Latest / The Identity Blueprint / The Nine Layers of Identity Architecture

Transcript

The Nine Layers of Identity Architecture · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome back to the Identity Blueprint, where enterprise identity and access management gets the depth it deserves.
• 0:07
  SPEAKER_00: I'm Ernie Prescott, Principal IAM Architect, and in the last five episodes, Jose and I have taken you from the boardroom to the architect's desk through discovery, strategy, governance, policy, and the full human identity life cycle.
• 0:22
  SPEAKER_00: Today, we shift gears entirely.
• 0:25
  SPEAKER_00: Episode six is where the philosophy stops and the engineering begins.
• 0:30
  SPEAKER_00: Phase five of the IAM engagement blueprint, the technology architecture, and three-year roadmap.
• 0:37
  SPEAKER_00: Nine distinct functional layers.
• 0:39
  SPEAKER_00: A sequenced deployment plan designed to take an enterprise from identity chaos to a passwordless, continuously compliant, zero trust operation, without bringing business operations to a screeching halt along the way.
• 0:53
  SPEAKER_00: If you've ever wondered what the actual machinery looks like underneath the strategy, this is that episode.
• 0:59
  SPEAKER_00: Let's get into it.
• 1:00
  SPEAKER_00: Right now, uh, as you listen to this, you are actually outnumbered in your own company.
• 1:05
  SPEAKER_01: Oh, by a massive margin.
• 1:07
  SPEAKER_00: Yeah.
• 1:08
  SPEAKER_00: Like for every human employee logging into your network today, there are likely tens, or honestly, probably hundreds, of invisible non-human identities just roaming around your servers.
• 1:21
  SPEAKER_01: Right, which is a wild to think about.
• 1:23
  SPEAKER_00: I mean, we're talking about service accounts, machine tokens, API keys, and autonomous AI agents.
• 1:30
  SPEAKER_00: And according to the research we're diving into today, this non-human population is growing by over 40% every single year.
• 1:38
  SPEAKER_01: Aaron Ross Powell Yeah, and they're executing code, you know, modifying databases, making decisions at literal machine speed.
• 1:44
  SPEAKER_01: Trevor Burrus, Jr.
• 1:44
  SPEAKER_00: Which kind of completely breaks the security models we've relied on.
• 1:48
  SPEAKER_01: It invalidates them entirely.
• 1:49
  SPEAKER_01: I mean, we spent decades perfecting the system that ensures like Sarah in accounting is actually Sarah in accounting when she types her password.
• 1:56
  SPEAKER_01: Right.
• 1:57
  SPEAKER_01: Meanwhile, you have thousands of invisible pieces of code constantly talking to each other behind the scenes.
• 2:02
  SPEAKER_01: And a lot of times they're holding these massive unchecked administrative privileges.
• 2:06
  SPEAKER_00: So the whole traditional perimeter thing.
• 2:08
  SPEAKER_01: Dead.
• 2:08
  SPEAKER_01: The idea that you have this secure internal network protected by a nice firewall, it's completely dead.
• 2:14
  SPEAKER_00: Aaron Powell Well, welcome to today's deep dive.
• 2:17
  SPEAKER_00: It is Monday, April 13th, 2026, and we are taking a really intense magnifying glass to a very specific, highly critical document that attempts to solve this exact nightmare.
• 2:30
  SPEAKER_00: Trevor Burrus, Jr.
• 2:30
  SPEAKER_01: That's a massive challenge.
• 2:31
  SPEAKER_00: Aaron Powell It is.
• 2:32
  SPEAKER_00: The document is called the IAM Program Engagement Blueprint.
• 2:36
  SPEAKER_00: But we are not just skimming the executive summary here.
• 2:39
  SPEAKER_00: We are zooming entirely in on phase five.
• 2:42
  SPEAKER_00: Aaron Powell Right.
• 2:42
  SPEAKER_01: The technology architecture and roadmap.
• 2:44
  SPEAKER_00: Trevor Burrus Exactly.
• 2:44
  SPEAKER_00: Because phase five is really where the philosophy stops and the actual engineering begins.
• 2:48
  SPEAKER_00: Aaron Powell Yeah.
• 2:49
  SPEAKER_01: I mean you can have all the high-level governance ideals you want in the boardroom, right?
• 2:53
  SPEAKER_01: But phase five is where you decide exactly which wires to cross.
• 2:56
  SPEAKER_00: Aaron Powell Which platforms to actually buy.
• 2:57
  SPEAKER_01: Aaron Ross Powell Exactly.
• 2:58
  SPEAKER_01: And how to sequence a massive deployment without bringing your business operations to a complete screeching halt.
• 3:05
  SPEAKER_00: Aaron Powell So whether you're an IT leader prepping for massive digital transformation or a security architect staring down this giant mountain of legacy tech debt.
• 3:13
  SPEAKER_01: Aaron Powell Which is a lot of you out there.
• 3:15
  SPEAKER_00: Aaron Powell For sure.
• 3:16
  SPEAKER_00: Or even if you're just insanely curious about how massive global corporations actually keep their data safe from these roaming armies of AI agents, this deep dive is for you.
• 3:27
  SPEAKER_01: It's essentially the ultimate how-to guide.
• 3:30
  SPEAKER_00: It really is.
• 3:31
  SPEAKER_01: Yeah.
• 3:31
  SPEAKER_00: And to help decode the dense technical architecture within this blueprint, I have the perfect guide with me.
• 3:37
  SPEAKER_01: Thanks.
• 3:38
  SPEAKER_01: I mean, my core philosophy going into this blueprint is pretty simple.
• 3:41
  SPEAKER_01: Treating identity merely as a back office IT function like, you know, a glorified help desk ticket for resetting passwords is basically a recipe for a massive data breach.
• 3:52
  SPEAKER_00: It's just not enough anymore.
• 3:53
  SPEAKER_01: No, identity is a strategic platform now.
• 3:56
  SPEAKER_01: Elevating identity to the absolute core of your security architecture is really the only way to achieve real return on investment.
• 4:03
  SPEAKER_00: And more importantly, it lets an organization actually reach a zero-trust operational baseline.
• 4:08
  SPEAKER_01: Precisely.
• 4:12
  SPEAKER_00: We need to figure out what that machinery actually looks like.
• 4:14
  SPEAKER_00: The blueprint lays out a technology architecture comprised of nine distinct functional layers.
• 4:20
  SPEAKER_01: Aaron Powell Nine layers.
• 4:21
  SPEAKER_01: It's a lot.
• 4:22
  SPEAKER_00: It's a ton.
• 4:23
  SPEAKER_00: So before we can talk about the roadmap of like when to build things, we have to understand the materials on the construction site.
• 4:30
  SPEAKER_01: Make sure we know what we're looking at.
• 4:31
  SPEAKER_00: Right.
• 4:32
  SPEAKER_00: So let's systematically deconstruct these nine layers.
• 4:35
  SPEAKER_00: Starting with layer one and layer two, which are the directory or identity store and the identity provider, the IDP.
• 4:41
  SPEAKER_01: Which people mix up all the time.
• 4:43
  SPEAKER_00: They really do.
• 4:44
  SPEAKER_00: These two get smashed together in casual conversation constantly.
• 4:47
  SPEAKER_00: But the blueprint separates them completely.
• 4:50
  SPEAKER_01: Aaron Ross Powell And they have to be separated because they serve fundamentally different mechanical functions.
• 4:55
  SPEAKER_01: I mean everything else we discussed today either federates through provisions from or enforces policy via these two specific layers.
• 5:03
  SPEAKER_00: Aaron Powell So let's break down layer one first, the directory.
• 5:06
  SPEAKER_01: Trevor Burrus Right.
• 5:07
  SPEAKER_01: So this could be Microsoft Enter ID or Legacy Active Directory or maybe a high-scale LDAPU directory like Ping Directory.
• 5:14
  SPEAKER_00: Okay.
• 5:15
  SPEAKER_01: The directory is your authoritative repository.
• 5:17
  SPEAKER_01: It's just the static database.
• 5:18
  SPEAKER_00: Aaron Powell So it stores the attributes.
• 5:20
  SPEAKER_01: Aaron Ross Powell Exactly.
• 5:21
  SPEAKER_01: The user's name, their department, their manager, their group memberships.
• 5:24
  SPEAKER_00: Aaron Powell It's basically the filing cabinet.
• 5:26
  SPEAKER_00: It just holds the paper.
• 5:27
  SPEAKER_01: Precisely.
• 5:27
  SPEAKER_01: It doesn't do much on its own.
• 5:29
  SPEAKER_01: Now, layer two is the identity provider or IDP.
• 5:32
  SPEAKER_01: This is the active engine.
• 5:33
  SPEAKER_00: This is the thing actually doing the work when you log in.
• 5:36
  SPEAKER_01: Yeah.
• 5:36
  SPEAKER_01: The IDP handles the actual authentication process, the federation to other applications, and single sign-on.
• 5:44
  SPEAKER_00: Okay, so when I try to log into a cloud app.
• 5:47
  SPEAKER_01: The IDP is the gateway that actively challenges you.
• 5:51
  SPEAKER_01: It asks for your multi-factor authentication, it evaluates if your laptop has the latest security patches.
• 5:57
  SPEAKER_01: It checks your geographic location.
• 5:59
  SPEAKER_00: Wow.
• 5:59
  SPEAKER_00: Okay.
• 6:00
  SPEAKER_01: And only then, if everything looks good, does it issue a cryptographic token saying, you know, yes, this entity is who they claim to be.
• 6:07
  SPEAKER_00: Aaron Powell, you know, our sources use this incredible analogy for this that clears up so much of the confusion.
• 6:11
  SPEAKER_00: They compare the identity provider to a passport office.
• 6:14
  SPEAKER_01: Aaron Powell It's a great analogy.
• 6:16
  SPEAKER_00: And then the downstream cloud resources are compared to a locksmith.
• 6:19
  SPEAKER_01: Right.
• 6:20
  SPEAKER_01: It illustrates the mechanics perfectly.
• 6:22
  SPEAKER_01: If you think about, say, Microsoft Enter ID functioning as an IDP, it operates exactly like a global passport office.
• 6:28
  SPEAKER_00: Aaron Powell Right.
• 6:29
  SPEAKER_00: Its entire job is just to verify your identity.
• 6:31
  SPEAKER_01: Aaron Powell Exactly.
• 6:32
  SPEAKER_01: It checks your background, looks at your HR signals, scans your biometrics, and just evaluates your overall risk profile.
• 6:39
  SPEAKER_00: And once it's satisfied, it issues your passport.
• 6:42
  SPEAKER_01: Right.
• 6:42
  SPEAKER_01: But, and this is key, the passport office does not care which specific room in a corporate building you're trying to enter.
• 6:49
  SPEAKER_01: It just vouches for your identity.
• 6:51
  SPEAKER_00: Aaron Powell It just says this is a real person.
• 6:53
  SPEAKER_01: Yeah.
• 6:54
  SPEAKER_00: And then you walk over to the locksmith, which in this analogy represents an authorization engine like AWS IAM.
• 7:00
  SPEAKER_01: Amazon Web Services Identity and Access Management, yeah.
• 7:03
  SPEAKER_00: Right.
• 7:03
  SPEAKER_00: So the locksmith doesn't ask to see your birth certificate.
• 7:06
  SPEAKER_00: It only cares if you have the exact, precise key to open a specific digital door.
• 7:13
  SPEAKER_01: Aaron Ross Powell Like a sensitive S3 storage bucket or a customer database.
• 7:17
  SPEAKER_00: Exactly.
• 7:18
  SPEAKER_01: And this is why the most resilient architectures intentionally decouple authentication from authorization.
• 7:23
  SPEAKER_00: Aaron Ross Powell Passport Office versus the locksmith.
• 7:25
  SPEAKER_01: Yes.
• 7:25
  SPEAKER_01: Authentication is proving who you are.
• 7:27
  SPEAKER_01: Authorization is deciding what you are allowed to do.
• 7:30
  SPEAKER_00: Aaron Powell And separating them gives you flexibility.
• 7:32
  SPEAKER_01: Huge flexibility.
• 7:33
  SPEAKER_01: When you separate them, you can upgrade your authentication methods like moving to passwordless without having to rewrite the authorization logic inside thousands of individual applications.
• 7:43
  SPEAKER_00: Okay, but if an architect is setting up this passport office, they face a massive vendor landscape out there.
• 7:50
  SPEAKER_01: Oh yeah.
• 7:50
  SPEAKER_01: It's incredibly crowded.
• 7:52
  SPEAKER_00: I mean, the sources mention heavyweights like Microsoft, Intra ID, Okta, Ping Identity, and Key Cloak.
• 7:59
  SPEAKER_00: If I'm an IT director looking at these options, how do I actually choose?
• 8:03
  SPEAKER_00: Because, you know, on the surface, they all promise seamless single sign-on.
• 8:08
  SPEAKER_01: Yeah, the marketing all sounds the same.
• 8:09
  SPEAKER_01: You really have to look beneath that at the underlying engineering architectures.
• 8:13
  SPEAKER_01: The sources actually break down the infrastructure models quite clearly.
• 8:16
  SPEAKER_00: Let's start with Okta.
• 8:17
  SPEAKER_01: Sure.
• 8:18
  SPEAKER_01: So Okta is engineered for cloud-first, Sauce-heavy environments.
• 8:22
  SPEAKER_01: It operates as a multi-tenant sauce platform built deeply around API-driven integrations.
• 8:27
  SPEAKER_00: So it's very modern, very cloud-focused.
• 8:29
  SPEAKER_01: Exactly.
• 8:30
  SPEAKER_01: If your company relies on hundreds of different cloud applications and you want incredibly fast deployment with a frictionless connection to those apps through a pre-built network, Okta is a phenomenal choice.
• 8:43
  SPEAKER_00: That makes total sense for like a nimble cloud native startup or a modern tech firm.
• 8:49
  SPEAKER_00: But what if you were a hundred-year-old insurance company or a massive multinational bank?
• 8:54
  SPEAKER_01: Aaron Powell That's a totally different scenario.
• 8:56
  SPEAKER_00: Aaron Powell Right, because you have mainframes, you have legacy on-premise applications that were coded like 20 years ago.
• 9:02
  SPEAKER_00: You can't just migrate everything into the cloud overnight.
• 9:04
  SPEAKER_01: Aaron Powell No, you can't.
• 9:05
  SPEAKER_01: And that is where a platform like Ping Identity becomes critical.
• 9:09
  SPEAKER_01: The blueprint highlights Ping specifically for hybrid complexity.
• 9:12
  SPEAKER_00: Aaron Powell What does that look like in practice?
• 9:14
  SPEAKER_01: Well, if you have legacy web applications that don't understand modern tokens, like they require older header-based authentication.
• 9:22
  SPEAKER_01: Or if you need to scale an identity directory to manage millions of external customer identities, Ping Directory handles that brilliantly.
• 9:29
  SPEAKER_00: So it's built for the messy stuff.
• 9:31
  SPEAKER_01: Aaron Powell Yeah.
• 9:31
  SPEAKER_01: It's a high-scale LD app server engineered specifically for complex hybrid environments.
• 9:38
  SPEAKER_01: Cloud native tools often fail there because they treat on-premises infrastructure as kind of an afterthought.
• 9:43
  SPEAKER_00: Aaron Ross Powell Right.
• 9:44
  SPEAKER_00: And what about Key Cloak?
• 9:46
  SPEAKER_00: The sources mention it as an open source option.
• 9:49
  SPEAKER_00: Which kind of makes me wonder why would an enterprise choose an open source tool for something as critical as authentication?
• 9:57
  SPEAKER_01: Because of developer flexibility.
• 9:59
  SPEAKER_01: Yeah.
• 9:59
  SPEAKER_01: Key cloak is deployed as a highly customizable authentication gateway.
• 10:03
  SPEAKER_01: Developers love it when they need to build very specific non-standard identity flows using protocols like OpenID Connect or OIDC.
• 10:11
  SPEAKER_00: Do you have an example?
• 10:12
  SPEAKER_01: Sure.
• 10:12
  SPEAKER_01: In Key Cloak, a developer can write custom JavaScript mappers.
• 10:16
  SPEAKER_00: Okay, let's translate that.
• 10:17
  SPEAKER_00: What does a custom JavaScript mapper actually do for the security team?
• 10:20
  SPEAKER_01: Right.
• 10:20
  SPEAKER_01: So imagine you have a proprietary internal application, and it needs to know not just who the user is, but whether that user has a very specific temporary security clearance level.
• 10:30
  SPEAKER_00: Like a clearance that changes based on the project.
• 10:33
  SPEAKER_01: Exactly.
• 10:33
  SPEAKER_01: And that clearance level is calculated in real time from a totally separate database.
• 10:38
  SPEAKER_01: With Keycloak, you can write a tiny script, a mapper, that fetches that clearance level and injects it directly into the user's access token the moment they log in.
• 10:49
  SPEAKER_00: Oh wow.
• 10:49
  SPEAKER_00: So the token itself carries the custom data.
• 10:52
  SPEAKER_01: Yes.
• 10:52
  SPEAKER_01: The application reads the token, sees the clearance, and grants access.
• 10:56
  SPEAKER_01: It provides surgical precision for custom software environments that you just can't get out of a box.
• 11:01
  SPEAKER_00: Aaron Powell Okay.
• 11:01
  SPEAKER_00: That definitely sets our foundation.
• 11:03
  SPEAKER_00: So the directory stores the identities and the IDP authenticates them.
• 11:08
  SPEAKER_00: But once the IDP issues that passport, we need a system to figure out what the user is actually allowed to do with it across the entire company.
• 11:15
  SPEAKER_01: Aaron Powell Which brings us to layer three and layer four.
• 11:17
  SPEAKER_00: Aaron Ross Powell Right.
• 11:18
  SPEAKER_00: Identity governance and administration IGA and privileged access management PAP.
• 11:23
  SPEAKER_00: The acronym SUP gets really dense here.
• 11:26
  SPEAKER_01: It really does, yeah.
• 11:26
  SPEAKER_00: But essentially we're talking about the difference between managing standard access and high-risk access.
• 11:31
  SPEAKER_01: Aaron Ross Powell That distinction is absolutely vital.
• 11:33
  SPEAKER_01: Let's look at layer three first.
• 11:34
  SPEAKER_01: IGA.
• 11:35
  SPEAKER_01: If the IDP is your passport office, identity governance is the visa office.
• 11:40
  SPEAKER_01: It governs the entire life cycle of the identity.
• 11:43
  SPEAKER_00: Aaron Powell So it's managing the day-to-day.
• 11:45
  SPEAKER_01: Exactly.
• 11:45
  SPEAKER_01: IGA platforms and the blueprint heavily features sale point here, by the way.
• 11:50
  SPEAKER_01: They manage access requests, periodic access reviews, and segregation of duties.
• 11:54
  SPEAKER_00: Aaron Powell So it's the audit trail.
• 11:56
  SPEAKER_01: Yes.
• 11:56
  SPEAKER_01: IGA exists to answer three fundamental questions for an auditor.
• 12:00
  SPEAKER_01: One, who has access to what?
• 12:02
  SPEAKER_01: Two, is that access appropriate for their current job?
• 12:04
  SPEAKER_01: And three, can we mathematically prove it?
• 12:07
  SPEAKER_00: Aaron Powell Right.
• 12:07
  SPEAKER_00: So if I'm a new employee and I need access to Salesforce to do my job, I log into a portal powered by the IGA tool, I submit a request, my manager hits approve, and the IGA tool reaches out and actually provisions my account in Salesforce.
• 12:20
  SPEAKER_01: Yeah.
• 12:21
  SPEAKER_01: IGA handles that broad spectrum of standard day-to-day user access.
• 12:25
  SPEAKER_01: But layer four PM, privileged access management, is an entirely different beast.
• 12:29
  SPEAKER_00: Aaron Powell High risk stuff.
• 12:30
  SPEAKER_01: Exactly.
• 12:31
  SPEAKER_01: PM is focused exclusively on elevated permissions.
• 12:34
  SPEAKER_01: We are talking about system administrators, database owners, root accounts, infrastructure engineers.
• 12:40
  SPEAKER_01: Right.
• 12:41
  SPEAKER_01: Standard IAM or IGA platforms simply lack the granular controls required to secure these critical pathways.
• 12:48
  SPEAKER_00: Aaron Ross Powell Because I mean if a standard user's account is compromised, a hacker might be able to read some internal emails or see a single department's files.
• 12:57
  SPEAKER_00: But if a domain administrator's account is compromised.
• 13:00
  SPEAKER_01: The hacker owns the entire Active Directory.
• 13:03
  SPEAKER_01: It's game over.
• 13:04
  SPEAKER_01: They can disable the antivirus, deploy ransomware to every endpoint, delete the backups, everything.
• 13:10
  SPEAKER_00: Which is why the blueprint emphasizes a very specific coexistence strategy here.
• 13:15
  SPEAKER_00: The sources detail an architecture where SailPoint and CyberArc work together synergistically rather than competing.
• 13:21
  SPEAKER_01: Yeah, they play very different roles.
• 13:23
  SPEAKER_01: SalePoint acts as the governance authority, it's the overarching system of record.
• 13:27
  SPEAKER_01: It manages the life cycle and determines which human beings are even eligible to hold a privileged account in the first place.
• 13:33
  SPEAKER_00: Okay, and then CyberArc acts as the actual shield.
• 13:35
  SPEAKER_01: Exactly.
• 13:36
  SPEAKER_01: CyberArc steps in to secure those sensitive accounts, technically.
• 13:39
  SPEAKER_01: It uses a digital vault to store the credentials.
• 13:42
  SPEAKER_00: Wait, so the user doesn't even know their own password.
• 13:44
  SPEAKER_01: Right.
• 13:45
  SPEAKER_01: The human user never even knows the actual password to the root servers.
• 13:49
  SPEAKER_01: When an administrator needs to do maintenance, CyberArc provides just in time access.
• 13:55
  SPEAKER_01: It literally rotates the password the second they are done.
• 13:58
  SPEAKER_00: That's amazing.
• 13:59
  SPEAKER_01: It is.
• 14:00
  SPEAKER_01: And furthermore, it utilizes a privileged session manager or PSM to actually isolate the session.
• 14:06
  SPEAKER_00: How does session isolation actually work?
• 14:08
  SPEAKER_00: Like does the admin just log in through a different web portal?
• 14:12
  SPEAKER_01: It is way more rigorous than that.
• 14:14
  SPEAKER_01: The admin connects to the CyberArc PSM and the PSM initiates a secondary, secure connection to the target server.
• 14:20
  SPEAKER_00: So they aren't touching the server directly.
• 14:22
  SPEAKER_01: Never.
• 14:23
  SPEAKER_01: The admin's local machine never touches the critical database, and the PSM records everything.
• 14:28
  SPEAKER_00: What do you mean everything?
• 14:29
  SPEAKER_01: Literally, it captures video of the screen and logs every single keystroke.
• 14:33
  SPEAKER_01: If an administrator accesses a payment database, CyberArc records exactly what query they typed and what data was returned on their screen.
• 14:41
  SPEAKER_00: Oh wow.
• 14:42
  SPEAKER_01: And it feeds all this into privileged threat analytics.
• 14:44
  SPEAKER_00: So there's an AI watching the video feed, essentially.
• 14:47
  SPEAKER_01: Basically, yeah.
• 14:48
  SPEAKER_01: It's monitoring the behavioral patterns and the commands being executed in real time.
• 14:53
  SPEAKER_00: So if something looks weird.
• 14:54
  SPEAKER_01: Exactly.
• 14:55
  SPEAKER_01: If an admin who usually only runs basic maintenance scripts suddenly starts attempting to download massive tables of customer credit card data, the threat analytics engine flags the anomaly.
• 15:06
  SPEAKER_01: It scores the risk, and it can automatically terminate the connection before the data is exfiltrated.
• 15:12
  SPEAKER_00: That is an incredible level of oversight.
• 15:14
  SPEAKER_00: Like putting a lock on the door isn't enough.
• 15:16
  SPEAKER_00: You need a camera watching the room and a mechanism to slam the door shut if the person starts acting suspicious.
• 15:23
  SPEAKER_00: But I want to go back to sale point and governance for a second.
• 15:26
  SPEAKER_00: The sources mention a technology inside modern IGA tools called an identity graph.
• 15:31
  SPEAKER_00: What is that and why is it replacing the traditional way we review access?
• 15:36
  SPEAKER_01: So the identity graph is a massive architectural shift.
• 15:39
  SPEAKER_01: Historically, if an auditor wanted to review your access, they looked at a flat list.
• 15:43
  SPEAKER_00: Like a spreadsheet.
• 15:44
  SPEAKER_01: Yeah.
• 15:45
  SPEAKER_01: A massive spreadsheet of your Active Directory group memberships.
• 15:48
  SPEAKER_01: But modern multi-cloud environments are deeply interconnected.
• 15:52
  SPEAKER_01: A flat list cannot show you relationship pathways.
• 15:55
  SPEAKER_00: What do you mean by relationship pathways?
• 15:57
  SPEAKER_01: Aaron Powell Graph Theory allows IGA tools to map out interconnected nodes of access.
• 16:03
  SPEAKER_01: So it visualizes not just your direct privileges, but your hidden indirect pathways.
• 16:09
  SPEAKER_00: Aaron Powell Walk me through a hidden pathway.
• 16:11
  SPEAKER_00: How does someone get toxic access without it showing up on a spreadsheet?
• 16:15
  SPEAKER_01: Okay, let's say you are a junior developer.
• 16:17
  SPEAKER_01: On a flat spreadsheet, you only have access to a non-critical testing server.
• 16:22
  SPEAKER_01: An auditor looks at that and approves it.
• 16:23
  SPEAKER_01: Seems fine, right?
• 16:24
  SPEAKER_01: Yeah.
• 16:24
  SPEAKER_00: Totally homeless.
• 16:25
  SPEAKER_01: But the identity graph analyzes the relationships and discovers that the testing server actually has a service account attached to it.
• 16:32
  SPEAKER_01: And that service account has permissions to modify network routing tables in the cloud environment.
• 16:37
  SPEAKER_01: Uh oh.
• 16:37
  SPEAKER_01: Right?
• 16:38
  SPEAKER_01: So if you compromise that service account, you could reroute traffic from the main customer database straight to your local machine.
• 16:45
  SPEAKER_00: Privilege escalation via indirect chaining.
• 16:47
  SPEAKER_00: The spreadsheet totally misses it because it only looks one hop away.
• 16:51
  SPEAKER_01: Exactly.
• 16:52
  SPEAKER_01: The flat list is completely blind to the chain.
• 16:54
  SPEAKER_01: The identity graph calculates the entire blast radius.
• 16:57
  SPEAKER_01: It allows security teams to spot these toxic combinations of access visually before a malicious insider or an attacker ever exploits them.
• 17:05
  SPEAKER_00: Okay, but here's where the architecture goes from, you know, complex to truly futuristic.
• 17:11
  SPEAKER_00: We've been talking entirely about humans so far, employees logging in, administrators accessing databases.
• 17:16
  SPEAKER_00: Right.
• 17:17
  SPEAKER_00: But as we established in our opening hook, human beings are now the minority on corporate networks.
• 17:22
  SPEAKER_01: Aaron Powell By a lot.
• 17:23
  SPEAKER_00: Right.
• 17:23
  SPEAKER_00: Which brings us to layer five and layer six.
• 17:26
  SPEAKER_00: Workload identities, external identities, and the massive explosion of AI agents.
• 17:31
  SPEAKER_00: I mean, how do you govern a piece of code?
• 17:33
  SPEAKER_00: You can't exactly send an email to a Python script and ask it to reset its password every 90 days.
• 17:38
  SPEAKER_01: No, you definitely can't.
• 17:39
  SPEAKER_01: And you have hit on the absolute most volatile area of identity architecture today.
• 17:44
  SPEAKER_01: Layer five deals with non-human identities.
• 17:46
  SPEAKER_00: Aaron Powell Which we haven't historically been great at managing.
• 17:49
  SPEAKER_01: We've been terrible at it.
• 17:50
  SPEAKER_01: For years, organizations handled service accounts terribly.
• 17:54
  SPEAKER_01: They hard-coded passwords directly into application source code, they granted them permanent sweeping permissions, and they just never audited them.
• 18:02
  SPEAKER_00: Set it and forget it.
• 18:03
  SPEAKER_01: Exactly.
• 18:04
  SPEAKER_01: If an attacker found an API key in a random GitHub repository, they essentially had a skeleton key to the company.
• 18:11
  SPEAKER_01: But now the introduction of autonomous AI agents requires an entirely new framework.
• 18:16
  SPEAKER_00: Because traditional identity was built for authentication, right?
• 18:19
  SPEAKER_00: Verifying who is at the door.
• 18:21
  SPEAKER_00: But AI agents don't just stand at the door.
• 18:24
  SPEAKER_00: They walk inside, they read files, they summarize data, they send emails on our behalf.
• 18:29
  SPEAKER_01: Precisely.
• 18:30
  SPEAKER_01: They execute actions autonomously.
• 18:32
  SPEAKER_01: So to secure this, the blueprint outlines a rigid three-layer architecture specifically for AI agent security.
• 18:39
  SPEAKER_00: Okay, let's break that down.
• 18:40
  SPEAKER_01: The first layer is model security.
• 18:42
  SPEAKER_01: This is the foundational layer that ensures the AI model itself is sanctioned by the enterprise and is operating within established boundaries.
• 18:49
  SPEAKER_00: Aaron Powell So keeping the AI from going rogue.
• 18:51
  SPEAKER_01: Yeah, it involves deploying defenses against prompt injection attacks and setting strict output guardrails.
• 18:56
  SPEAKER_00: Aaron Powell Right.
• 18:57
  SPEAKER_00: You have to make sure the brain of the AI hasn't been compromised or tricked into ignoring its security instructions.
• 19:03
  SPEAKER_01: Aaron Powell Yes.
• 19:04
  SPEAKER_01: Now the second layer is agent identity.
• 19:06
  SPEAKER_01: And this is a total paradigm shift.
• 19:08
  SPEAKER_01: You must treat the AI agent as a first-class digital citizen with its own life cycle, just like a human employee.
• 19:15
  SPEAKER_00: Interesting.
• 19:16
  SPEAKER_01: You do not just hand the AI a shared API key, you use modern OAuth-based delegated identity chains.
• 19:24
  SPEAKER_01: The agent is registered with the IDP and it utilizes something called token vaulting.
• 19:29
  SPEAKER_00: Okay, let's unpack token vaulting.
• 19:32
  SPEAKER_00: If the agent has a secure wallet of tokens it uses to access other systems, who is guarding the wallet?
• 19:38
  SPEAKER_00: Like if the AI gets hijacked by a bad prompt, can't the hacker just command the AI to reach into its wallet and hand over the tokens?
• 19:45
  SPEAKER_01: That is the exact vulnerability token vaulting solves when paired with the third layer, which is data authorization and runtime enforcement.
• 19:52
  SPEAKER_00: Okay.
• 19:53
  SPEAKER_01: The agent never actually holds the raw tokens in its working memory.
• 19:57
  SPEAKER_01: The sources highlight PIN identity's approach here, specifically their agent gateway.
• 20:01
  SPEAKER_00: So there's a middleman.
• 20:02
  SPEAKER_01: Exactly.
• 20:03
  SPEAKER_01: The agent gateway sits between the AI agent and the resources it wants to access.
• 20:08
  SPEAKER_01: When the AI needs to query a database, it doesn't use a token itself.
• 20:12
  SPEAKER_01: It asks the agent gateway to execute the query.
• 20:16
  SPEAKER_01: Oh, I see.
• 20:16
  SPEAKER_01: The gateway evaluates the request, checks the token vault, and brokers the access dynamically.
• 20:22
  SPEAKER_00: Aaron Powell So the AI is basically in a sandbox.
• 20:25
  SPEAKER_00: It has to ask the gateway for permission every single time it wants to touch the outside world.
• 20:30
  SPEAKER_00: And the gateway is monitoring everything.
• 20:32
  SPEAKER_01: Everything.
• 20:33
  SPEAKER_01: The gateway utilizes agent detection, which uses behavioral signals to monitor the AI's actions.
• 20:38
  SPEAKER_00: Aaron Powell So it knows what's normal for that AI.
• 20:40
  SPEAKER_01: Right.
• 20:40
  SPEAKER_01: If an AI agent that is programmed to just summarize daily sales reports suddenly attempts to run a destructive command to drop a database table, the agent gateway intercepts the command.
• 20:50
  SPEAKER_00: Because that's way out of character.
• 20:51
  SPEAKER_01: Yeah, it recognizes it falls outside the agent's behavioral baseline and it blocks it instantly.
• 20:56
  SPEAKER_00: Aaron Powell But wait, what if an AI agent is explicitly designed to do something highly sensitive?
• 21:01
  SPEAKER_00: Like what if a financial firm builds an AI agent to execute large fund transfers based on market conditions?
• 21:08
  SPEAKER_00: Do we just trust the gateway to get it right?
• 21:10
  SPEAKER_01: Absolutely not.
• 21:11
  SPEAKER_01: For high-risk actions, the architecture mandates a human in the loop or H ITL mechanism.
• 21:17
  SPEAKER_01: You have to insert a human circuit breaker.
• 21:19
  SPEAKER_00: How does that actually work mechanically?
• 21:21
  SPEAKER_00: I mean, does the AI send an email to a manager asking for approval?
• 21:25
  SPEAKER_00: Because emails can be spoofed, and honestly, they are way too slow for machine speed transactions.
• 21:31
  SPEAKER_01: No, it doesn't use email.
• 21:32
  SPEAKER_01: It uses advanced out-of-band authentication flows, specifically a protocol called SIBA.
• 21:37
  SPEAKER_00: SIBA, client-initiated back channel authentication.
• 21:40
  SPEAKER_01: That's the one.
• 21:41
  SPEAKER_01: Here is the mechanism.
• 21:42
  SPEAKER_01: The AI agent attempts to execute the high risk financial transfer.
• 21:46
  SPEAKER_01: The agent gateway intersects the request and pauses the execution.
• 21:49
  SPEAKER_01: Okay.
• 21:50
  SPEAKER_01: Simultaneously, the gateway triggers an out of band notification directly to the authorized human manager's registered mobile device.
• 21:56
  SPEAKER_00: Like a secure push notification right on their phone.
• 21:59
  SPEAKER_01: Yes.
• 22:00
  SPEAKER_01: Completely separate from the communication channel the AI is using, the manager receives a prompt detailing the exact transaction the AI wants to perform.
• 22:07
  SPEAKER_00: And then they just tap approve.
• 22:09
  SPEAKER_01: Not just tap.
• 22:10
  SPEAKER_01: The manager must then provide strong biometric multi-factor authentication, like a face-side scan to approve it.
• 22:16
  SPEAKER_01: Wow.
• 22:17
  SPEAKER_01: Only after that out-of-band cryptographic approval is received does the gateway release the pause and allow the AI to complete the transfer.
• 22:24
  SPEAKER_01: It preserves the speed and utility of AI while maintaining absolute human authority over critical actions.
• 22:31
  SPEAKER_00: That is a phenomenal piece of engineering.
• 22:33
  SPEAKER_00: Okay, so we've covered the directories, the IDPs, IGA, PAM, and the massive complexities of non-human AI identities.
• 22:41
  SPEAKER_00: We are almost through the architecture.
• 22:42
  SPEAKER_01: Aaron Powell Just three left.
• 22:44
  SPEAKER_00: Right.
• 22:44
  SPEAKER_00: Let's finish the foundational layout with layers seven, eight, and nine.
• 22:47
  SPEAKER_00: Identity security, permissions management, or CIM and network access, or ZTNA.
• 22:52
  SPEAKER_01: These final three layers really represent the shift from static defenses to continuous dynamic security.
• 22:58
  SPEAKER_00: Okay.
• 22:58
  SPEAKER_01: Layer seven is identity security.
• 23:00
  SPEAKER_01: This specifically focuses on identity threat detection and response, or ITDR.
• 23:05
  SPEAKER_00: How is that different from regular antivirus?
• 23:07
  SPEAKER_01: Well, traditional security looks for malware on a laptop.
• 23:11
  SPEAKER_01: ITDR looks for attacks against the identity infrastructure itself.
• 23:15
  SPEAKER_01: It uses real-time behavioral analytics.
• 23:18
  SPEAKER_00: Give me an example.
• 23:19
  SPEAKER_01: Sure.
• 23:20
  SPEAKER_01: It calculates impossible travel scenarios mathematically.
• 23:23
  SPEAKER_01: If a user's session token is validated in New York, and 10 minutes later that exact same token attempts to access a cloud resource from an IP address in Eastern Europe, ITDR detects the mathematical impossibility of that travel.
• 23:36
  SPEAKER_00: Because you can't fly to Europe in 10 minutes.
• 23:38
  SPEAKER_01: Exactly.
• 23:38
  SPEAKER_01: And it instantly revokes the session.
• 23:40
  SPEAKER_00: It is the active immune system of the identity architecture.
• 23:43
  SPEAKER_01: Exactly.
• 23:44
  SPEAKER_01: Then we have layer eight, CIMM, which stands for Cloud Infrastructure Entitlement Management.
• 23:50
  SPEAKER_01: As enterprise organizations scale into multi-cloud environments like running workloads in AWS, Azure, and Google Cloud Platform, simultaneously managing permissions becomes a complete mathematical nightmare.
• 24:02
  SPEAKER_00: I want to dig into that nightmare, actually, because the sources point out that these cloud platforms speak completely different languages when it comes to permissions.
• 24:09
  SPEAKER_01: Oh, they do.
• 24:10
  SPEAKER_01: They don't translate natively at all.
• 24:12
  SPEAKER_01: AWS handles permissions using complex JSON policies.
• 24:16
  SPEAKER_01: Think of them as highly specific, custom-written legal contracts attached to every single file or server.
• 24:23
  SPEAKER_00: Okay, very granular.
• 24:25
  SPEAKER_01: Right.
• 24:25
  SPEAKER_01: Azure, on the other hand, relies heavily on RBAC role-based access control, which is more like giving someone a preprinted badge that says manager and assigning broad permissions to that badge.
• 24:36
  SPEAKER_00: Totally different concept.
• 24:37
  SPEAKER_01: Completely.
• 24:38
  SPEAKER_01: And then Google Cloud utilizes resource hierarchies.
• 24:41
  SPEAKER_01: So trying to manually translate a custom JSON contract into a pre-printed Azure badge just to figure out what a user can actually do across both platforms, it is virtually impossible for a human being.
• 24:52
  SPEAKER_00: So how does a CAM platform solve that translation problem?
• 24:55
  SPEAKER_01: Aaron Powell A CIM solution ingests all those different provider-specific primitives, the JSON, the RBAC, the hierarchies, and it normalizes them into a single unified data model.
• 25:04
  SPEAKER_00: Aaron Powell It translates them.
• 25:06
  SPEAKER_01: Yes.
• 25:06
  SPEAKER_01: It translates the distinct code languages into a universal schema.
• 25:09
  SPEAKER_01: Then, similar to the IG identity graph we discussed earlier, it calculates net effective permissions.
• 25:14
  SPEAKER_00: Aaron Powell Meaning what you can actually do at the end of the day.
• 25:17
  SPEAKER_01: Right.
• 25:17
  SPEAKER_01: It runs the math on explicit grants, implicit denials, inherited group roles, and temporary session policies to reveal exactly what a single identity can do across the entire multi-cloud matrix.
• 25:30
  SPEAKER_01: Oh wow.
• 25:30
  SPEAKER_01: It is really the only architectural way to genuinely enforce least privilege and clean up shadow administrators in the cloud.
• 25:38
  SPEAKER_00: It takes the chaos of three different cloud providers and turns it into one clear, readable map of risk.
• 25:44
  SPEAKER_00: That's incredibly powerful.
• 25:46
  SPEAKER_00: And finally, layer nine, ZTNA zero trust network access.
• 25:51
  SPEAKER_00: How does this differ from the VPNs we've all been using for the last like 20 years?
• 25:56
  SPEAKER_01: ZTNA fundamentally replaces the legacy VPN because it changes the entire concept of trust.
• 26:02
  SPEAKER_01: Well, in a traditional VPN, you authenticate once, cross the perimeter, and are granted broad access to the corporate network.
• 26:08
  SPEAKER_01: You are inside the walls.
• 26:09
  SPEAKER_01: Right.
• 26:09
  SPEAKER_01: If an attacker steals your VPN credentials, they can move laterally across the entire network, just probing for weaknesses.
• 26:16
  SPEAKER_01: ZTNA assumes the internal network is just as hostile as the public internet.
• 26:20
  SPEAKER_01: It utilizes microsegmentation and context-aware proxies.
• 26:24
  SPEAKER_00: Wait, so you don't connect to the network at all?
• 26:26
  SPEAKER_00: You do not.
• 26:26
  SPEAKER_00: Really?
• 26:27
  SPEAKER_01: Really.
• 26:27
  SPEAKER_01: When you request access to an internal application, the ZTNA engine evaluates your identity, verifies your device health, and then creates a secure, encrypted, one-to-one tunnel only to that specific application.
• 26:41
  SPEAKER_00: Aaron Powell Just to that one app.
• 26:42
  SPEAKER_01: Yes.
• 26:43
  SPEAKER_01: You are completely blind to everything else on the network.
• 26:45
  SPEAKER_01: If your laptop is compromised, the attacker can't move laterally because there is no network layer visibility.
• 26:51
  SPEAKER_01: The application is isolated.
• 26:53
  SPEAKER_00: Aaron Powell Right.
• 26:54
  SPEAKER_00: We have done it.
• 26:54
  SPEAKER_00: We have laid out all nine layers of the technology architecture.
• 26:58
  SPEAKER_00: Trevor Burrus, Jr.
• 26:58
  SPEAKER_01: There's a lot of layers.
• 26:59
  SPEAKER_00: We have our directories, our IDPs, the governance engines, PAM vaults, AI agent security, ITDR, CIM, and ZTNA proxies.
• 27:08
  SPEAKER_00: We have every single piece of modern security hardware and software sitting on the construction site right now.
• 27:14
  SPEAKER_01: It's quite the pile of tech.
• 27:15
  SPEAKER_00: It is.
• 27:16
  SPEAKER_00: But this leads us to a massive practical problem.
• 27:19
  SPEAKER_00: I mean, if I am an IT director listening to this, I am probably having a panic attack looking at my budget, my timeline, and my engineering team.
• 27:27
  SPEAKER_01: Oh, without a doubt.
• 27:28
  SPEAKER_00: If you try to deploy all of this at once, you will utterly destroy the company's ability to function.
• 27:34
  SPEAKER_00: The friction would be insurmountable.
• 27:36
  SPEAKER_00: So how on earth do you actually schedule this deployment without breaking the business?
• 27:40
  SPEAKER_01: Yeah, that anxiety is exactly why many IAM programs fail before they even begin.
• 27:46
  SPEAKER_01: Practitioner experience, which is cited throughout the blueprint, shows that the number one mistake organizations make is buying more platform than their operational teams can actually implement.
• 27:56
  SPEAKER_00: Biting off more than they can chew.
• 27:58
  SPEAKER_01: Exactly.
• 27:59
  SPEAKER_01: The cure for this overwhelming complexity is phase five's three-year horizon roadmap.
• 28:04
  SPEAKER_01: You cannot boil the ocean.
• 28:06
  SPEAKER_01: You have to sequence the deployment based on immediate risk reduction and organizational maturity.
• 28:11
  SPEAKER_00: Okay, let's walk through these horizons then.
• 28:13
  SPEAKER_00: Horizon one is the foundation phase.
• 28:15
  SPEAKER_00: This covers months zero to twelve.
• 28:17
  SPEAKER_00: The underlying theme here is secure the base, reduce critical risk.
• 28:21
  SPEAKER_01: Right.
• 28:21
  SPEAKER_00: What exactly is happening in year one?
• 28:23
  SPEAKER_00: What are we building first?
• 28:24
  SPEAKER_01: So in Horizon One, you are putting locks on the doors before you start installing the high-tech laser grid.
• 28:31
  SPEAKER_01: You are establishing the non-negotiable baseline.
• 28:34
  SPEAKER_01: First, you mandate phishing resistant MFA across the entire enterprise.
• 28:38
  SPEAKER_00: No more SMS techs.
• 28:39
  SPEAKER_00: Exactly.
• 28:40
  SPEAKER_01: Second, you eliminate legacy authentication protocols, like basic auth or older Windows protocols that bypass modern security controls and are highly vulnerable to automated credential stuffing attacks.
• 28:52
  SPEAKER_00: Clean up the old stuff.
• 28:53
  SPEAKER_01: Yeah.
• 28:54
  SPEAKER_01: But the most critical operational shift in Horizon 1 is establishing automated lifecycle management.
• 29:00
  SPEAKER_01: The joiner, mover, lever workflows.
• 29:02
  SPEAKER_00: The JML workflows.
• 29:03
  SPEAKER_00: Okay, I want to pause here and dig deep into the mover phase because the sources highlight this as a massive, often ignored vulnerability.
• 29:11
  SPEAKER_00: They refer to it as privilege creep.
• 29:13
  SPEAKER_01: Oh, privilege creep is a silent, systemic killer of enterprise security.
• 29:17
  SPEAKER_00: How does it actually happen?
• 29:18
  SPEAKER_01: Let's look at the mechanics.
• 29:20
  SPEAKER_01: Imagine an employee, let's call her Sarah, joins a company in the finance department.
• 29:24
  SPEAKER_01: IT provisions her access to the financial ledgers, the payroll systems, and the corporate banking portals.
• 29:30
  SPEAKER_00: Makes sense she needs those.
• 29:32
  SPEAKER_01: Right.
• 29:32
  SPEAKER_01: A year later, she transfers to the marketing department.
• 29:35
  SPEAKER_01: In a traditional manual system, Sarah's new manager submits a help desk ticket requesting access to the marketing analytics tools and social media platforms.
• 29:44
  SPEAKER_00: And IT fulfills the ticket.
• 29:45
  SPEAKER_01: They do.
• 29:46
  SPEAKER_01: But nobody submits a ticket to revoke her finance access because the finance manager assumes IT handled it, and IT assumes the finance manager will tell them what to do.
• 29:56
  SPEAKER_00: So Sarah now has access to the corporate bank accounts and the corporate Twitter account.
• 30:00
  SPEAKER_01: Yes.
• 30:00
  SPEAKER_01: And five years and three promotions later, Sarah has accumulated a toxic combination of permissions across the entire enterprise.
• 30:08
  SPEAKER_01: She has become an accidental super user simply by sticking around.
• 30:12
  SPEAKER_01: Wow.
• 30:13
  SPEAKER_00: And if a threat actor compromises her account.
• 30:18
  SPEAKER_00: So how does Horizon One automate this away?
• 30:20
  SPEAKER_00: What is the actual technical trigger that stops privilege creep?
• 30:24
  SPEAKER_01: Well, in Horizon One, you integrate your identity directory directly with the authoritative HR system like Workday or SAP.
• 30:31
  SPEAKER_01: Okay.
• 30:31
  SPEAKER_01: When HR updates Sarah's department code from finance to marketing in the HR database, that data change automatically triggers a webhook.
• 30:39
  SPEAKER_00: So it's instantaneous.
• 30:41
  SPEAKER_01: Exactly.
• 30:41
  SPEAKER_01: The identity system detects the change, automatically provisions her marketing tools based on her new role, and crucially systematically revokes any access tied to her old finance role that isn't explicitly required for her new job.
• 30:56
  SPEAKER_00: It just wipes the slate clean.
• 30:57
  SPEAKER_01: Yes.
• 30:58
  SPEAKER_01: This is called zero-based provisioning.
• 31:00
  SPEAKER_00: The system assumes you need nothing and builds your access back up from zero based on the new job title.
• 31:06
  SPEAKER_00: That's so smart.
• 31:07
  SPEAKER_00: And this same HR integration must solve the lever problem too, right?
• 31:11
  SPEAKER_00: The gap between someone getting fired and their access being shut off.
• 31:14
  SPEAKER_01: Yes, that is known as lever latency.
• 31:16
  SPEAKER_01: If an employee is terminated on a Friday afternoon, but the manual help desk ticket to disable their accounts isn't processed until Tuesday morning.
• 31:24
  SPEAKER_00: You've got a problem.
• 31:25
  SPEAKER_01: A huge problem.
• 31:26
  SPEAKER_01: You have left a massive multi-day window for insider threat sabotage or data exfiltration.
• 31:32
  SPEAKER_01: Automated lever workflows ensure that the exact second HR changes an employee's status to terminated in the system, a cascade of automated scripts fires off.
• 31:41
  SPEAKER_00: And shuts everything down.
• 31:42
  SPEAKER_01: Instantly.
• 31:43
  SPEAKER_01: It disables their directory account, revokes all active session tokens in the IDP, and suspends downstream application access instantly.
• 31:51
  SPEAKER_00: Aaron Powell The Blueprint also leans heavily into NIST SP 863 guidelines during this first horizon.
• 31:59
  SPEAKER_00: Why are federal guidelines relevant here?
• 32:01
  SPEAKER_01: Aaron Powell Because NIST 863 is the definitive gold standard for digital identity architecture.
• 32:06
  SPEAKER_01: In Horizon 1, organizations must rigorously evaluate their IAL identity assurance level and AAL authenticator assurance level.
• 32:14
  SPEAKER_00: Break those down for me mechanically.
• 32:15
  SPEAKER_00: What do they actually mean?
• 32:16
  SPEAKER_01: So IAL deals with identity proofing.
• 32:19
  SPEAKER_01: It basically asks how thoroughly did we verify this human being is actually who they say they are when we hired them.
• 32:25
  SPEAKER_01: Okay.
• 32:25
  SPEAKER_01: Did we verify a government-issued ID against a biometric facial scan during onboarding?
• 32:29
  SPEAKER_01: That determines your IAL score.
• 32:31
  SPEAKER_00: And AAL.
• 32:32
  SPEAKER_01: AAL deals with the cryptographic robustness of the authentication process itself.
• 32:36
  SPEAKER_01: Like you mentioned earlier, a password and an SMS text message is a very low AAL because SMS can be intercepted.
• 32:43
  SPEAKER_01: A hardware security key, like a Yubi key, provides a very high AAL.
• 32:47
  SPEAKER_01: You cannot build an advanced zero trust architecture in later horizons if you are not absolutely certain about the identity of the user and the integrity of the authenticator they are using.
• 32:58
  SPEAKER_01: Horizon one forces you to secure this foundation.
• 33:01
  SPEAKER_00: Okay, so year one is about survival and hygiene.
• 33:04
  SPEAKER_00: We stop the bleeding, we automate onboarding and offboarding through HR integrations, and we mandate strong MFA.
• 33:11
  SPEAKER_01: Exactly.
• 33:12
  SPEAKER_00: That brings us to Horizon 2.
• 33:14
  SPEAKER_00: Extend.
• 33:15
  SPEAKER_00: This covers months 12 to 24.
• 33:17
  SPEAKER_00: The theme shifts to mature governance expand coverage.
• 33:21
  SPEAKER_00: How does the engineering change here?
• 33:23
  SPEAKER_01: This is where we shift from simply verifying who is logging in to rigorously governing what they are allowed to do.
• 33:29
  SPEAKER_01: We move into access reviews at scale.
• 33:31
  SPEAKER_01: Right.
• 33:32
  SPEAKER_01: Instead of the IT department trying to manually guess who needs access to which database, we push the accountability to the business units.
• 33:39
  SPEAKER_01: We leverage tools like SalePoints Access Certification Campaigns.
• 33:42
  SPEAKER_00: How does an automated campaign change the dynamic for a manager?
• 33:46
  SPEAKER_01: It forces engagement.
• 33:47
  SPEAKER_01: The system automatically generates a comprehensive report of every single application and permission an employee holds and routes it directly to their manager's dashboard.
• 33:55
  SPEAKER_00: So the manager has to look at it.
• 33:57
  SPEAKER_01: Right.
• 33:57
  SPEAKER_01: The manager must periodically review the list and cryptographically attest by clicking approve or revoke that their direct report still requires this access to perform their duties.
• 34:07
  SPEAKER_01: It shifts the risk acceptance from IT to the actual business owner.
• 34:11
  SPEAKER_00: Aaron Powell Which makes sense because the business owner knows what their team actually does.
• 34:14
  SPEAKER_00: Yeah.
• 34:15
  SPEAKER_00: And this is where segregation of duties or SOD becomes enforceable, right?
• 34:20
  SPEAKER_01: Yes.
• 34:20
  SPEAKER_01: In Horizon 2, you implement programmatic rules preventing toxic combinations, the classic financial example.
• 34:27
  SPEAKER_01: The system enforces a hard architectural rule that the user account holding the authority to write a corporate check cannot mathematically be the same user account that holds the authority to approve that check.
• 34:38
  SPEAKER_00: Aaron Powell So someone tries to get both permissions.
• 34:40
  SPEAKER_01: The system auto-denies it and flags a security violation, it's built into the code.
• 34:44
  SPEAKER_00: Aaron Powell The sources also note that Horizon 2 is where zero trust graduates from a theoretical framework into a daily operational standard.
• 34:52
  SPEAKER_00: What does that operationalization actually look like on the network?
• 34:55
  SPEAKER_01: Aaron Powell It represents a shift to continuous contextual evaluation.
• 35:00
  SPEAKER_01: Let's say you log in at 8 a.m.
• 35:02
  SPEAKER_01: from your corporate laptop in the Chicago office.
• 35:04
  SPEAKER_01: The system grants you access.
• 35:06
  SPEAKER_00: Normal behavior.
• 35:07
  SPEAKER_01: Right.
• 35:08
  SPEAKER_01: But at 11 0 a.m., you walk to a coffee shop, connect to an unsecured public Wi-Fi network, and attempt to download a massive spreadsheet of customer data.
• 35:17
  SPEAKER_01: Under a traditional model, you are authenticated at 8 a.m.
• 35:20
  SPEAKER_01: So your session is still valid.
• 35:22
  SPEAKER_00: But under an operational zero trust model.
• 35:24
  SPEAKER_01: Under zero trust, the system continuously monitors the context of your session.
• 35:28
  SPEAKER_01: When it detects the shift to an unsecured network and the high-risk action of a bulk data download, it dynamically reassesses the trust level.
• 35:36
  SPEAKER_00: Oh wow.
• 35:37
  SPEAKER_01: Yeah.
• 35:37
  SPEAKER_01: It steps in mid-session and either demands a fresh multi-factor authentication, restricts the download capability entirely, or just terminates the connection.
• 35:46
  SPEAKER_01: Trust is never permanent.
• 35:47
  SPEAKER_01: It is continuously earned and continuously evaluated.
• 35:51
  SPEAKER_00: Which sets the stage perfectly for Horizon 3.
• 35:53
  SPEAKER_00: Transform.
• 35:54
  SPEAKER_00: Yeah.
• 35:54
  SPEAKER_00: Months 24 to 36.
• 35:56
  SPEAKER_00: The theme here is strategic enablement data-driven identity.
• 35:59
  SPEAKER_00: This is the bleeding edge of the architecture.
• 36:01
  SPEAKER_01: Yes, Horizon 3 is where the immense financial and operational ROI of a mature identity program is fully realized.
• 36:08
  SPEAKER_01: For end users, this is where we achieve passwordless authentication at scale.
• 36:14
  SPEAKER_01: The blueprint points to advanced solutions like OktaFastPass.
• 36:18
  SPEAKER_00: I am fascinated by passwordless tech.
• 36:21
  SPEAKER_00: How does it work without sacrificing security?
• 36:23
  SPEAKER_00: Because it sounds less secure on the surface.
• 36:26
  SPEAKER_01: It relies on cryptographic device binding.
• 36:28
  SPEAKER_01: Instead of a user typing a password that can be fished or stolen, the authentication is tied to the hardware enclave of their corporate managed laptop or smartphone.
• 36:37
  SPEAKER_00: Okay, so the device is the key.
• 36:39
  SPEAKER_01: Exactly.
• 36:40
  SPEAKER_01: The device itself holds a cryptographic key.
• 36:42
  SPEAKER_01: When the user attempts to log in, the IDP challenges the device, verifies its security posture checking for disk encryption, firewall status, OS updates, and authenticates the user seamlessly via local biometrics like a fingerprint.
• 36:55
  SPEAKER_00: So no password at all.
• 36:56
  SPEAKER_01: You never type a password, meaning there is no password for hacker to steal.
• 37:00
  SPEAKER_01: It dramatically improves the user experience while rendering entire categories of phishing attacks mathematically useless.
• 37:06
  SPEAKER_00: That is the dream scenario for an IT help desk.
• 37:10
  SPEAKER_00: No more password reset tickets.
• 37:11
  SPEAKER_01: It saves so much time.
• 37:13
  SPEAKER_00: But what about the governance side?
• 37:15
  SPEAKER_00: The SalePoint 2025-2026 report findings highlight a massive shift in how organizations handle compliance in Horizon 3.
• 37:23
  SPEAKER_01: Yeah, the report reveals that organizations operating in this advanced horizon are abandoning periodic manual access reviews entirely.
• 37:31
  SPEAKER_01: They transition to identity security posture management, or ISPM.
• 37:35
  SPEAKER_01: It is a state of continuous compliance.
• 37:37
  SPEAKER_00: Replacing the agonizing six-month audit cycles.
• 37:41
  SPEAKER_00: I've been there, it's brutal.
• 37:42
  SPEAKER_01: Completely brutal.
• 37:43
  SPEAKER_01: Instead of a manual audit, the ISPM engine utilizes machine learning algorithms to continuously monitor the entire environment for configuration drift.
• 37:51
  SPEAKER_00: Drift, like things changing over time.
• 37:53
  SPEAKER_01: Right.
• 37:53
  SPEAKER_01: If an administrator accidentally changes an AWS JSON policy that inadvertently exposes an S3 bucket to the public internet, the ISPM system detects the anomaly in real time, evaluates the risk against the baseline, and uses automated orchestration to revert the policy back to its secure state.
• 38:09
  SPEAKER_00: Instantly.
• 38:10
  SPEAKER_01: Instantly.
• 38:11
  SPEAKER_01: Before an attacker even scans the IP address.
• 38:14
  SPEAKER_00: That is an incredible progression over three years.
• 38:16
  SPEAKER_00: But let me ask the inevitable question.
• 38:18
  SPEAKER_00: If I am an executive sitting in a boardroom and I see the amazing capabilities available in Horizon 3, the AI agent governance, the passwordless user experience, the continuous automated compliance, why can't I just write a massive check to these vendors today and jump straight to Horizon 3?
• 38:35
  SPEAKER_00: Why suffer through the basic hygiene of Horizon 1 and 2?
• 38:39
  SPEAKER_01: Because of dependencies.
• 38:41
  SPEAKER_01: And attempting to skip them is the fastest way to set millions of dollars on fire.
• 38:45
  SPEAKER_00: Ouch.
• 38:46
  SPEAKER_01: It's true.
• 38:46
  SPEAKER_01: You cannot build the roof of a house before you poured a concrete foundation.
• 38:50
  SPEAKER_01: If you attempt to deploy advanced AI-driven governance platforms without having clean, authoritative identity data feeding into them, the entire system collapses.
• 38:59
  SPEAKER_00: This brings us to segment three, the criticality of dependency mapping.
• 39:03
  SPEAKER_00: The blueprint is incredibly strict about this.
• 39:05
  SPEAKER_00: Let's break down the layers of dependencies, starting with platform and data dependencies.
• 39:10
  SPEAKER_00: Platform dependencies make a logical sense.
• 39:12
  SPEAKER_00: You can't install software B if software A isn't running.
• 39:15
  SPEAKER_01: Exactly.
• 39:15
  SPEAKER_01: For instance, you cannot successfully deploy zero trust network access CTNA if you do not already have a highly available, robust identity provider operating effectively.
• 39:26
  SPEAKER_00: Because the ZTNA proxy is the locked door.
• 39:29
  SPEAKER_00: But it completely relies on the IDP acting as the passport office to tell it who is standing at the door.
• 39:35
  SPEAKER_01: Right.
• 39:36
  SPEAKER_01: If the IDP goes down, the ZTNA proxy fails closed and nobody can work.
• 39:40
  SPEAKER_00: So the infrastructure must be sequenced.
• 39:42
  SPEAKER_00: But you mentioned data dependencies are even more critical.
• 39:45
  SPEAKER_00: What happens when the underlying data is flawed?
• 39:48
  SPEAKER_01: The blueprint uses the authoritative HR source flow as the prime example, and honestly, it is where most programs stumble.
• 39:54
  SPEAKER_01: You absolutely cannot govern access in an advanced IGA tool like SalePoint if you do not have pristine identity data flowing from your HR system like workday or SEP success factors.
• 40:04
  SPEAKER_00: Let's play this out.
• 40:05
  SPEAKER_00: What happens if HR data is a mess?
• 40:07
  SPEAKER_00: What if managers are typing in random job titles or forgetting to update department codes when people move?
• 40:13
  SPEAKER_01: If the HR data is garbage, automating your provisioning processes based on that data is a catastrophe.
• 40:18
  SPEAKER_01: Think about it.
• 40:19
  SPEAKER_01: If HR inaccurately lists a junior analyst as a financial controller, the automated IGA system reads that data, believes it, and instantly provisions the analyst with super user access to the corporate ledgers.
• 40:33
  SPEAKER_00: Oh no.
• 40:34
  SPEAKER_01: You aren't fixing security, you are just automating the distribution of toxic access at incredible speed and scale.
• 40:40
  SPEAKER_01: Garbage in, automated, garbage out.
• 40:42
  SPEAKER_00: So the data pipelines have to be sanitized before you ever turn on the automation engine.
• 40:47
  SPEAKER_00: The research backs this up entirely, right?
• 40:49
  SPEAKER_00: I think it was 72% of organizations cite integration compatibility as their top IAM priority.
• 40:56
  SPEAKER_00: If your identity platform cannot cleanly sync with HR, with your IT service management platforms like ServiceNow, and with your security analytics tools, the architecture shatters.
• 41:06
  SPEAKER_01: And that leads directly to process and organizational dependencies.
• 41:09
  SPEAKER_01: The blueprint insists that buying technology does not fix identity architecture.
• 41:14
  SPEAKER_01: Technology only enforces processes.
• 41:16
  SPEAKER_00: So if the processes do not exist.
• 41:18
  SPEAKER_01: The technology is useless.
• 41:19
  SPEAKER_00: Give me a real-world example of an organizational process dependency derailing a technical deployment.
• 41:24
  SPEAKER_01: Okay.
• 41:24
  SPEAKER_01: Let's look at the access certification campaigns we discussed in Horizon 2.
• 41:29
  SPEAKER_01: You purchase a multimillion dollar IGA platform to automate these reviews.
• 41:33
  SPEAKER_01: The technology works flawlessly.
• 41:36
  SPEAKER_01: It generates the review campaign for a specific custom application.
• 41:39
  SPEAKER_00: Sounds good so far.
• 41:40
  SPEAKER_01: But the system has to send that review to the application owner for approval.
• 41:44
  SPEAKER_00: So it looks up the owner.
• 41:46
  SPEAKER_01: Right.
• 41:46
  SPEAKER_01: But what if the organization has never formally defined who the application owner is?
• 41:50
  SPEAKER_01: Oh.
• 41:51
  SPEAKER_01: What if the IT department thinks the marketing department owns the app, but marketing thinks IT owns it?
• 41:56
  SPEAKER_01: If the organizational process hasn't explicitly assigned risk ownership to a human being, the automated workflow stalls.
• 42:03
  SPEAKER_01: The tool has nowhere to route the approval, the compliance review fails, and the software investment sits idle.
• 42:09
  SPEAKER_01: Process readiness must precede technical deployment.
• 42:13
  SPEAKER_00: This sounds incredibly rigorous.
• 42:14
  SPEAKER_00: I mean, a company is mapping nine layers of architecture, sequencing them across 36 months, cleaning HR databases, and rewriting corporate processes.
• 42:23
  SPEAKER_00: At the end of phase five, after all this architectural design and political wrangling, what does the organization actually hold in its hands?
• 42:31
  SPEAKER_00: What are the physical deliverables?
• 42:32
  SPEAKER_01: The blueprint mandates five specific outputs for phase five.
• 42:36
  SPEAKER_01: But these aren't just, you know, administrative documents.
• 42:39
  SPEAKER_01: They are survival tools and budgetary armor for the architecture team.
• 42:43
  SPEAKER_00: Let's run through them.
• 42:44
  SPEAKER_01: First is the target state architecture blueprint.
• 42:47
  SPEAKER_01: This is the visual map of logical data flows.
• 42:50
  SPEAKER_01: It proves exactly how the HR system talks to the IDP, how the IDP feeds the governance engine, and how that governs downstream targets.
• 42:58
  SPEAKER_00: It is the master schematic.
• 42:59
  SPEAKER_01: Yes.
• 43:00
  SPEAKER_01: Second is the technology selection rationale.
• 43:03
  SPEAKER_01: This is deeply critical for office politics.
• 43:06
  SPEAKER_00: Office politics?
• 43:06
  SPEAKER_00: How so?
• 43:07
  SPEAKER_01: It is the rigorously documented justification of technical choices.
• 43:11
  SPEAKER_01: Why did we choose Okta over ping identity for this specific business unit?
• 43:15
  SPEAKER_01: Why did we procure CyberArc instead of Beyond Trust?
• 43:18
  SPEAKER_01: Ah, because six months from now, a new executive might come in and ask why we didn't buy the software their buddy sells.
• 43:24
  SPEAKER_00: Precisely.
• 43:25
  SPEAKER_00: The rationale document prevents endless relitigation of decisions.
• 43:29
  SPEAKER_00: It is the armor that protects the strategy.
• 43:31
  SPEAKER_01: Smart.
• 43:32
  SPEAKER_00: Third is the three-year roadmap, the sequenced project plan broken down by Horizons.
• 43:37
  SPEAKER_00: Fourth is the dependency map we just discussed, proving why certain projects cannot be accelerated.
• 43:43
  SPEAKER_01: And the fifth.
• 43:44
  SPEAKER_00: Finally, the cost model.
• 43:46
  SPEAKER_00: This breaks down the total cost of ownership licensing, implementation hours, and ongoing operational maintenance.
• 43:52
  SPEAKER_00: So the business knows exactly what the long term financial commitment is.
• 43:55
  SPEAKER_01: It is a comprehensive blueprint for survival in the modern digital landscape.
• 44:00
  SPEAKER_01: Let's synthesize this incredible journey we've been on today.
• 44:03
  SPEAKER_01: We have completely decoded phase five of the IAM blueprint.
• 44:07
  SPEAKER_00: We covered a lot of ground.
• 44:08
  SPEAKER_01: We really did.
• 44:09
  SPEAKER_01: We started by exploring the massive scale of the nine architecture layers, from the foundational directories storing identities and the IDPs asserting them, through the complex governance engines of IGA and the isolated vaults of PAM.
• 44:22
  SPEAKER_00: We ventured into the bleeding edge of securing autonomous AI agents through token vaulting and out-of-band human approvals, and we mapped how CIM normalizes the mathematical chaos of multi-cloud permissions.
• 44:35
  SPEAKER_01: We then took that massive pile of technology and structured it across a realistic, sequenced three-year horizon.
• 44:42
  SPEAKER_01: We moved from securing the foundation with fundamental hygiene and automated lifecycle workflows to expanding governance by shifting risk to the business.
• 44:50
  SPEAKER_00: And finally, transforming the enterprise into a passwordless, continuously compliant operation.
• 44:56
  SPEAKER_00: Exactly.
• 44:56
  SPEAKER_00: And we learned exactly why attempting to skip steps is fatal.
• 44:59
  SPEAKER_00: Mapping dependencies, ensuring pristine HR data feeds the automation tools, and defining human ownership before deploying software is the actual difference between building a resilient, secure enterprise and executing a highly expensive failure.
• 45:12
  SPEAKER_01: It is the difference between simply buying software and actually engineering a comprehensive security program.
• 45:17
  SPEAKER_00: And to you, listening to this deep dive, the reason this matters so deeply right now is because identity is no longer an IT headache.
• 45:25
  SPEAKER_00: It isn't a back office administration task for resetting passwords.
• 45:29
  SPEAKER_00: As the architecture proves definitively, identity is the new perimeter.
• 45:33
  SPEAKER_01: It is the firewall.
• 45:34
  SPEAKER_00: Exactly.
• 45:34
  SPEAKER_00: Right.
• 45:35
  SPEAKER_00: Managing it properly doesn't just keep attackers out.
• 45:38
  SPEAKER_00: It yields massive financial returns, drastically reduces help desk friction, and provides the agility your business needs to survive in a landscape dominated by non-human actors.
• 45:48
  SPEAKER_01: The evolution we are witnessing is breathtaking.
• 45:51
  SPEAKER_01: We are moving from managing static, predictable human employees to orchestrating a vast, dynamic fabric of digital entities operating at machine speed.
• 46:00
  SPEAKER_00: Which leaves me with a final, somewhat provocative thought to ponder.
• 46:04
  SPEAKER_00: As organizations mature into Horizon 3, they are building intricate systems and agent gateways to manage the identities and access of autonomous AI agents.
• 46:12
  SPEAKER_01: Yeah.
• 46:12
  SPEAKER_00: We're relying on human in the loop approvals to pause the system and authorize high-risk actions.
• 46:17
  SPEAKER_00: But given the exponential speed of AI development, how long until those AI agents are the ones evaluating the complex access requests?
• 46:24
  SPEAKER_00: How long until specialized AI models are detecting the anomalies, recalculating the risk context, and orchestrating the governance itself?
• 46:32
  SPEAKER_00: And when that inevitable shift happens, how do we ensure that the human in the loop doesn't become the weakest, slowest link in a completely machine-to-machine trust fabric?
• 46:41
  SPEAKER_01: That is the defining architectural and security question of the next decade for sure.
• 46:45
  SPEAKER_00: Something to keep you up at night, or at least keep you insanely curious.
• 46:49
  SPEAKER_00: Thanks for joining us on this deep dive into the uh I am blueprint.
• 46:53
  SPEAKER_00: Keep asking the hard questions, keep verifying those identities, and we will catch you next time.
• 46:58
  SPEAKER_00: That's a wrap on the nine layers of identity architecture.
• 47:02
  SPEAKER_00: The episode ends on a big question, and it should keep you thinking long after you close this app.
• 47:08
  SPEAKER_00: Take that question back to your own team.
• 47:11
  SPEAKER_00: Because the organizations that are asking it right now are the ones who won't be caught off guard when the answer arrives.
• 47:18
  SPEAKER_00: On our next episode, Jose and I tear apart exactly why a flawless strategic vision still fails on launch day, and what phase six implementation planning looks like when it's done right.
• 47:30
  SPEAKER_00: Episode seven Planning Successful Identity Management Rollouts.
• 47:35
  SPEAKER_00: Connect with me on LinkedIn at LinkedIn.com forward slash in slash Ernie Prescott, and subscribe now so you don't miss it.
• 47:43
  SPEAKER_00: Until next time.