentication authorization a
6:21
lot for AI agents, but it's mostly on the enterprise
6:26
workforce side. And you guys are obviously
6:29
taking it from the approach of customer.
6:32
I am. And I wanted to know kind of
6:34
start the conversation with like why is the right, why is now the
6:38
right time to talk about this? Yeah.
6:41
So if you kind of, if you kind of look back in history a little
6:44
bit, you know, AI was sort of mostly helping people do things
6:48
like research or make decisions, right?
6:50
You know, using sort of a, the, the, the chat bot interface.
6:54
But what we're seeing now is that, you know, agents are
6:56
executing actions on behalf of users, right?
6:58
And some examples, maybe contrived examples would be like
7:01
booking travel or, you know, managing your accounts or making
7:06
purchases on your behalf, right? So when you enter a world where
7:10
like AI starts to act, identity kind of becomes a, a critical
7:14
part because every action must be sort of tied back to the user
7:17
that, that, that authorized it. And so we've entered, we, we,
7:22
we've created this kind of new type of actor into identity
7:26
systems. It's not really just humans
7:28
logging in anymore. Now you have these like agents
7:30
that are acting for humans, You know, it sort of extends the,
7:35
the surface, right? And the potential attack
7:37
surface, which means that like authentication, delegation,
7:41
authorization models need to evolve to, to, to, to sort of
7:44
keep, keep pace with it. And then, you know, following
7:49
that is liability, especially in the customer side, right?
7:52
So when you're executing transactions on behalf of
7:55
customers, the stakes change completely.
7:58
So if an agent changes a shipping address or resets an
8:02
account or initiates a payment, like an organization needs to be
8:05
able to prove who authorized that what or what authority the
8:09
agent had and why the agent, you know, why the action was
8:12
allowed, right? So identity kind of becomes like
8:15
an accountability layer in, in, in this, in this kind of model.
8:19
And a really interesting point is that CIAM is kind of where
8:25
agentic interactions are actually happening right now.
8:28
So you have, you know, historically we've talked about
8:31
enterprise OR workforce, but like customer identity systems
8:35
are where real consumer actions are occurring, right?
8:37
Logins, purchases, support flows.
8:40
So CIM kind of comes the place where agents are actually
8:42
meeting real users, right, and real data.
8:45
And so that's a, that's a really important point to, to sort of
8:49
hammer, hammer down on. And, you know, the market
8:52
narrative is still forming. I think the, I think the vendors
8:56
are sort of framing agents as like this new identity that need
8:59
authentication. But you know, and the standards
9:02
and the best practices are still forming.
9:04
But this is a good moment for for vendors like us to shape how
9:09
agent identity actually works before the patterns solidify,
9:11
right? So it's a great place for me as
9:13
acto of a of a vendor up and coming vendor to, to be able to
9:17
shape, you know how I think things should work, right?
9:20
Yeah, yeah, the the discussion I think is really interesting and
9:25
I philosophically agents doing things on behalf of people is a
9:31
lot different. Wondering from a mechanic's
9:33
perspective, is there a difference between what AI
9:37
agents are doing from an authentication authorization
9:40
standpoint from humans? From an from an authorization
9:44
standpoint, yeah. So, you know, let's look at it
9:51
this way. I mean, agents introduce like
9:54
like a delegated actor, right? And I think that's kind of the
9:58
one of the core concepts to think about is, you know, in
10:02
traditionally, like the actor was already was almost always
10:05
the human customer, right, The human themselves with a Gentech
10:09
guy, you now have software that's acting on behalf of a
10:12
customer, which introduces A delegation model.
10:15
So the the system kind of needs to know who the agent is, who
10:20
they represent and what they're allowed to do, right?
10:23
And that's when you start talking about like the
10:25
authorization side of it. So authorization kinda needs to
10:31
be more granular here. So, you know, humans usually
10:35
have very broad account permissions once they've logged
10:37
in. Agents require much tighter
10:39
control. So, you know, for example, an
10:42
agent might be able to like view account data, but not change
10:46
billing info or initiate purchases over a certain amount.
10:50
And So what it means is that authorization shifts from like,
10:54
you know, historically simple scopes to more of like a
10:58
capability based permission. And there's, there's a, you
11:02
know, there's an extension to Oauth called RAR that like
11:05
covers like much more granular permission, much more granular
11:10
permissions, you know, that are associated with an authorization
11:13
request. This ability becomes really
11:16
important. So you need to kind of have
11:18
clear logs of like what the agent did, notifications for
11:22
sensitive actions, controls to sort of pause or even maybe
11:25
revoke the agent. And so, yeah, I think like the
11:30
the real basic fact is that like authorization kind of needs to
11:32
become much more granular in, in in the agent world.
11:36
So that's kind of the authorization set of things,
11:38
which you know, you've got to make sure you've got the right
11:42
scope right for permissions and things like that.
11:44
The authentication level though, I think is, is somewhat similar
11:48
to a human, especially an agentic.
11:50
I've, I've had this thought before where like it seems like
11:52
the behavior of an agentic identity tends to be more
11:55
familiar or more more aligned with like a human.
11:58
Does that extend also on the authentication side of things?
12:02
So, yeah, this is great. I think fundamentally, like if
12:08
you think about it this way, like humans prove identity
12:10
through factors, right? So, you know, we've relied on
12:14
things like passwords or biometrics, you know, or OTP
12:18
codes or device trust, right? Those are those are human
12:21
verification factors and agents don't really have those, right?
12:27
Like they they should be authenticating, you know, like
12:31
what we kind of refer to as like a cryptographic identity.
12:34
So they're, you know, the things like a private.
12:36
Key or a certificate, right? Or, or or a token by a bound
12:41
token, right and those and, and the system here is for sort of
12:44
verifying the software workload rather than the person when an
12:47
agent authenticates, right and then you think about the fact
12:52
that like humans authenticate interactively, right?
12:56
They're they're they're typing a password, they're approving a
13:00
push notification. Agents authenticate machine to
13:03
machine, so they're often, you know, often using protocols like
13:06
O auth, you know, token exchange is another good example we can
13:10
talk through later. But you know, the the system
13:13
isn't, isn't verifying intent through like interaction like it
13:17
would with the human. It's verifying the integrity of
13:20
the calling agent, right? And then you think about the
13:23
fact that like, well, humans authenticate once per session.
13:26
Typically they might log in once and they stay in the session for
13:29
hours or days. Agents behave differently.
13:32
They may be requesting tokens frequently, they may be running
13:35
background jobs and may be operating continuously.
13:37
So identity systems have to be able to handle like higher
13:41
authentication and token exchange frequency with with
13:46
with agents. And I think, you know, the, the
13:49
last point I would make is that, you know, humans typically
13:52
represent themselves. Agents represent someone else,
13:55
right? So a human logs in as
13:57
themselves. An AI agent almost always logs
13:59
in on behalf of someone else in the customer side.
14:02
This means that identity system has to attract has to has to
14:05
track multiple things who the agent is, who The Who the human
14:09
is and what sort of delegation exists between that human to
14:13
that agent. So the delegation relationship
14:16
is really a kind of the the the added complexity here with that.
14:20
So I feel like we've, you know, platforms in the consumer space
14:23
like this, like yourselves have been spending a lot of time like
14:27
trying to stop bots right from accessing accounts.
14:30
And now it's like, oh, oh, no, like we want these bots to come
14:33
in. But how do we do that?
14:34
Like, how do you see this actually playing out in a, you
14:37
know, CIAM sort of platform where, you know, you used to
14:41
click the, you know, prove you're not a robot, you know,
14:44
and now I think you probably need to start to allow bots
14:49
right, to come in. Like how does that look from
14:51
your perspective? Well, it's, it's like, it's
14:56
like, I think actually one of the seasons I talked to you
14:58
recently was talking about the concept of like good bots versus
15:00
bad bots. You know what I mean?
15:02
Like you keep the bad bots out on the good bots in and actually
15:04
not that different from authenticating humans, right?
15:07
Keep the you let the good humans in and keep the bad humans out.
15:11
But you know, it's interesting. Like if you think, if you look
15:13
in history like we've seen like I guess agents acting on behalf
15:22
of consumers for a while, right? Like we've had financial
15:27
aggregators for a long time. You think about platforms like
15:30
Plaid or you know, Yoda Lee where, you know, they're logging
15:33
into bank accounts, they're pulling transactions, they're
15:36
moving data between services automatically.
15:38
Like we've, we've actually been thinking about this problem long
15:42
before the agent, the AI, you know, the AI agent world, right?
15:46
So, you know, you think about like beyond that, like we've had
15:51
automation platforms like, you know, Zapier make or IFTTT,
15:56
which are, you know, sort of increasingly connected to
15:58
consumer services. You know, they're, they might be
16:01
like moving order data to a spreadsheet or, you know, saving
16:05
your receipts from your e-mail to your Google Drive, right.
16:08
So, you know, from an identity systems perspective, that's
16:12
software, that's a that's a bot performing repeated actions
16:16
using the customer's identity. You know, you're starting to see
16:20
AI assistants interact more with services you think about like
16:24
the smart home or the voice ecosystems that we have, like
16:26
like, you know, Google Assistant or Siri.
16:29
I don't want to trigger anybody's, anybody's phone.
16:32
They're purchasing items, they're controlling services.
16:35
So and then I think like one thing we're also seeing is like
16:39
customer support automation. So companies are sort of
16:42
experimenting with how to, how do they handle sort of the
16:45
customer support challenge using these, using these agents.
16:50
And so like, I think what I'm trying to get is that we've kind
16:52
of, we've kind of seen like these autonomous bots agents,
16:57
you know, accessing systems for a while.
16:59
Like we're just kind of seeing it play out in a different way
17:02
with much more intelligent autonomous systems behind it.
17:05
I think the Rico for me here is is the word agentic because
17:09
everything you kind of described was pretty predictable patterns,
17:12
right? It was this is the transaction
17:14
I'm doing and, and I kind of led that question earlier with like
17:17
the behavior in an agentic identity is more similar to a
17:19
human browsing and checking for things.
17:23
Maybe it's, you know, pricing, maybe it's enrollment or
17:26
whatever it may be. And the the idea of a good
17:30
letting a good body in and keeping a bad bot out I find
17:34
interesting because how do you know which is which?
17:37
Yeah. And and it really comes down to
17:38
like that, that delegation model like like that, that being you
17:42
being able to sort of tie that agent that's coming in to a
17:47
human identity behind it, right? Like that's so you're sort of
17:51
like verifying the human as well as the the bot, if that makes
17:55
sense. So it's not only using that
18:01
agentic ID for API access, right?
18:04
Because I'm kind of thinking like I've set up Clawbot or what
18:09
do you call it Open Claw and it's essentially you can have it
18:14
browse with a Google Chrome browser.
18:20
I think it kind of presents itself as a headless browser,
18:23
right? Right, right.
18:24
So like like in your, in the case you're talking about is
18:27
like, can you actually tell that it's an agent driving the
18:29
browser versus versus a, you know, an, an actual agent
18:34
that's, that's more directly connecting to your, to your
18:37
platform? Yeah, that's, that's, that's
18:39
definitely a challenge that the, that the industry's is, is
18:42
struggling with. And there's some some other
18:44
interesting approaches around that where like, you know, you
18:47
have to sit more in the browser rather than being, you know,
18:51
being sort of an identity system that that these platforms are
18:54
connecting to. I think why that's interesting
18:57
to me and why I brought it up is that, you know, my, my next
19:01
question was going to be if I was to try to roll my own and
19:05
kind of manage this, you know, my original thinking when we
19:09
were getting prepared for this discussion was, OK, somebody
19:14
writes an app that can, you know, basically act as an
19:20
assistant. It can go and transfer money for
19:22
me. It can buy an espresso machine
19:24
that can do all these things. But it could just be Joe Q
19:29
public set up Claudebot or let's think six months down the road,
19:34
it could be Joe Q public using Co work, Claude Co work or
19:40
whatever other instantiations there are of AI assistance out
19:45
there. So now it's not just an app
19:48
through an App Store that maybe has, you know, some kind of
19:53
central force behind it, but it's individuals.
19:56
So the use cases to me seem like really, really broad.
20:02
If I wanted to roll my own, I guess to bring this back to a
20:05
question, it's if I wanted to roll my own, what would I have
20:09
to do in order to do that? What are the the puzzle pieces I
20:13
need? Yeah.
20:15
So if you're going to roll your, you know, roll your own agent,
20:18
you know, the first thing I would do is is to start to model
20:23
the agent as a, as a delegated actor, right?
20:26
You're going to keep hearing me repeat this.
20:28
But that, you know, that the like you shouldn't treat the
20:31
agent like a new customer identity.
20:32
You should treat it as a, as a delegated actor acting on behalf
20:36
of a user, right? So your model kind of becomes
20:39
like the user is talking to the agent, which is talking to the
20:41
application. And that relationship should be
20:44
preserved so that every action can be tracked back to that, to
20:48
that real user, right? That's, that's the first thing I
20:51
would say. So modeling the agent as a
20:53
delegated actor using existing identity standards, again, going
20:59
to repeat that a lot instead of inventing new ones.
21:02
The good news is you don't need entirely new protocols.
21:05
A lot of the building blocks are already there in Oauth and Open
21:08
ID connect the the token exchange extension to Oauth is
21:15
very useful here. It's actually the basis of of
21:17
our solution. There's a concept that won't go
21:20
into two depth too much, but in sort of protecting the agent
21:23
itself and using a concept called proof of possession,
21:27
which is sort of like, you know, giving that agent a
21:29
cryptographic key to be able to repeat, bring come back to you
21:33
and say, yes, this is me, right, Like sort of protecting the
21:35
agent identity. And then, you know, what you're
21:39
doing here is you're allowing the agent to identify,
21:41
authenticate as a workload and then obtain A delegated token
21:44
tied to the user, right. And so then you need to focus on
21:49
the authorization design. So you know, agent for the agent
21:52
itself, like authentication's the easy part.
21:55
The, the real challenge is like what is the agent allowed to do?
21:58
So you need to think about like using capability based
22:01
permissions. So like, you know, instead of
22:04
saying you have the ability to transfer money, saying you have
22:07
the ability to transfer money up to $50.00, right?
22:10
That's that's would be like a capability based permission, you
22:13
know, strict scope being limit, limits on the actions.
22:17
So you're sort of putting guard rails around what the, what the
22:20
agents can do. And then, you know, one thing to
22:24
note is that you can add human approval for sensitive actions.
22:28
So later in the process, I mean, you've probably seen this if
22:32
you've ever played with like Claude code or any of the local
22:34
tools where you're in the middle of a of a session, it's like,
22:38
Hey, I need to go do some stuff on your desk because you are you
22:41
cool with that? You know, and you click allow,
22:43
right? So that's like a that's like a
22:45
high impact action where you know, you should, you could add
22:49
like a step up approval flow, right?
22:51
It could be as simple as like a push to accept to a phone or you
22:54
just clicking, you know, clicking allow, right?
22:57
And then that activity should be visible.
22:59
So you need to like really think about observability.
23:03
So you know, your, your system should log like which agent
23:07
acted, what user they represented, like, you know,
23:10
what action was performed, what policy allowed it.
23:14
So if you're sort of tracking all those things, you're going
23:17
to be in a much better place to be able to, you know, be
23:19
accountable when when things happen.
23:22
And so you know that that's kind of those, those are kind of the
23:25
thing, I guess the, the, the five things I would focus on if
23:29
you were going to roll your own, roll your own solution.
23:33
The build versus buy analysis sounds a lot like when you're
23:36
doing human only. I mean, it's that, but maybe a a
23:40
tad more, you know, I also was just thinking as you're talking,
23:47
the two main use cases I think are either you're consuming
23:51
services or you're providing services.
23:55
Which side of that equation does Trivesti help me with?
23:59
So if I'm building the consumer app or I'm setting up an API to
24:04
buy my goods. Yeah.
24:07
So, you know, as a CIM platform, we, we sit on the on the
24:12
consumer side, so we can sit on the consumer application side of
24:16
the interaction. And so, you know, we're, you
24:19
know, the system that's responsible for authenticating
24:23
the customer, you know, managing their account, their identity,
24:26
enforcing policies on what, you know, what, what actions are
24:30
allowed. So when an AI agent acts on
24:32
behalf of a user, Serbacity kind of governs the identity behind
24:37
the the the action. So we kind of become the control
24:41
point between the user and the service.
24:43
So what the architecture kind of looks like is like, you know, a
24:46
user is talking to an AI agent, which is talking to the consumer
24:50
application, which is talking to a back end service API.
24:53
So we sit right at the identity boundary between the agent user
24:57
and the application resources. And our job is to determine who
25:01
is the user, which agent is acting for them, what the agent
25:05
is allowed to do. And so we anchor the consumer
25:08
identity, but we also become the authorization layer for for
25:12
downstream services. So when an agent tries to
25:14
perform something like initiating a payment or updating
25:17
account information, we are issuing the tokens and we're
25:21
controlling the policies that determine whether that service
25:24
API should allow that action to happen, if that makes sense.
25:29
Yeah, no, it totally makes sense.
25:31
Now I'd like to just understand, is your approach based on open
25:36
standards like you started off talking about Open ID Connect
25:40
and O off to? Are you using Open ID standards
25:44
or is it proprietary and why does it matter?
25:50
Yeah, so totally we're we're built on widely adopted identity
25:54
standards, you know, O off to open ID connect token exchange,
25:58
which is like I said is an an extension of of the of the Oauth
26:02
protocol and some proof of possession techniques.
26:06
So that's sort of the, the, the, the cryptographic control over,
26:11
you know, the agent authentication itself.
26:12
So, you know, things like Depop, which is a proof of possession
26:17
extension to, to O auth. And MTLS is another example of
26:21
like, you know, where you're basically just exchanging
26:23
certificates between, you know, a client and server, right?
26:26
So these standards are already, you know, out there, right?
26:30
They're already powering modern identity systems.
26:33
They're extending them to, so you know, kind of extending them
26:37
to agents kind of means practitioners don't have to
26:39
adopt like a new model, right. So some reasons as to why, you
26:44
know, why we would and why that's important or why we why,
26:47
why the distinction matters. It's like to me like these are
26:53
battle tested identity standards, right?
26:56
Like they're, they've been out there for years, they've gone
26:59
through security audits, they've gone through large scale
27:04
deployments, they're continuously improved on by the
27:07
standards bodies. That's super important, right?
27:11
And So what that means is that you're building this, this agent
27:14
identity framework on a foundation that that's proven
27:17
right. It's not experimental.
27:19
I think that's I think that's super important.
27:22
You know, you won't hear most vendors say this, but you do you
27:26
do sort of, it sort of helps the vendor lock in problem a little
27:29
bit. So like if you're, if you were
27:31
proprietary organizations kind of get trapped inside your
27:34
ecosystem. If you use open standards, you
27:37
know, agents can move between platforms, enterprises retain
27:41
some, some architectural flexibility, right?
27:43
Security models remain transparent.
27:45
So you know, you won't hear most vendors say that, but it is, it
27:49
is a a benefit of, of using open standards.
27:53
And you know, I think so I think really like kind of tying it all
27:56
together is that like standards help us converge on safe
28:00
patterns, right, right. We've, we've figured out how
28:02
agents should authenticate and act on behalf of users.
28:06
You know, if we build on top of open standards, we can gradually
28:09
converge on shared patterns for like the delegation problem, the
28:14
the human approval problem, the capability based off
28:17
authorization, the, the auditability of all of it.
28:19
All right. So that that's kind of why we
28:22
chose to go that direction. And we've always kind of been a
28:24
very standards friendly. Well, I'm sure Open ID
28:27
Foundation appreciates that. I think a lot of people do
28:29
because they think standards really kind of help make the
28:32
world go round. So I see that as a plus, You
28:35
know, for sure. I want to get a little more into
28:38
the weeds around how this actually works because I'm
28:42
trying to like, you know, wrap my head around this idea of, OK,
28:46
I've got a human. In the case of a consumer IM
28:48
platform, I might have millions of users, right?
28:51
Maybe even billions, but let's stick with millions so I have
28:54
fewer commas to deal with in my brain.
28:56
Millions of users and each of those million users could have
29:00
any number of delegated agents. Can agents be shared amongst
29:07
users? Maybe it's like a family unit or
29:08
an organizational unit that maybe has a shared sort of bot.
29:12
I'm curious like how do you represent this when it comes to
29:15
try and map those relationships in, especially in the consumer
29:18
space where you're dealing with orders of magnitude higher than
29:22
maybe like a normal enterprise might see?
29:25
Yeah, no, I mean it it it again, it really comes down to the the
29:29
delegation model. So there is no reason why a
29:32
single user, a single person couldn't delegate authority to
29:37
multiple agents, right. It's just an approval.
29:42
You know, you would sort of have like an approval workflow that
29:44
that user goes through to say, hey, yes, I am authorizing this
29:48
agent to, you know, be able to execute these specific actions
29:53
on my behalf, right. So, and then so that would sort
29:56
of be modelled within, within your product in terms of like,
29:59
well, what agents have I actually approved, you know, to
30:02
operate on my behalf? You know, what, what rights did
30:08
I give them? Like how long are they able to
30:10
you know, what, what's this? What's the the the length of
30:13
the, of time that I'm allowing them to act for me, unless,
30:15
until I have to sort of reauthorize them in the future.
30:19
This all really that isn't that different than like the standard
30:22
sort of CIM problem where you're sort of logging into a service
30:25
for and you're you're granted a session for some period of time
30:28
and then at some point you have to kind of go back and, and,
30:31
and, you know, re approve it in the future, right.
30:34
So really nothing's really nothing's stopping, you know,
30:39
you having multiple agents that have been delegated to act on
30:42
your behalf. And one of the things we're also
30:44
thinking about as Trivacity is like, well, how do we actually
30:47
give customers control over that, right?
30:49
So they, you know, provide them with an interface of my agents
30:52
interface, maybe, you know, where they can kind of go in and
30:54
say, oh, no, you know what, I don't like that that one, I'm
30:57
going to revoke, revoke their access at this point right
31:00
before it expires, right. So yeah, I mean, it's kind of
31:03
the it's kind of the idea around it.
31:05
So you kind of, you know, pre answer the next questions that
31:08
have it seems like we're bleeding a little bit into a
31:11
space that's traditionally been called IGA identity governance
31:14
administration or identity identity, you know, identity
31:17
governance type solutions. Now you're talking about OK,
31:20
well, me as a consumer, you know, what does that my agent
31:23
interface look like? It's almost like, you know, I'm
31:26
and maybe I'm just kind of reading between the lines.
31:28
Am I doing access reviews essentially on all the agents
31:31
that have access to my things? Like what does that look like?
31:34
I would think it's more like session management, you know, So
31:37
if you think of like a, most of most sites that have sort of of
31:40
a like, like a, like a my account portal where you're sort
31:44
of going into the portal and you know, what MFA do I have set up?
31:49
What sessions are, you know, where have I logged in from?
31:51
Oh, well, well, somebody logged in from some remote part of the
31:53
world. I don't know what that is.
31:55
So maybe I ought to kill that session, right.
31:56
So to me, it's more of like a, not like a, like a customer
32:00
doing like a personal access review or access review.
32:02
It's more like me just having a having vision into like who's
32:07
acting them on behalf and when did I approve them and giving me
32:11
control over being able to revoke those.
32:13
Right. So it's more of like a like a
32:14
personal control thing rather than like a but yes, it is a it
32:17
is a governance thing. It's just AI think it's I, I
32:22
would sort of more equate it with like the like device
32:25
management, you know, session management interface than I
32:27
would sort of a, you know, a full sort of IGA interface.
32:31
I assume that would stretch into other sort of, you know, non
32:34
human interfaces like API keys, things like that.
32:37
I think the dangers of like, you know, unattended and API keys
32:41
are probably pretty well known. But is this another point where
32:45
it's like, OK, agents are going to start to leverage these keys
32:47
and you have. You really have to make sure
32:50
that your API keys are solid, secure, and that you're pruning
32:54
them when needed. You know, API keys have been
32:57
around forever. It's a simple way to
32:58
authenticate software, but it's also one of the weakest ways to
33:02
authenticate software. You've you've, they're
33:05
essentially shared secrets, right?
33:07
You, you, if you possess the key.
33:09
In most cases, if you possess the key, the system assumes that
33:12
you're the authorized caller. And that works for simple
33:16
service integrations. But I would say it has major
33:19
limitations when agents are involved because, you know, the
33:22
key is not necessarily tied to like a specific agent.
33:27
It doesn't prove who's actually using it.
33:30
It's often long lived, which is not necessarily a great thing.
33:33
And and then I would sort of build upon the delegation
33:37
conversation where I would say that, you know, API keys don't
33:41
really support the delegation model well.
33:44
So, you know, agentic AI kind of introduces a new requirement,
33:49
right, Acting on behalf of a user.
33:51
So API keys typically represent an application and not a
33:55
relationship, if that if if that makes sense.
33:57
So if an agent used an API key, it's kind of hard to answer
34:00
questions like, well, who authorized which user authorized
34:03
this or what authority did they grant or, or when did they, you
34:07
know, when, when should that authority expire?
34:10
So that's why token based models like O auth token exchange
34:15
become much more important here, right?
34:17
And so I think it's a natural, I think it was kind of a natural
34:20
place for us to start with agents is like use an API key,
34:23
use a simple client credentials grant.
34:24
But I think we need to sort of evolve our thinking.
34:27
And then, you know, key leakage is a major real world risk.
34:30
I mean, API keys get exposed all the time.
34:33
They get committed to source code repositories, they appear
34:36
in logs. They, you know, they leak
34:38
through client side applications like like you're told they're
34:42
problematic and you know, they enable impersonation and replay.
34:47
So you know, there's a lot of problems the, a lot of problems
34:50
with them. I think the safest, the safer
34:52
pattern is what is short lived scoped tokens, you know, and a
34:56
modern identity system kind of replaces API keys with a short
35:00
lived access token. Again, capability based
35:04
permissions, proof of possession, delegated identity
35:08
claims. These are the things we should
35:09
be thinking about with these types of interactions rather
35:12
than than API keys. Do you see agentic identity as
35:17
sort of like a, a way for API keys to start to go away?
35:25
Like is this the beginning of, hey, you know what, maybe, you
35:28
know, we, we've used them for years and you know, it's kind of
35:30
like the password, right? And a pass key.
35:33
We're, we've been trying to kill the password for decades.
35:36
We're not there yet, but it's getting better, right?
35:38
Pass keys have come along like where does, where are we at in
35:41
the life cycle of an API key? Is it something else?
35:44
I I appreciate your optimism there.
35:46
I'm. Not saying it's going to happen
35:48
anytime soon, I'm just wondering if this is the beginning of
35:50
that. I, I, I mean, you know, you do,
35:52
you do touch on a key thing is that, you know, people, people
35:55
like simple, right? API keys are simple.
35:57
I just want to connect my thing to this back end data and, and
36:01
have it do things. So I think that that's a
36:04
challenge for our industry is, is providing a equally simple
36:09
way for agents to do things the right way rather than use, you
36:13
know, a weaker API key. So, you know, I don't, I don't,
36:18
it's interesting. It's like kind of the like the
36:20
password versus pass key discussion, you know, where like
36:23
it took us a long time for pass keys to get, get out there and
36:28
really widely used. And, and now they are right now
36:30
we're actually having discussions like I have
36:31
customers all the, all the time talking about like, oh, like I'm
36:35
going to use Fido for our login and I'm, and we're not going to
36:37
use passwords like this is this is Greenfield solution.
36:40
And so like, there's hope, I guess, you know, there's hope,
36:44
but I mean, I. Would measure this in, in this
36:46
transition in decades, not in years because we're dealing with
36:50
enterprises and enterprises I've built their applications a lot
36:54
of it based on API based authentication and so you need
36:56
keys for that. I'm just curious if it like, you
36:58
know from your, you know, in your projection hat of
37:02
projecting into the future, like do you see this as like the very
37:05
beginnings maybe of API keys becoming less, you know, less of
37:11
the, you know, desired format? Definitely, I mean, definitely
37:15
I, I think it, it's, I think I think it's a really good point.
37:18
And I think specifically extensions like token exchange
37:23
really do a much better job at sort of providing scope down
37:28
tokens to access AP is in a, in a way that's much safer and and
37:32
much more auditable. So, you know, I guess, I guess
37:35
you could argue make the argument that like the AI agent
37:40
sort of progression explosion maybe maybe pushes us more
37:44
towards safer models of of accessing APIs versus versus API
37:50
keys. I like that it's a good, it's a
37:52
good angle. I like it.
37:53
That's why I come on Identity Center, to get little Nuggets
37:55
like that. Yeah, I hadn't thought of it
37:57
that way, but that's a really good point, yeah.
37:59
All right. Well, I'll take that as a win.
38:01
You're definitely now one of my favorite guests, Steven.
38:03
So to answer your previous question, there we are.
38:05
OK, beautiful. I wanna kind of lump a couple
38:08
things together cuz we talked about access and agentic and
38:11
APIs, right? We're talking about non humans
38:13
essentially, yeah. Where do things like proxies
38:16
come in? Where do things like MCP servers
38:19
and even like agent to agent protocols?
38:21
I'm kind of kind of lumped all those three things together to
38:23
some degree, but like how do you see those things impacting, you
38:27
know, what is it you guys do? Let's talk about MCP because I
38:30
think it's, I think it's really interesting to, to bring into
38:33
this conversation. And so, I mean, I, I know quite
38:37
a few of your guests have talked through MCP in the, in, in the
38:40
last couple episodes you've done around this.
38:44
But you know, MCP essentially a bridge between agents and AP is
38:49
right. If you think, if you sort of
38:50
break it down to the like the most base level.
38:53
So it sort of provides a standard way for AI agents to
38:55
discover and call tools or AP is so instead of sort of hard
39:00
coding integrations, you know, MCP allows an agent to sort of
39:04
dynamically understand well, what tools exist, what
39:07
parameters do they accept and what actions do they perform?
39:11
So, you know, one thing to note is that identity authorization
39:17
still sits outside of MCP. So it's not necessarily MCP is
39:23
not solving the authentication or authorization problem for
39:26
you. So when an agent actually calls
39:29
an API through MCP, it still needs credentials, it still
39:33
needs an access token, it still should have some sort of
39:37
delegated authorization. So you're sort of tracking it
39:40
through, you know, the, the, the entire process.
39:44
And so that's where an identity system like Stravacity would
39:46
come in. So you know, the agent might
39:49
authenticate to the identity provider, receive a delegated
39:52
token tied to a user, and then use that token when calling the
39:57
API via MCP, right. And so you're, you're sort of
40:01
sitting. Sort of still stick outside of
40:04
of the MCP server. So I actually would argue that
40:07
MCP kind of increases the importance of strong identity
40:10
controls because you're you're making it easier for agents to
40:14
discover and invoke AP is which is a good thing and potentially
40:19
a bad thing. If you don't have strong
40:21
identity controls, you could end up with agents calling AP is
40:25
unexpectedly sensitive, AP is unexpectedly, you could have
40:29
that, you know, have agents accessing resources that they
40:31
shouldn't, right? So, so an identity system like
40:34
us kind of needs to ensure like the agent is authenticated, the
40:38
action is authorized, the request is auditable, right?
40:41
And that, and I think that's an important aspect with, with
40:45
regards to, with regards to MCP with, with proxies.
40:49
I think it's, I think it's, it's, it's a little bit of a, of
40:54
a, more of a controversial topic.
40:56
I guess the, you know, a lot of service providers introduce API
41:02
gateways or proxies in front of their services, right?
41:04
And it lets them inspect requests, enforce authorization
41:08
policies, validate tokens, you know, but you know, I think
41:13
proxies can also become a bottleneck.
41:15
And if you think about like agents, they're generating
41:17
really high volumes of requests. The proxy layer can kind of
41:20
become a, a bottleneck, a single point of failure, a latency
41:23
amplifier. And I think in specifically in
41:26
the agentic world, they can weaken end to end identity
41:31
guarantees. So you're, you're, you're, you
41:34
know, proxies often terminate the identity context and then,
41:38
you know, the proxy validates a token and then it forwards A
41:40
simplified request on to the downstream services.
41:43
And so those services might lose visibility into who the user
41:47
was, you know, which which agent acted, what authorization scope
41:53
was granted. So you kind of want like an
41:55
agenda in an agent world, you kind of want the identity
41:57
context flowing end to end and not stopping at a gateway.
42:02
You know, other other more controversial takes on this is
42:06
that, you know, security responsibility can get blurred.
42:09
So, you know, proxies can kind of create a perception that
42:12
security's handled upstream, you know, and back end services end
42:16
up kind of trusting requests too much.
42:19
But that's more of like a that's more of like a, you know, a
42:22
general discussion about like, you know, how to employ proxies
42:25
within, you know, within within identity frameworks.
42:27
But yeah, I mean, that's kind of my take on the on the proxy
42:30
side. I think the take away is like
42:33
for for for agents, it's important to have that sort of
42:36
end to end identity guarantee, right?
42:38
Having an audit trail all the way down to the back end API of
42:42
of what happened. Hey Steve, when you're talking
42:44
about delegation, I started to think about like that the multi
42:49
agent scenario like I've got I wanted to delegate some of the
42:55
authorizations I guess to other agents to work on just specific
43:00
tasks. How do you kind of manage all
43:05
that from, you know, an auditability standpoint, just a
43:10
a traceability standpoint? Yeah.
43:12
So the great thing about that is it, it's, is that particular
43:15
challenge is, is embedded into the token exchange extension to
43:23
Oauth, right? And Tobin, I think talked about
43:25
a little bit about this. I'm a big Tobin fanboy
43:27
apparently, but he talked about this in his pod.
43:31
But I think, you know, what I would say is like, you know, how
43:33
do you how do you make that audit trail like hold up to
43:35
scrutiny? I would say start with the
43:38
principle that delegation must never become anonymous, right?
43:44
So that's a, that's a, that's a good sound bite there.
43:47
So the, the, the biggest risk is that you, this delegated
43:51
authority gets passed down the chain and you lose sight of who
43:55
ultimately authorized what. So in a sub agent world, you
44:00
know, I would say that the rule would be, hey, a sub agent must
44:03
be linked to a parent agent. A parent agent must be linked to
44:06
a real human or an accountable system owner.
44:10
And every action must preserve that chain.
44:13
And and like I said, you can preserve that chain within the
44:16
token model. So you know, that means like
44:19
tokens that get passed around or exchanged, they need to carry
44:23
contacts like who was the human subject?
44:28
Who was the primary agent? What was what were the sub
44:31
agents that were actually executing tasks, you know, on
44:35
behalf of that primary agent? What capabilities were granted
44:39
the policy or maybe some approved approval context if you
44:42
want to carry that along. And I think that can all be
44:44
embedded into the token model and sort of carried along with
44:47
the tokens as they as they progress through your through
44:49
your systems. You need to use constrained
44:53
delegation. And I think I think one of the
44:56
podcasts you talked about scope attenuation, but you know, the
45:00
basic concept being that a parent agent should never hand
45:02
off unlimited authority to a sub agent, right?
45:06
You should always attenuate their what they're allowed to
45:09
do. And each hop in the chain should
45:11
really be constrained by, you know, least privilege, maybe
45:15
some time or resource limits, you know, sort of setting
45:18
explicit policy boundaries around the the chain as a sort
45:23
of goes down, you know, through throughout your system.
45:26
So yeah, that that's kind of, I mean, I think, you know, I think
45:30
ultimately like audit logs kind of need to read more like a more
45:33
like a chain of custody that like then like a debug log, you
45:37
know, so it holds up the scrutiny.
45:39
You can, if you can show who the human principal was, what
45:43
principle, what, what parent agent received the delegation
45:45
from the human, what sub agents executed, what capabilities were
45:49
used, then I think you're, you're in pretty good shape in
45:51
terms of, you know, being able to hold up to, to scrutiny on
45:54
this. This, this whole a agentic AIIM
45:59
topic is just so fascinating. And I know as practitioners,
46:03
we're all hopeful that we can leverage our existing
46:06
investments and tools. I'm sure your customers feel
46:10
that way as well. So your existing travesty
46:13
customers, I mean are they looking at rebootstrapping based
46:17
on, you know, taking all the agentic AI use cases into
46:22
account or is this something that kind of adds into their
46:26
existing deployment? Yeah.
46:30
So I mean like, you know, selfishly like a platform or
46:33
like ours would definitely give a head start, right.
46:37
And in terms of, in terms of solving this problem, I mean, I
46:41
think if you're running a modern CIA and platform like
46:44
Strabacity, like you're, you're already using some pretty core
46:49
identity primitives. Like you're, you're probably
46:52
using Oauth, you're probably using Open ID Connect, you're
46:55
probably doing some policy driven authorization.
47:00
You know, you have a customer identity store where your
47:02
customers live already, you're doing event logging and audit
47:06
trails already. And I think, you know, a gentic
47:09
AI doesn't really replace those foundations.
47:11
It extends them. And that's how we're treating
47:13
it. We're we're layering this into
47:15
our platform. We're not, you know, we're not
47:16
sort of shipping a new product. We're literally saying like, you
47:20
know, in our audit events, instead of just having like the
47:24
human that logged in you, there's now an actor column,
47:26
right, where you can see like, oh, human plus actor, right.
47:29
That's kind of how we're layer laying it down into our product
47:34
now. You know, some concepts do need
47:36
to evolve, right? You know, delegated authority
47:39
again is something that, you know, you need to be able to
47:42
support, you know, being able to handle higher levels of machine
47:47
to machine authentication. The whole capability based
47:50
permission thing, you know, is instead of simple scopes,
47:53
because I think most, most, most organizations that are deploying
47:57
say, yeah, we're really thinking about it from a simple scope
48:00
perspective and not really a capability perspective at this
48:03
point. And, and I think that's, that's,
48:07
that's kind of the position we're taking on it.
48:09
You know, that's kind of how we're seeing it.
48:10
I feel like there's so much more to cover, but yeah, you know, we
48:13
want to keep this reasonable for people listening to it.
48:16
What is the one thing that somebody listening to this
48:19
should take away to say, you've got to get this right.
48:22
We start talking about managing A genetic identity.
48:24
And you know, obviously I think I didn't want to keep it
48:26
specific, maybe on the the CIM side, the consumer side of
48:28
things, but where it makes sense, like give me some, give
48:32
me a sound bite, right that we can use to say, hey, this is
48:34
what you should be doing folks. So the one thing that has to be
48:38
right is the accountability model.
48:42
So before a genetic AI goes anywhere near production, like
48:47
you have to get the accountability model right.
48:49
That means you, you need to be able to answer who's responsible
48:53
for an action, right? And in practical terms, that
48:56
means every agent must be tied to a real human.
49:00
Every action must carry that identity chain, you know, down
49:04
through your systems. Every permission must be
49:06
explicit and constrained. So the accountability model is,
49:10
is, is is of the utmost important.
49:12
You can't, you can't get that wrong.
49:15
And so, you know, I think if you think about like, well, why,
49:17
why, why would I say that? Well, I think the, you know,
49:20
agentic systems sort of amplify mistakes is probably how I would
49:26
think about it. You know, a misconfigured
49:28
permission or a compromised credential could lead to, you
49:32
know, thousands of automated actions very quickly.
49:36
So, you know, without a clear chain of accountability, you're,
49:39
you're going to really struggle to do governance, you're really
49:42
going to struggle to do auditability when it comes to
49:46
regulatory challenges. You're going to struggle to be,
49:50
to be able to defend it, you know, in front of a regulator.
49:54
And and then of course, you know, you have the, you have the
49:56
customer trust problem too, right?
49:58
If you you don't want to upset your customers because they'll
50:01
go to your competitors, right? Got to keep the customers happy.
50:04
Absolutely, yeah. All right, well, I promised Jim
50:07
that we would talk baseball, and so I'm going to hand it over to
50:10
him. But as we were kind of prepping
50:12
for this episode, you mentioned simulation baseball and I, you
50:15
know, I've played, I've played baseball video games in the
50:17
past. I'm assuming that's not what you
50:19
meant or do you mean something else completely and then Jim
50:22
take it away for baseball at the center?
50:25
Well, yeah, thank you, Jeff, because this is like the moment
50:28
I've been waiting for, Steven. We're in the small minority of
50:31
people who like baseball, at least it that like baseball and
50:36
identity. So you brought up the simulation
50:41
baseball. Why don't we start there?
50:42
I don't even know what that is. OK, so I think most your
50:46
listeners are probably familiar with fantasy baseball, right?
50:50
So simulation baseball is different from fantasy baseball
50:54
because you're not, you're not just like collecting players and
50:57
tracking their real world stats, right?
51:00
And simulation baseball, you're actually running a baseball team
51:03
inside a, a simulated league. So it's like you're acting like
51:08
the manager or general manager. You're, you're building a
51:12
roster, you're setting line UPS, you're managing pitching, you
51:16
know, pitching rotations, you're making strategic decisions.
51:19
So the games themselves are run using like a simulation
51:23
software, The one that my league uses called Diamond Mine
51:27
Baseball. And, and it's basically what
51:31
happens is it's based on player ability.
51:33
So you draft a player, you pick a vintage or a year to simulate
51:38
that player, and then you aggregate A-Team like that.
51:42
So you can draft anybody from history, you know, for it's for
51:45
example, like I could draft Cy Young or I could draft Barry
51:48
Bonds. I pick the year that I want to
51:50
use to put into the simulation and then I aggregate A-Team
51:54
around that, that concept. So the focus is really on like
51:58
team construction and strategy rather than scoring points from
52:02
like real life, you know, games, right?
52:07
So like what it makes, what makes it really appealing to me
52:09
is that it kind of becomes a sandbox for baseball strategy.
52:14
So if you're really into baseball, like like like you and
52:16
I are Jim, you can architect the team however you want.
52:20
You can test different philosophies like do you want to
52:22
build around power versus pitching?
52:25
Do you want to try small ball versus analytics driven line
52:28
UPS? Do you want to see how they, you
52:30
kind of want to see how they play out?
52:31
And you know, like I said, our simulations also include players
52:34
from different eras so you can explore fun sort of what if
52:38
questions that you know, fantasy baseball can't really answer.
52:41
So you can be like, you know, how would Barry Bonds have
52:43
actually fared against Cy Young, right?
52:46
Two players from two different 2 completely different eras,
52:50
right? So the, the league I'm in is
52:51
actually 48 teams, all with different human owners, not
52:57
agents. Ha, ha.
52:59
We actually get together once a year for a yearly draft.
53:03
We, we, you know, and it's a few days of just me nerding out on
53:07
baseball with friends that I've, you know, that I've known for,
53:09
for over 20 years. So yeah, that's my little
53:12
rundown. I was going to ask you how you
53:13
knew they were not agents, but I guess getting together in the
53:16
room is the answer. Yeah, absolutely.
53:18
You know, I've, I've, I've laid eyes on them specifically.
53:21
Yeah, absolutely. OK, yeah.
53:22
So question that I'm going to ask you and Jeff prepare,
53:25
because I'm going to ask you the same.
53:27
Who's your favorite player, either current or historical?
53:31
This is going to be controversial one, but it's it
53:34
for me. I'm a Braves fan, so I grew up
53:37
watching the the Richmond Braves on TBS and and the my favorite
53:45
player is Shipper Jones. Historic of all time.
53:47
Yeah, so. Why?
53:48
He said. Controversial.
53:51
He was a, he was, you know, he's a controversial guy, you know,
53:54
Well, see, the New Yorkers didn't really get along with
53:56
them too much so. I lived in Georgia for so long
53:59
that you know he's, he's like a folk hero there.
54:03
Totally. Yeah, Yeah, yeah.
54:05
How about you, Jeff? Sammy Sosa only because that was
54:09
the only season that I found baseball exciting.
54:11
Exciting was the home run chase between Sosa and McGuire.
54:15
And you know, I'm a Cubs fan. If I if I do watch baseball,
54:18
it'll be Chicago Cubs. And so that's it.
54:20
So that season brought kind of brought baseball back a little
54:25
bit from from the brink like so yeah, that was a good season.
54:28
Absolutely. I I totally respect that answer,
54:30
Jeff. I'm a simple man, I just want to
54:32
see home runs. I don't want to see a 10332 game
54:36
like it's I I. I'll tell you what, I I'm not a
54:38
baseball fan, but I have watched more of baseball in the last
54:42
year, 2 years maybe than I have in probably the last few decades
54:47
because the game has speed up the pitch clock.
54:50
Things like that have definitely helped.
54:51
It's no longer like a 5 hour thing, you know you can get a
54:54
game in and 2 1/2 hours. So I do appreciate those types
54:57
of things that that helps drive my interest, but I'm still a
54:59
football guy. Yeah, I agree about this feeding
55:03
games up, and I was imagine this as an old curmudgeon about the
55:08
rules I didn't want. To.
55:10
I definitely did not want a pitch clock.
55:12
I did not want a clock in baseball.
55:15
And that's one of the things about that they've always said
55:17
about baseball is that there's no clock in baseball.
55:20
Game can go forever. And then they had the ghost
55:24
runner on 2nd and they had the pitch clock.
55:26
Anyway. I was actually not going to name
55:29
my historical figure because I was sure one of you guys would
55:32
have said Jackie Robinson. And I mean, just what he had to
55:37
go through as a human being in addition to playing baseball and
55:42
being one of the best ever. So that's how I would have
55:45
picked for sure. I'm still going to pick him.
55:49
But I'm also going to name my other person, which is Aaron
55:51
Judge. He's the current, you know,
55:54
captain of the Yankees. And he's just like quality human
55:58
being on top of being the best baseball player in the league.
56:02
And I know that there's a controversial statement cause a
56:05
lot of people are going to say, no, it's Shohei.
56:08
Like he's clearly, you know, he's Cy Young level pitcher, MVP
56:12
level hitter. Like he wins the MVP every year
56:15
but Aaron Judge wins the MVP every year with Justice Bat and
56:20
just glove and right field anyway.
56:21
Yeah, no, I mean, I think, I think like, you know, the
56:24
comments about like games being five hours long.
56:26
I mean, one of the things I like about baseball is that like a
56:29
soup, especially once you get deep into games, if you really
56:31
look close, like there's always some strategy playing out, you
56:35
know, and if you know what to look for and that's that, to me,
56:38
that's fascinating, right? They're always thinking about
56:41
how do they approach this inning?
56:43
How do they approach this batter?
56:46
I I think that that's, that's really fascinating.
56:48
And I love the I and I love sort of the hidden rules of baseball
56:51
as well. Like there's actually a book
56:53
named that I believe that's interesting to read, but it's
56:55
sort of like, what are all the rules that actually aren't in
56:57
the rule books? But like, you know, if you, you
57:00
know, if you being a player, like you're probably going to
57:02
get Bean to like those kind of rules.
57:03
Like those those are to me. That's to me, that's the
57:06
unwritten rules. Yeah, thank you.
57:07
That that's that's fascinating to me.
57:09
I love that stuff. Yeah, and the they call you
57:11
talked about the game within the game and you're playing
57:15
baseball. If you're in left field and
57:17
there's a guy on first base, you have to be thinking about if
57:20
it's it to me, not only that you need to be thinking about, it's
57:24
ground ball to me. If it's fly ball to me, what am
57:26
I going to do? And if you catch that fly ball
57:31
or no, I'm sorry. If you get catch a ground ball
57:33
and you throw it second base, that guy's going from first to
57:36
third almost automatically. And the whole crowd's going to
57:40
be like, why did you do something so stupid?
57:43
But think about it like it's just a a momentary lapse.
57:47
There's no place for momentary lapses in baseball.
57:49
No, there isn't. You've got to kind of have the,
57:52
the, the, the entire game in your head at any one time and
57:55
know, know what the best play is.
57:57
But yeah, I mean, it's strategy, man, I, I, I love that.
58:00
I love that aspect of baseball. So, Jeff, do we convince you?
58:04
Do you love baseball now? No, It's.
58:09
Just not my thing. I'm a football guy, then
58:11
basketball, then hockey, and then we still, still.
58:15
Agree on only something else and that they know, right?
58:17
Yeah, definitely agree on. We all agree on look.
58:20
Not everything has to be for everyone all the time.
58:22
That's fine. Everybody can have individual
58:23
interests. I, it's not that I, I, I, I just
58:26
don't care about it, I guess, for lack of a better word.
58:30
It's not that I don't appreciate the skill or anything like that.
58:33
It's just it's, it just doesn't interest me as much as it does
58:35
for you guys. Nobody's perfect, you know?
58:37
Yeah. That's fine.
58:38
Yeah. All right, let's leave it there.
58:40
I'm not perfect. And you know I can, I can live
58:43
with that. Steven, thank you so much for
58:46
coming back. I hope you come back in the
58:47
future as well. I hope to see you at conferences
58:49
coming up here between Identiverse.
58:51
I'm I'm assuming we'll probably be out there in in June.
58:55
We can give you the the official fist level of gratitude.
58:58
Definitely want people to check out Strivacity again, the
59:01
website STRIVACIT y.com. We'll have links in our show
59:06
notes to find that very easily as well as your LinkedIn
59:09
profile, Steven, for people to connect, maybe share their
59:12
favorite baseball player of all time or maybe I don't know.
59:16
I mean, so the the all time simulation baseball thing I do
59:20
find somewhat interesting because they think that's a
59:22
unique spin that I haven't seen. I've played fantasy football for
59:24
years. I haven't seen the idea of
59:27
taking like Barry Sanders 2000 yard year versus, you know,
59:32
someone else like in the football side of thing like how
59:34
do you construct A-Team right, So like that.
59:36
So I might pick your brain a little bit on that one and see
59:38
how that that would work out sounds.
59:39
Good. Be interesting anytime.
59:41
All right, let's go and leave it there.
59:43
Thanks everybody for watching and or listening.
59:45
Check out our show notes for all the information.
59:48
Find us on the web, IDC podcast.com And thanks again to
59:51
Steven and Strabasco for sponsoring this episode.
59:54
And we'll talk over the one in the next one.
59:58
You've been listening to Identity at the center.
1:00:01
We hope you've enjoyed the show. Make sure to like, rate and
1:00:05
review, and we'll be back soon. But in the meantime, hit the
1:00:09
website at identity@thecenter.com.
1:00:13
See you next time on Identity at the Center.