Latest / Identity at the Center / #413 - Standards, AI Agents, and the Digital Estate with Heather Flanagan

Transcript

#413 - Standards, AI Agents, and the Digital Estate with Heather Flanagan · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Doing great, man.
0:18
You know what one of the There's so many great things about
0:23
having started this podcast with you.
0:25
This part has nothing to do with you though.
0:27
It's all the other people that have come on to the show, like
0:31
our guest today, and I have to share, like, my favorite story.
0:36
You know, it's like I don't think I ever said to Heather,
0:38
like, hey, this is like a great moment.
0:40
But I saw her at the Gartner conference this past December,
0:46
and she was actually knitting. And she talked on one of our
0:50
previous episodes about that being a major hobby.
0:54
And I have to say, that was the first time I've gone to a
0:57
conference and saw someone knitting.
1:00
OK, well, I don't know how we're going to top that.
1:02
That's like, you know, this, this, this great moment in
1:06
Heather history or something like that.
1:09
Seeing somebody in their element, man, I love that.
1:12
But I also felt completely comfortable, like, oh, there's
1:16
Heather going to go over there and chat with her and hopefully
1:19
not break her groove on this big knit that she's working on.
1:23
But I need to know, is she making like Christmas stocking
1:27
or what is in process here? I wonder if she remembers that
1:32
moment and if she knows what she was knitting.
1:36
Well, there's a good and a bad, right?
1:37
It's good if she remembers because like, oh, it was a
1:40
memorable experience meeting Jim, which let's be honest, it's
1:43
always a memorable experience meeting Jim, especially at a
1:45
conference, because you just don't know what you're going to
1:46
be wearing. It could also be bad if like if
1:48
you, if you made her mess up something, she's like, there's
1:52
that guy who made me, you know, mess up this stitch and I had to
1:54
go back and redo like, you know, blah, blah, blah.
1:57
So let's find, you know what, let's just jump right to it.
1:59
Let's find out. Heather, was it a good or bad
2:02
experience when Jim came up to you when you were knitting?
2:06
Good news and I have bad news. I know exactly what I was
2:08
knitting because it is my current travel project and I've
2:11
been working on it for a while. I was knitting A shawl.
2:14
I'm still knitting the shawl. I'll probably be continuing to
2:17
knit that shawl for at least another six months to a year at
2:20
the rate that it's going, which means I've actually spoken to a
2:24
lot of people while I've been knitting that shawl, and I don't
2:28
remember any particular one conversation that I had.
2:32
But if I'm knitting, I'm always happy to chat because I can.
2:36
Either I'm either doing something that's completely
2:38
mindless and I just have to make my hands twitch for a little
2:40
bit, or I put it down. It's like, what's it the
2:44
sisterhood of the traveling pants?
2:45
It's like this one is the the, the traveling shawl and every,
2:49
every, you know, stitch or knit in it has, you know, some sort
2:53
of story behind it. It's like, oh, I did that one.
2:55
I was talking to Jim and you know, he had I don't know.
2:57
It was it was it was Gartner, right.
2:59
So it's probably a cowboy hat maybe, Or maybe you were dressed
3:01
like a dealer, one of those outfits.
3:04
Exactly. No, it was in.
3:05
It was in Texas, so it was definitely a cowboy hat.
3:09
And so maybe there's a little bit of a a Jingle jangle and
3:11
those bells on that shawl for that particular part of the
3:15
shawl. Or maybe it really got tightly
3:18
woven or something. No, they, well people have said
3:21
that they can tell what my mood is by how aggressively I'm
3:24
knitting. Like if I'm just, if I'm just
3:26
sitting there knitting slowly and then the more irritated I
3:29
get, the faster it goes. And then like the drastic slow
3:34
down and then the really bad sign when I just put it down and
3:37
I just start looking at you. But with that, with the death
3:40
stare of you did not just say that.
3:44
I've been fortunate. I don't think I've seen the dust
3:46
stare because you're always, you know, warm and inviting and
3:48
approachable and, you know, just definitely one of the folks that
3:51
I enjoy seeing at conferences. And, you know, hopefully I will.
3:55
I will know, you know, that I have worn out my welcome far
3:58
before I get the dust stare to say, OK, move along.
4:02
I got I got some stuff to do. I think the dust stares only
4:05
actually happened in certain standards conversations.
4:10
Do you think death stares can be sniper accuracy, meaning only
4:15
one person sees it? Or do you think it's a shotgun?
4:19
Where if, if you let loose your death stare, does everyone see
4:23
it? It's one of those things where
4:25
not everybody recognizes that's what I'm doing, but my closest
4:28
friends always do. And so for them, it's more like,
4:31
oh, oh, oh, oh, laser eyes have come out and they just start
4:34
slowly, like trying to hide. Or it's like gym from the office
4:39
where you just get the, you know, the eyes and like, what
4:42
was that about? Whether the person that I'm
4:45
talking to actually gets it. Well, maybe I'm now I might just
4:48
use some video editing and just have everyone be like really
4:50
wide eyed this entire episode and see if people catch on with
4:53
that one. Let's see, Heather, this is your
4:56
fifth time on the show. We did the math right before the
4:58
show. So kind of an exclusive club for
5:01
us to be on the five times. So Jim is in charge of jackets,
5:04
so I'll leave it to him. You know Jim, I don't know what
5:06
your plan is, you know, for you know, 5 timers club, but I feel
5:11
like we need to start handing something out, maybe AT shirt or
5:13
something. If we celebrate five times right
5:16
now, Andrew Shakyara is going to give me the death stare because
5:19
they gave him nothing for his tense appearance, which was a
5:24
major faux BLOB. Because he gave me grief and it
5:29
was very, it was deserved, you know?
5:31
Every time I've been on the show, I've been wearing a
5:33
different hat because you've you've been asking me like
5:35
different questions about, you know, in one thing it's like,
5:39
OK, talk about your standards work.
5:41
But then another thing it was talk about your ID pro work.
5:43
And then another thing is talk about your collaborative work
5:46
with, you know, in writing this Dade paper.
5:49
So you've you've always taken like this slice of what it is
5:52
that I do. And now we're just going to talk
5:54
about all of it. And I think, did we lose mercy
5:57
behind you? We did.
5:59
We did OK. Well, maybe Mercy will make an
6:01
appearance of, you know, ID Pro newsletter fame and ID Pro
6:06
videos. I always enjoy seeing her behind
6:08
the scenes. So maybe we'll be lucky.
6:10
Maybe she will come back and grace us with her presence.
6:12
But why don't we start with sort of the world of Heather when I,
6:18
you know, when I look at all the stuff you've worked on and have
6:20
been working on and continue to work on, Give us an update like
6:23
what is, what is new, what is old and what is as is from your
6:28
perspective. Well, so this year, this year
6:31
has been really interesting. At the end of last year, I knew
6:35
I was wrapping up my ID Pro work.
6:37
I've been, I've been working with ID Pro for about 6 years
6:39
and I felt that it, it needed new energy to sort of spice it
6:43
up and everything else I was doing, it kind of moved on from
6:47
that, that type of model. So knew that was ending.
6:53
And so I, I actually worked on a business plan, the Heather
6:56
business plan, the I'm not sharing this with anybody.
6:58
It's what is it that I want to do?
7:00
And I came up with such a pretty plan.
7:01
It was, it was just, it was marvelous.
7:03
It was great, It was wonderful. It's like I'm going to focus a
7:06
lot more on the identity salon. I'm going to travel less.
7:11
You know, I've, I've got some basic standards work that I'm
7:14
going to be taking care of and we'll see, we'll see how that
7:18
goes where I actually leave myself a lot of time to focus on
7:24
some of the things that I think are just downright interesting.
7:27
And that lasted till about January 7th.
7:29
And then it kind of all blew up because the Ideniverse
7:37
conference hit a very, very sad state of affairs in that the,
7:42
the person who was taking over from Andy and I for to basically
7:47
manage content passed away very unexpectedly at the end of the
7:52
year. And it left the conference in a
7:54
very, very difficult position of there was no one that could
7:59
backfill at CRA to do this. And so Andy and I both said,
8:05
right, dust off those gloves, dive, you know, onto that
8:09
grenade we went and I picked up the role of content share as
8:14
opposed to before. I was chief of staff for the
8:16
conference chair. He was doing the majority of the
8:18
work and I was just like randomly catching anything that
8:21
that needed to be caught. This year, I'm much more
8:24
actively engaged in actually the the content development for what
8:28
comes in for the CFP, the sponsorships, the side meetings,
8:32
a lot, a lot more hands on material and trying to make it
8:37
so that the conference chair can actually keep that larger
8:40
oversight role. So that's been a character
8:43
building experience trying to pick that up with no, you know,
8:47
no, no, I don't want to say no planning, but it's not what I
8:51
expected to be doing. And so there was a lot of last
8:54
minute fire drill type things. And in the meantime, in the
8:58
meantime, right, I was like, OK, that's cool.
9:00
And then the World Wide Web Consortium's team said, hey,
9:07
Heather, could you volunteer for two years for the Technical
9:12
Architecture Group, which is a wonderful big responsibility.
9:19
And I had to find people to help help support that.
9:23
That was that was fun too. The technical Architecture
9:27
group, the tag is, it's an 11 person group.
9:33
Eight people are elected. And then the team says, all
9:36
right, what's what's missing? What do we need that will
9:38
balance out the the membership of this so that we can actually
9:41
look at the architecture of the whole World Wide Web.
9:44
And that's when they reached out to me and said, yeah, I think
9:46
you're, you're doing so much with the identity space, with
9:49
other standards organizations, with policy makers.
9:53
So they asked me to be on the tag.
9:56
OK, that's cool. Didn't expect to do that.
10:00
The identity Salon, it is doing great and wonderful things might
10:05
even our first meeting instead of having a, you know, it was a
10:08
full day. Yes.
10:09
And we, we generate reports out of all these meetings and that's
10:13
something that I take care of because I do like the writing.
10:15
And in this case, our reports are usually around 2025 pages.
10:22
Except this was such a great meeting.
10:24
It turned into 40 pages. So that was a big thing that I
10:27
got to work on too. And in the meantime, I'm still
10:30
supporting the US National Institute of Standards and
10:36
Technology and the National Cybersecurity Center of
10:38
Excellence, NIST and the NCCOEI subcontract through MITRE as a
10:43
subject matter expert and a technical editor for a lot of
10:45
the stuff that comes through there.
10:48
I'm also working as an advisor to something called the Cyrus
10:51
Foundation, which is doing, it's a, it's a nonprofit in Sweden
10:56
that's focusing on an open source wallet platform that
11:01
actually works more on a desktop rather than a mobile device.
11:05
I'm sure we'll get to the mobile device, but it's, it's trying
11:07
to, to look at where, where things are when you're not on
11:12
mobile and how you handle that and when you don't want to be
11:16
stuck with perhaps a big tech wallet.
11:19
There's a lot of, there's a lot of interesting things going on
11:21
there. And that's a pretty hot topic in
11:23
Europe. There's probably more, yeah,
11:31
Part 2, but that that's probably, I'm going to stop
11:38
there as those, those are the highlights at this point.
11:40
OK. So yeah, you wear many, many,
11:42
many hats, Yes. And I still write a lot for just
11:44
for my own blog. And because that wasn't enough
11:46
work, I decided to add an audio blog component to it because as
11:50
it turn, thank you. As it turns out, a lot of people
11:52
don't feel they have time to read.
11:55
Or can't. We don't judge.
11:58
It's our success. But not being able to read.
12:02
Yeah, not wanting to read. I mean, people drive too.
12:07
Yeah, it's when they drive, it's when they're, you know, walking
12:10
to work is when they're doing dishes.
12:12
It's when you 90 number of things.
12:13
And one of the things that I know person personally, I like
12:18
the give me give me 1015 minutes because that's all I have time
12:22
for. I'm going to take a walk at, you
12:24
know, 30 minutes Max. So for having my podcast be
12:29
generally never more than 15 minutes long because it's, it's
12:32
sort of the TLDR of what, what did I just write about here?
12:36
Let me talk about that. If you're interested in more and
12:39
you actually want to click on all the research because all of
12:41
the blog posts, the blog posts are always written 1st and they
12:44
always have the links to the research material that went into
12:47
it. If you want that go look at
12:50
post. So where do people find the
12:53
podcasts? Spherical.
12:55
Yeah, Spherical Cow consulting.com I know has links
12:58
to it, but I assume, you know, it's all it's on.
13:00
All the major ones I listen to on Spotify.
13:01
Yeah, it is on I think every, every major and minor podcast
13:06
platform there is. It's called a Digital Identity
13:09
Digest. It's fun, right?
13:11
I get a kick out of doing it, sure.
13:14
I and I, one of the things I've noticed, you know, looking
13:17
behind the scenes at like stats of reading and podcasts and
13:19
whatnot. So the readership has definitely
13:24
gone down a little bit at just about the same rate that the
13:28
podcast has gone up. They're just trade.
13:31
You're just trading one for the other.
13:33
In some cases, yeah. I think there's a lot a lot of
13:36
people who are getting the material now just directly from
13:40
the podcast rather than going to the blog itself.
13:42
Yeah, I think we see some of that too with us doing video.
13:45
You know, the vast majority, like 99% still listen, but we
13:48
have the video component and you know, people want to enjoy it
13:52
that way. Great or not enjoy it that way.
13:54
That's fine too. You've been involved with so
13:56
many different things and you, you named a couple things.
13:59
I want to make sure that I get them out.
14:01
Identity Salon. For people who are not familiar
14:04
with that, what is the identity Salon?
14:06
So the Identity Salon was an answer to a problem that Ian
14:10
Glaser, Andy Handel and I noticed, which is that a lot of
14:15
the senior architects that we would talk to at these
14:18
conferences, of course we talked to them in the hallways and they
14:21
really wanted to be they, they, they, they appreciated the large
14:25
venue and all the people that wanted to talk to them.
14:27
But they really wanted to have some quiet time so they could
14:29
talk to each other where they didn't have to spell out
14:34
necessarily all the acronyms and they could actually talk a
14:36
little bit about what's happening in my company and how
14:39
does it compare to what's happening in your company, but
14:41
do it in a, a fairly self, relatively private manner.
14:45
And so we kicked off the Identity Salon, which is a small
14:50
invitation only event in in part half of it I would say is, is
14:56
the event where we never have more than 30 people covered
15:00
under Chatham House rules. And we just, there may or may
15:03
not even be slides for any given any given event where we just
15:07
sit down and say, OK, what are the problems we're having?
15:09
The most recent one was around identity proofing and
15:11
verification in the enterprise. What changes are we seeing?
15:16
How are enterprises adapting to the different technologies out
15:20
there? How are they experiencing
15:23
challenges? And we tend to look like the,
15:24
the just that, that bigger scale, longer range problems.
15:28
And then out of all of those, we create these reports and we've
15:32
turned, we realized we originally thought that people
15:35
would, you know, come to the event and that's how they would
15:37
get the value. But then more and more people
15:39
actually wanted the reports, and so we turned the report part
15:42
into a subscription service so people could like subscribe for
15:46
$200 a year and then get all the reports that we've done.
15:48
Heather, I mostly follow you. I mean, obviously we see each
15:53
other conferences, but I mostly follow your LinkedIn.
15:56
And one thing I've noticed that you've been one of the things I
16:01
think is unique about you is kind of the way you bring up
16:03
these topics. Not like, hey guys, by the way,
16:07
I'm now 100% on a topic and I'd like to just give you the
16:10
answer. You're like exploring your
16:13
thinking about it more kind of thinking out loud.
16:17
I wouldn't call it a stream of conscious, but at the same time,
16:20
you kind of like bring up these topics and like, hey, I'm
16:23
figuring this out as well. And you've been talking a lot
16:26
about kind of AI agent identity. And obviously everybody's
16:31
talking about that. But you're kind of putting it in
16:34
the terms of how's it going to work as AI agents start acting
16:39
on our behalf, which I think is an incredibly useful topic.
16:44
I think more and more over the next couple of years, this is
16:48
going to take over how we do authentication, for example.
16:53
And the perspective I'm coming with that is that I think apps
16:56
are all going to be written to tell the app what you're.
17:00
Maybe they won't even called apps anymore, but you'll
17:03
essentially be telling an agent go do this thing for me, go make
17:07
a purchase or submit a timesheet or do all these things.
17:12
And then the agents going to go out there and be the actor that
17:16
authenticates. And so I'd like you to kind of
17:19
like talk about what your exploration is and kind of like
17:24
what are some of the big topics as far as you're concerned?
17:28
So the, the thing, the reason the I find the AI space so
17:32
interesting right now is because nobody has good answers to it.
17:36
I mean, what we see more often than not is yes, I have the
17:40
solution as if there's only be 1, which is not going to be the
17:44
case. There's never just one solution
17:46
to anything, right? It that's just not how it works.
17:49
The reason I, I write and research the way I do to be
17:53
honest, is because I'm trying to build myself a library of
17:56
material of how does, how does this actually work?
18:00
And what, what are the resources that are the right ones to look
18:05
at in order to actually, you know, deep dive into this in a
18:08
sane manner? And other people tend to find
18:11
that useful. I'm not since I'm not actually a
18:14
vendor and I'm not trying to sell anything.
18:16
It's actually really helpful for me to just say, here's here's
18:20
where we are right now based on this information.
18:23
And if that spurs other people to actually then think a little
18:26
bit more critically about it, then that's that's fantastic.
18:31
I did something interesting for RSA.
18:34
So I was just really curious how this might work as I, if you go
18:38
to the RSA conference website and you, you, you say, show me,
18:42
show me your vendors. It gives you like these, these
18:46
pre selected keyword terms. And so you can say show me the
18:50
eight people who say that they are AI vendors.
18:54
It's like. Hmm, only eight.
18:56
I'm like, OK, sure. There were, there were 4049 of
19:00
them, which was actually less than I expected that that self
19:04
identified as AI vendors. I imagine if you went through
19:07
others, they would say, no, no, I, my products are AI supported,
19:11
but they didn't see themselves as AI vendors.
19:13
I'm like, all right, well, for AI vendors out there, what is
19:16
it? What is it you do and how, how
19:19
do you break down that kind of classification?
19:22
And what was so much fun about doing all of that is of course,
19:27
it ended up splitting into layers.
19:29
There was like the identity layer, then there was a policy
19:33
layer, there was a runtime and visibility, there was
19:36
applications and code security and then it went all the way up
19:39
to like the the hardware edge of things.
19:44
It was an incredibly uneven distribution in terms of, you
19:49
know, we did not looking at all that there was like a group of
19:52
them over here and a group of them over there and then all
19:54
these big gaps and nothing actually orchestrating between
19:57
all of those layers. If you.
20:01
If that's the way the industry is right now, how, how anybody
20:05
can say that they have the answer to life, the universe and
20:07
anything, everything is just beyond me.
20:10
I don't know how they can get away with it and look at
20:13
themselves in the mirror the next day.
20:15
You know, one of the, I keep pointing back as my use case or
20:20
my example of how I see this working as there was a
20:23
commercial that was running around the time of the Super
20:26
Bowl. And it was the person was
20:29
saying, OK, go out and buy me an express, an espresso machine.
20:34
And they all came back or the app came back and said, OK, it's
20:38
$300, OK, go ahead and buy it and then transfer money from my
20:44
savings account into my checking account.
20:47
OK, great. And then I was thinking behind
20:48
the scenes, this agent is going in authenticating as the person,
20:53
especially with the banking app. And if I think about my banking
20:56
app experience, you know, the first thing it does is like make
21:00
sure you're not a robot. OK?
21:02
That's number one. Let's assume we can get past
21:04
that or maybe we don't assume that's a a topic.
21:08
But number two topic is it's got to be some kind of MFA.
21:12
And I don't think we've solved for that.
21:15
But even my question, so my question #1 is like
21:18
authentication seems to be kind of a a challenge in this aspect.
21:23
You know, you know, who was kind of prescient in all of this was
21:26
Ian Glaser, Sean Odell, Andrew, the the folks that were focused
21:29
on the whole continuous identity effort.
21:32
Because the, I think the whole concept of authentication is
21:38
kind of not, not what we think it is anymore.
21:44
It's not a one and done. And if it's not a one and done,
21:48
then then what are you? What are you doing right?
21:51
You you keep having to redo this thing in order to get this whole
21:54
chain of events to happen. I don't think authentication is
21:59
the right word. I don't think that's the action
22:01
that's being taken. What is it then?
22:03
Do you know? I mean, I agree with your
22:06
premise. And then the question becomes
22:09
like, so is this a vendors going to solve for this and run with
22:13
it and say we're the only product that works this way or
22:16
they're going to be? They, they can't.
22:19
There has to be. Well, now, now we're getting
22:21
into the really hardcore this is where I live part, right?
22:24
I mean, what's happening is vendors are trying to say if you
22:27
orchestrate all your stuff through through my platform,
22:31
then it will all just work. That is not how interoperability
22:35
actually happens, which means that for interoperability to
22:40
happen, there actually has to be standards that you can you can
22:43
use that have consensus and no publishing your idea on your
22:49
website and say I've written a standard for the following
22:52
behavior is not actually a standard.
22:54
I've seen that a couple times recently.
22:56
And I'm like, all right, all right, wait back up, back up.
22:59
Let's talk about what standards are.
23:02
So glad you made it openly available because you put it on
23:05
your website. But that's not that.
23:08
Is that is neither necessary nor sufficient.
23:10
Yeah, well, it's still proprietary.
23:12
It still hasn't gone through actual community review.
23:16
It hasn't gone through any privacy considerations.
23:19
It hasn't got a security consideration, you know,
23:21
depending on what Larry you're working at.
23:23
It doesn't have people looking at the usability of it.
23:26
It doesn't have people looking at the internationalization
23:28
components of it, all of which actually matter.
23:31
This this whole topic that we're talking about, do you see this?
23:34
I mean, it's going to take cooperation from vendors to
23:39
build these things. Who drives a standard like that?
23:44
Is that community member? I, I don't know, I'm using like
23:49
vaguities to talk about it, but I'm like, is this like Apple,
23:52
Microsoft? So kinda, kinda what's so I
23:56
think, I think the whole looking at MCP is a really interesting
24:00
example of of how all of this works.
24:02
And for the life of me I'm, I'm blanking on the name of that,
24:05
that new standards organization. A lot what I'm seeing happening
24:09
is the industry players, the big industry players who generally
24:13
get in trouble with regulators if they don't have interoperable
24:17
solutions based on open standards.
24:20
They're getting together to say, OK, this is not working.
24:23
We have to develop something and MCP is going down, going down
24:28
that path. But what that ends up being is a
24:30
is a very heavily pay to play style of standard which can
24:35
work. The Fido Alliance, if you think
24:37
about it as a pay to play for participation.
24:40
And yet they have open standards that come out of it and the
24:43
royalty fleet free licensing, which is kind of important.
24:47
I mean open standard can mean any number of different things
24:49
depending on what's most important to you.
24:53
Are you most worried about how the standard was developed?
24:56
Are you most worried about how the standard is made available?
25:00
Your mileage varies. Kind of like open source from
25:05
that perspective. I mean, it can mean a lot of
25:07
different things. You can have open source
25:09
software and still make a fortune around an open source
25:13
project. What is the standards body that
25:18
you know is most important when it comes to kind of this whole
25:22
genetic AI and the standards that are going to be developed
25:26
around that? Is it W3C?
25:29
No, no. This stuff is happening at so
25:32
many layers. I can't, I can't say that
25:34
there's anyone standards organization that's more or less
25:36
important. The IETF has a lot of really
25:39
interesting work going on right now.
25:40
For example, there's a working group that's working on AI
25:46
preferences. How do you actually rebuild
25:49
robots dot TXT to give it instructions for what you do and
25:53
don't allow for LLMS to use your material or not?
25:58
That working group has been going for about a year now, and
26:02
it's fascinating to watch it because I've never seen an ITF
26:06
working group with so many lawyers involved, but they're
26:09
all there in the room. There's also something called
26:12
Web Bot Auth, the Web bot authentication group, trying to
26:15
figure out how do you? On the one hand, there's a lot
26:18
of people and organizations that desperately want these bots to
26:22
authenticate themselves so that they can put some controls
26:25
around what they do. But the incentive mismatch means
26:29
that while you can want that, you can also want a pony.
26:32
And you can want it to have a nice little horn in the center
26:35
of its head. And you know, you want it can
26:37
fart rainbows. You know, you can want anything
26:39
but the incentive to get it. Why would why would a bot
26:43
actually do this? What are you offering them other
26:46
than rate limiting what they can do?
26:49
Well, that's not an incentive, you know, or give them access to
26:53
more things. Maybe that plus the the ongoing
26:58
work with Oauth and the various extensions, I would guess I
27:04
would call them of the Oauth spec to help with the
27:06
authorization and delegation. That's a pretty big deal as soon
27:10
as you do get to the acting on behalf of users.
27:15
And then I would have to say, yeah, the W3C is actually a
27:19
really interesting place to see what that means.
27:22
The post I wrote recently on AIAI enabled browsers, where the
27:28
browser becomes your AI agent. Well, that's that's that's
27:32
fascinating because that the, the way the web architecture
27:36
thinks of user agents doesn't account for that level of
27:41
delegation and behavior. And so they're having to really
27:44
think about some of the web architecture, what that means
27:47
when you hit a button, who's you, Who is you hitting the
27:51
button and what kind of response should you be getting and what
27:55
what principles then apply? But also how do you define AAAI
28:00
based browser? Is it the browser itself?
28:03
Is it a plug in to the browser? I mean Claude has plug insurance
28:06
and AI browsers and downloadable apps.
28:09
Now I like Claude, I think it works, you know, pretty well.
28:12
But who makes that definition of what is?
28:15
You know, what is an AI browser? And I'm sorry, it that that that
28:20
we're differentiating them this way, calling them AI browsers as
28:23
opposed to regular browsers. That's a very artificial
28:28
distinction that's not going to last through the end of the
28:29
year. It sounds like marketing, right?
28:31
You you log it's you know, I'm going to shame Microsoft here,
28:34
but everything is copilot now at Microsoft because they're trying
28:38
to get AI into everything. And so if I go into an App
28:40
Store, it's like Copilot for, you know, Windows Word, right,
28:45
Copilot for Excel, Like, no, no, no, like I just need Excel.
28:48
A number of times I've yelled at my computer stop helping me stop
28:51
it. But it you know, yes who who
28:56
actually decides that will the decision has probably been made.
29:02
We're just working through marketing terms right now.
29:04
I wonder how involved kind of the frontier model companies,
29:10
Open AI, Anthropic and Google would be in this authentication
29:16
standard or they just kind of like sitting back and are they
29:20
going to be active participants or is that too soon to say?
29:24
So I would say they, they are not particularly incented to
29:30
work at the tradition, what I'll call a traditional standards
29:33
model. The the thing I like most about
29:39
standard, the the open standards development of the ITF, the W3C,
29:43
the Open ID Foundation, even the Fido Alliance, is that you are
29:47
ultimately demanding consensus of people.
29:51
The humans have to come to consensus on what's going in
29:53
that spec and consensus is slow. And the more people you involve,
30:02
the slower it is there. There's really good reasons for
30:08
that. And it makes for a much more
30:10
powerful specification at the end of the day that you know,
30:12
you have buy in for because you have thought to get your
30:15
agreement, but it is slow. And the companies like Anthropic
30:19
and, and Open AI and whatnot, they're going, yeah, no, that's
30:23
too slow. AI doesn't work.
30:24
That, that at that speed, we've got it.
30:26
We've got to move it faster. And if you're telling me that I
30:29
have to wait for the the the IETF to figure out the kind of
30:34
authorization models that I need, I'm just going to invent
30:36
my own and assume that my market dominance will make it work.
30:39
Is it hopeless though? Like a governance body will
30:43
never be able to keep up with the speed of business, right?
30:46
Whether it's federal, state, local or even just a standards
30:49
group, it it just won't be able to keep up.
30:52
I think, I think there is a compromise.
30:54
There's a gentleman who like some people like to follow me
30:58
for reading and stuff, which is great.
30:59
But I follow a guy named Mark Nottingham and he's, he's a
31:04
fantastic Blogger. And one of the things he's
31:07
written recently is about how can you use AI in standards
31:11
development and to, you know, where can we use it to help
31:14
speed up the process while still respecting the need for human
31:18
consensus and human engagement? But one of the things that every
31:23
standards process desperately needs is implementation.
31:27
Just to test out me and I could, I could write the most glorious
31:29
standard in the world, but if you can't actually use it, what
31:32
was the point? But if you can write it and then
31:35
say, and then just feed the spec to an AI and say, can you write
31:38
code based on this that would actually work?
31:41
You've, you've done, you've speed things up actually quite a
31:44
bit. So I think, I think there's a
31:45
middle ground. Not sure everybody is
31:50
comfortable getting to that middle ground just yet because
31:52
we've got enough people in the standards development that are
31:55
like, wait, all AI is bad because it uses M dashes too
31:59
much, which I think is just rude.
32:01
I like M dashes, thank you very much.
32:06
And others that are like, why? Why are we not just having AI
32:10
write this stuff? I could just brain dump and then
32:12
it'll come up with something and it'll be great.
32:14
So there's a lot of tension in this space and it will resolve,
32:19
but for now it's messy. Well, why don't we relieve some
32:23
of that tension and go to maybe a topic that's less
32:25
controversial, you know, like national digital identity
32:27
programs? Oh, sure.
32:31
You know, in the US here, right, we've got mobile driver's
32:33
license. We've got, you know, mobile
32:34
passports now, you know, you can do that through like, you know,
32:37
Apple. No, yes, no.
32:41
I'll call it that. No, don't call it that because
32:43
it's a derived credential. It's not actually your passport.
32:46
You can't use it anywhere except with USTSA.
32:51
Tell me I'm talking to a standards person without telling
32:54
me I'm talking to a standards person.
32:56
You're absolutely right. So let's talk about sort of
33:00
those programs and, you know, what are some of the things that
33:03
you've been observing either from like a regulation
33:05
standpoint or from other programs maybe you've had your
33:07
eye on? What are some of the policies
33:10
that you see coming up that are really going to shape and impact
33:14
the way that identity architecture works for these
33:18
types of credentials? There's been some really
33:21
interesting policy battles around when and how to use
33:25
selective disclosure versus when and how to use zero knowledge
33:29
proofs. Or do you use both?
33:33
Or do you use, I mean, how does all of that work and when do you
33:37
use it? And who are you using it with?
33:40
Because some of these things require pretty powerful
33:43
smartphones. And that is its own inclusion
33:47
problem because not everybody's going to have said smartphone.
33:53
I have had some wonderful conversations over adult
33:56
beverages with a friend of mine about looking, looking not just
34:00
in the US but to Europe where there's there's this the push
34:04
for getting this kind of verifiably cryptographically
34:08
verifiable credential out there. Like, OK, the governments are
34:12
pushing it. They're going to issue these
34:13
things and they're going to issue it into wallets that are
34:16
only been certified and, and we've got standards, we've got
34:19
specs, we've got rules who's actually going to use it?
34:24
They're lying party aspect of this of OK, they're setting up
34:27
all of this infrastructure, but they don't have the relying
34:30
parties actually sorted out with do they know how to use these
34:35
credentials to how to check whether this particular, is it a
34:40
screenshot? Is it a, is it AQR code that's
34:43
safe to click on? What?
34:44
What do they supposed to do? That's the other thing I see
34:48
that's happening a lot. We're coming up with some great
34:50
rules and guidelines and policies and have left the poor
34:53
lying party of the entities having to use this stuff
34:56
completely out in the cold. Is this a situation where you
34:59
kind of have to build it 1st and then kind of have that framework
35:04
in place for people to catch on versus the hope that it catches
35:09
up? And maybe this is a poor
35:10
analogy, but it's almost kind of like electrical charging
35:13
infrastructure for EVs. I want a vehicle that, you know,
35:17
I want to be able to take my EV anywhere across the US and have
35:20
a network that is stable, reliable and I can count on for
35:23
that trip that does not exist yet today in the US.
35:27
As a six or seven-year now EV driver, I'm very familiar with
35:31
how things work in that space. But it's continuing to get
35:34
better. And the better the adoption of
35:36
like an EV charging network, the more people are to get over
35:39
things like range anxiety and, you know, all the different
35:42
things that go on with that. Is it similar for a credential
35:45
where we need to have infrastructure built up to
35:48
support it and be ready to accept those people when they
35:51
are ready to come on board? Absolutely, absolutely.
35:54
And I think that's what they're they're counting on the need for
35:57
government services to do that. I know there's people are slowly
36:03
leaning against financial services in the hopes and
36:08
expectations that financial services will start using these
36:10
more regularly. In the US in particular, there's
36:15
been some interesting work out of Nccoe when they talk about
36:18
mobile driver's licenses that are specifically geared towards
36:21
financial institutions and why a financial institution would
36:24
actually find this a better solution than the physical
36:28
driver's license. Can you explain that?
36:30
That you've got my head cocked to the side of like what?
36:33
Yeah, the so right now a lot of the the banks will just point at
36:40
banks. Banks are like, no, if you want
36:41
to open up an account, you have to, you know, we need to
36:44
actually, we want you to come in, we want you to have your ID.
36:50
You know, we want these things because we have, we have
36:52
regulations that we have to comply with in terms of know
36:54
your customer. And the point is that like the
36:57
Nccoe and NIST are trying to say, yes, you can actually do
37:01
all of that with the mobile driver's license and, and
37:06
walking them through that they're, you know, for legal
37:09
reasons, they are incredibly risk averse organizations out
37:13
there. But this is that will be, I
37:15
think after, after the government services, this
37:17
becomes a thing, financial services will become the next
37:20
thing. And possibly an even better
37:22
thing than government services will be.
37:24
Government services still have to be, they still have to make
37:30
it possible for people who don't have these things to get to the
37:36
services that they need. And unfortunately, a lot of the
37:39
people who need the services more are the ones least likely
37:41
to have the digital credentials. Banking.
37:44
I think you start to see that even out a little bit more where
37:48
more kids don't need government services for the most part in
37:53
the same way that kids are getting bank accounts opened for
37:56
them. So I think the banks will be the
37:58
next big thing. And then maybe the universities
38:01
or colleges or even K through 12, depending on how that's
38:06
that's going to work. I fortunately, I don't have to
38:07
work worry about K through 12 because I stuck with cats.
38:10
I don't have kids. I think one of the mistakes that
38:14
I've made a lot is thinking of, OK, we're talking about digital
38:19
driver's license or digital IDs in general is just the idea of
38:25
like, hey, let's take the real world use case and how am I
38:28
going to use a passport or a driver's license in the TSA line
38:33
or when I get stopped by the police?
38:35
But there's a whole lot of use cases that are purely digital.
38:40
I think opening a bank account could be a purely digital
38:43
experience. And I think that's probably
38:47
level 1 use case. Right.
38:49
Yep. And I bet you if we we sit and
38:51
brainstorm a bit, we'll find other level 1 use cases as well.
38:55
That voting could actually be an interesting 1, though that goes
39:02
back to government services. Still may depend a little bit of
39:04
what you're voting for. Doesn't have to be in a
39:06
government election. It can be in like your community
39:09
elections or things like that where really they don't actually
39:11
care how old you are per SE, but they want or do you?
39:15
Do you actually live in Seattle? That's all they really want to
39:19
know. No one actually cares about the
39:21
outcome of the election because you see the voter turn out so
39:24
small. But if you tried to have online
39:26
voting, people would blow a gasket.
39:29
In, in some of the local cases, sure.
39:32
Here, here where I live, since I'm in an unincorporated King
39:35
County, what we're voting on is like, it's a fundraising
39:39
activity. So that's why we tend to get
39:41
like dogs and goats as mayors. I mean, I might support any of
39:45
those things for mayor depending on the dog and or goat.
39:48
You know, if it's a little Sebastian, I'm all, I'm all in.
39:53
I want to, you know, we, we've taken a lot of time kind of talk
39:56
about a bunch of different topics.
39:57
But I want to look at this idea of, you know, digital identity
40:02
and especially for national programs, whether it is
40:04
government or maybe finance or something that has that.
40:07
If I'm an identity architect out there listening to this, and I'm
40:10
probably sitting in a private organization.
40:13
What do I do about this? Is there anything that I can do
40:16
or is it more let me keep an eye on these standards and sort of
40:20
be ready for my organization to latch on to that when it's ready
40:24
to go for like a private org? Any, any enterprise out there
40:29
that has to deal with I-9 forms, those forms that say is, you
40:33
know, in the US, is this person legal to work here?
40:37
They could save so much time using digital credentials, so
40:41
much time where you know that that as we move to digital
40:45
credentials to identify the person, but also digital
40:47
credentials to verify their educational experience, right?
40:52
Think how long it takes to actually send all of that
40:54
through HR and do all the checks.
40:56
That right there, if you do nothing else at this point in
40:59
time, if you can, if you can move that to a purely digital
41:03
verification model, you have saved your company time and
41:06
money and you're probably going to get better outcomes.
41:09
So when we talk about moving to digital identity and credentials
41:14
like that, what I don't think we're talking about is like this
41:18
immediate cut over where you cannot go the traditional route,
41:22
right? There's going to be this maybe
41:25
years long transition point where hey, we support, you know,
41:29
digital credentials. If you've got them, great.
41:31
If you don't, here's the other path for you to follow.
41:34
This is not necessarily like a binary.
41:36
Today it's this and tomorrow it's that, right?
41:38
There's going to be probably, I'm thinking a multi year
41:41
transition here and who knows, we may never get to like 100%
41:45
digital credential. But if we got to 50% over the
41:49
next decade or two decades, however long it takes, and then
41:52
longer and longer, like I, I, I guess sometimes I, I feel like
41:56
it gets lost. That's like, hey, we're talking
41:58
about digital credentials and like this is a 100% game.
42:01
Like it has to be all or nothing.
42:02
But it doesn't, right? One of the one of the sessions I
42:05
was at at RSA was a gentleman named Dale Bowie.
42:08
It was a super fun session and he was reporting out from
42:12
Australia and one of the things that he showed on the screen was
42:16
if you don't have a digital credential or you know, you
42:19
don't necessarily have a photo, if you don't have a photo ID,
42:24
they have actually this form and they have the different types of
42:28
I DS rated. And you can actually prove your
42:32
identity without a single photo ID at all, as long as you can
42:36
make the make the documentation add up to 100.
42:42
Now, like a passport would be, you know, 99 points, but other
42:47
things like your electric bills might be 10 points.
42:50
Your library card might be another 10 points.
42:52
You know this other thing might be another 10 points, right?
42:55
You could actually prove prove who you are using using a
43:01
predetermined list of things that I thought that was actually
43:06
a really great list and a great way to do it.
43:09
Yeah, that's a cool idea. I think as long as you don't
43:11
have too many, you also have to figure out just like people,
43:15
somebody out there is going to try to figure out how to break
43:18
it. And so you have to kind of have
43:21
that right mindset going in. I wanted to ask you one more
43:25
question. You've been so generous with
43:27
your time. I'm kind of thinking like from a
43:31
future perspective, like we seem to be talking about a lot of the
43:35
same topics right now, especially like agentic AI and
43:40
machine identities and things like that.
43:44
I guess the question I'd ask you is like, what are we going to
43:47
wish we talked more about and thought more about five years
43:51
down the road? I'm going to point to something
43:53
that that we have started talking about.
43:56
And yet my observation with how those conversations have gone
43:59
have been like, wow, that's really huh.
44:02
That's yeah, that and off they go.
44:05
Right. And that's the, the whole
44:08
digital estate thing. Because that problem is only
44:11
going to get bigger and bigger and bigger and bigger over time
44:14
as more and more people have a much bigger digital footprint
44:17
out there. How did we end up handling
44:19
delegation? AI is making delegation a super
44:23
hot topic. But now we're like, OK, well,
44:28
how do we solve it for AI like Doug?
44:31
Yes, and we still need to solve it for people.
44:35
You're talking death in the digital estate.
44:37
Death in the digital estate, yeah.
44:39
It's funny, Jeff and I had a conversation about this the
44:41
other day because I've one of us asked like, well, what if one of
44:45
us dies? And it's like, OK, let's stop
44:47
talking about that and start talking about something else.
44:50
Kick the can down the road. And it's like, we know, we know
44:54
that you need to plan for this, but.
44:57
But no, but it's a deeply uncomfortable thing.
45:00
It's a deeply uncomfortable thing to do.
45:01
You know, when I was a kid, it was, I didn't even realize that
45:04
I was missing the topic of, you know, you're not supposed to in
45:06
polite conversation. You're not supposed to talk
45:08
about sex, money, politics or religion.
45:12
Never occurred to me that death was one of those things that you
45:14
just don't talk about it. But as soon as you bring it up,
45:17
it's it's it's deeply uncomfortable.
45:19
And yet I think in in that five years time, it's it's a problem
45:24
that will only get bigger. Well you've just ruled out like
45:26
95% of my conversation, so I guess I've never had really a
45:29
polite conversation. Well, I pretty much gave on
45:30
polite conversation too, so you know.
45:32
So Speaking of death of Digital State, how do people get
45:35
involved? I know you're part of that with
45:36
Dean and Dean Saxon and Mike Kaiser, but for people who are
45:40
interested, is it, is it joining the group and sort of following
45:43
on and listening? Is there something that can that
45:46
that people can actively be doing around this?
45:49
Yes, I, I mean, if you want to participate and have
45:54
conversations about it, sure, then then participating in the
45:58
community group might be a fine and dandy thing, But I suspect a
46:01
lot of people, they just just tell me what to do.
46:05
I don't necessarily, you know, want to, to have a conversation
46:09
about all of the, all of the details and whether anything was
46:11
missed on the list. But if you go to and I'll make
46:14
sure you have a link for the show notes.
46:16
If you go to the Open ID Foundations website, you'll
46:19
actually, yes, we wrote a whole paper, but there's also actually
46:23
a like a checklist guide. And I think that guide is maybe
46:28
ultimately more practical than the paper will be.
46:30
The paper is more for like policy makers, standards
46:33
developers, things like that. Anyone who's like
46:35
intellectually, academically interested in the space, but
46:38
that that the actual guide to hand out and say, yeah, you're
46:43
not going to want to do this, do it anyway.
46:45
That would be the more useful thing.
46:46
Yeah, you can send a link over and I have the open ID web page
46:50
already for our show notes, but if you have a direct link to
46:53
said checklist, that would be very appreciated.
46:56
You've been super generous with your time, and so we want to
46:58
wrap up things up on a lighter note.
47:00
I feel like this conversation kind of went a few different
47:03
ways and it got, I don't know, maybe it's just me.
47:07
It was kind of like, oh, like, OK, it's getting kind of like
47:09
uncomfortable, but not in a bad way.
47:10
It was like, oh, you know, we really kind of need to talk
47:12
about more of this stuff. And so maybe this is not a great
47:15
lighter note, but in honor of Identity Management Day, which
47:18
is coming up in in about a week or so, by the time this drops,
47:22
I'd like to have a theme song for Identity Management Day
47:27
2026. You can pick any song you want
47:30
and that would become like the theme for that day that will
47:33
have, you know, people's ear worms going or toe, toe tapping
47:37
or just, you know, laughing ironically.
47:40
Yeah, at the song choice. And so Heather, as our guest,
47:43
you get to go first. Or you can defer to one of us if
47:45
you prefer and want some more time to think about it.
47:47
I'm going to go with Wagner's Ride of the Valkyries.
47:51
OK. And for copyright protections, I
47:54
can't play any of that music, so you just have to think about it
47:56
in your head. Actually, you probably could,
47:58
because that music's been around for a really long time.
48:01
Yeah, well, if you want to hum a few bars, you know, we could get
48:03
away with that. You.
48:06
Don't want me to do that. Jim, do you have a a theme song
48:10
for a Daddy Management Day? I do.
48:12
I wanted to give a shout out before I do, Before the episode
48:16
wraps up, Eve Miller is dropping her book in about a month.
48:20
It's called Mastering Digital identity.
48:23
Eve is a huge friend of the show, huge friend of all three
48:29
of us as individuals. I've already gotten to read a
48:34
clip of the book and it is freaking awesome.
48:36
Same. Same high quality reading.
48:39
Yeah, I just need the audio version.
48:44
No, I did. I did read.
48:45
I, I broke out those reading specs just for that.
48:49
So Jeff, my approach to answering this question, and I
48:52
didn't know this was the question until about 45 minutes
48:55
ago. That's how I roll.
48:57
I want it to be a gut reaction as much as I can.
48:59
Yeah. Well, I thought we had to have
49:01
the the term center in the title of the song.
49:05
And so there are very few songs that AI came back with the half
49:10
Center probably missed like some obvious choices, but the one
49:14
that I knew was from the J Isles band, which I think they only
49:20
had one song. Everybody's ever heard of
49:23
Centerfold. OK, you.
49:25
Want me to sing it for you? I mean, I'm yes.
49:27
No, no, no. You want me to because you're
49:30
going to clip it and you're going to make me look like a
49:33
horse's behind. I'm not going to make you do
49:35
anything. That's just the way you appear.
49:37
I can't. That's how you roll, baby.
49:39
Oh, that that was that was cold hearted.
49:42
Actually, other people have heard me sing little clips from
49:45
like, yeah, Jim. Yeah, but I I Can't Sing.
49:48
So, you know, everybody's better than this frying your voice.
49:51
Yeah. Here's another one that if you
49:52
want to infer the center, you know as part of it stuck in the
49:54
middle with you. There you go.
49:56
That's just like a small inference away.
49:58
Yeah, for some reason, when I was thinking of this question, I
50:01
came up with two answers and I've already shared them kind of
50:04
ahead of like here's kind of like what I was thinking.
50:05
And one was, you know, I Will Survive.
50:08
You know, that was sort of like the theme.
50:09
And then the other one was let the bodies hit the floor.
50:12
So if that gives you any sense of where my head is right at
50:14
right now, it's one of those two things.
50:17
You know, maybe it's this the theme songs for a day Management
50:19
day. We'll be sitting down with Jeff
50:21
Rich later this week to record an episode with him ahead of
50:24
Identity Management Day. So, you know, maybe we'll bring
50:27
that up and and see if we can get that into the agenda because
50:29
we're actually, we're doing a live podcast on Identity
50:31
Management Day. I think we've got 30 minutes or
50:33
so and we still need to figure out what that show's going to be
50:36
about. South Jimmy and I got to get
50:38
cracking here. Yeah.
50:40
Well, we'll be prepared well. Let's go ahead and wrap it up
50:43
for this week. A couple of reminders since we
50:46
didn't get it out to in the very beginning, but conferences are
50:49
coming up. So Jimmy and I will be in Berlin
50:50
and so will Heather. She'll be in Berlin as well for
50:52
the EIC conference. We've got discount for that on
50:55
our website, idcpodcast.com. I've got my flight booked.
50:59
I'm going just for Berlin and then coming back.
51:01
That's all I've got time for this year, but I'll be there for
51:04
the entire week and looking forward to strolling the streets
51:07
and talking with a fellow like minded individuals.
51:11
And then we've got Ideniverse in June, so we've got just cut code
51:15
for that as well. idacpodcast.com.
51:17
Just Scroll down. We'll be doing a game show, I
51:20
think to kick off sort of the opening Expo night, kind of Expo
51:22
hall night that we, it's kind of like what we did last year.
51:25
It will not be the Family Feud style show.
51:29
It'll be something different, maybe majority rules, maybe
51:32
something else. We'll see.
51:33
But we're on that and we'll be recording some episodes live
51:35
from the Expo hall floor. So please stop by and say hello,
51:39
grab a sticker. Jim's very proud of those
51:41
stickers, as am I. Have to be.
51:44
I'll have links in our show notes for people to connect with
51:46
Heather and to death and digital estate and see what else I take
51:49
notes of digital identity podcast where people can go out
51:52
there and, and listen to Heather's fine work on that
51:55
podcast, which is excellent. And we'll have links for us to
51:58
connect on LinkedIn and you know, is it more of the show
52:00
idacpodcast.com like subscribe and that's it.
52:05
We'll talk with everyone in the next one.
52:09
You've been listening to Identity at the Center.
52:12
We hope you've enjoyed the show. Make sure to like, rate and
52:16
review, and we'll be back soon. But in the meantime, hit the
52:20
website at identity@thecenter.com.
52:24
See you next time on Identity at the Center.