Practical notes on identity governance, access architecture, non-human identities, and AI agents.https://www.igafieldnotes.com/https://www.igafieldnotes.com/blog/agent-governance-should-move-to-the-application-boundary/https://www.igafieldnotes.com/blog/agent-governance-should-move-to-the-application-boundary/Instead of only governing which applications an agent can access, each application should decide which agents it trusts, what they may do, and how far their authority can travel.Sun, 19 Jul 2026 00:00:00 GMThttps://www.igafieldnotes.com/blog/open-source-git-hib-govenance-tool/https://www.igafieldnotes.com/blog/open-source-git-hib-govenance-tool/GitHub access grows quietly across people, apps, keys, secrets, and automation. I built gh-iga to make that access visible—and to be honest when a scan is incomplete.Fri, 17 Jul 2026 00:00:00 GMThttps://www.igafieldnotes.com/blog/the-certification-that-never-was/https://www.igafieldnotes.com/blog/the-certification-that-never-was/A fictional story about a real IGA failure pattern: access reviews that create evidence of governance without governance actually happening.Sun, 12 Jul 2026 00:00:00 GMThttps://www.igafieldnotes.com/blog/cloud-breaches-dont-start-in-the-cloud/https://www.igafieldnotes.com/blog/cloud-breaches-dont-start-in-the-cloud/Most compromises begin outside the cloud, then ripple inward through identity, federation, and trust chains.Thu, 28 May 2026 00:00:00 GMThttps://www.igafieldnotes.com/blog/your-verified-identity-is-now-a-liability/https://www.igafieldnotes.com/blog/your-verified-identity-is-now-a-liability/AI agents, deepfakes, and synthetic profiles are dissolving the old boundary between verified identity and actual human trust.Mon, 25 May 2026 00:00:00 GMThttps://www.igafieldnotes.com/blog/your-situation-isnt-as-unique-as-you-think/https://www.igafieldnotes.com/blog/your-situation-isnt-as-unique-as-you-think/The hidden cost of believing the rules don't apply to you.Mon, 25 May 2026 00:00:00 GMThttps://www.igafieldnotes.com/blog/salesloft-breach-guest-user-identity-gap/https://www.igafieldnotes.com/blog/salesloft-breach-guest-user-identity-gap/When an attacker can add a guest account without approvals or alerts, it's not a breach problem — it's an identity governance problem.Tue, 09 Sep 2025 00:00:00 GMThttps://www.igafieldnotes.com/blog/two-types-of-communicators-in-corporate-it/https://www.igafieldnotes.com/blog/two-types-of-communicators-in-corporate-it/Real-time responders and batch processors both have a place in IT. The best professionals know when to be each.Tue, 09 Sep 2025 00:00:00 GMThttps://www.igafieldnotes.com/blog/the-missing-middle-where-humans-and-ai-meet/https://www.igafieldnotes.com/blog/the-missing-middle-where-humans-and-ai-meet/The real opportunity in the age of generative AI isn't on either extreme — it's in the space where humans and machines work together.Sun, 07 Sep 2025 00:00:00 GMThttps://www.igafieldnotes.com/blog/weekend-read-what-iga-do-you-use/https://www.igafieldnotes.com/blog/weekend-read-what-iga-do-you-use/A roundup of practitioner takes on Okta, SailPoint, One Identity, Saviynt, Omada, midPoint, and Wren:IDM from a Reddit thread worth bookmarking.Sat, 30 Aug 2025 00:00:00 GMThttps://www.igafieldnotes.com/blog/jagged-intelligence-ai/https://www.igafieldnotes.com/blog/jagged-intelligence-ai/AI can pass medical exams and solve advanced math, then fumble on something a child would handle. That unevenness has a name — and it might be permanent.Tue, 01 Jul 2025 00:00:00 GMThttps://www.igafieldnotes.com/blog/deployment-pain-where-dev-meets-ops/https://www.igafieldnotes.com/blog/deployment-pain-where-dev-meets-ops/It worked on my machine. Then it didn't. Every engineer has lived this gap — and it's where the real work of bridging dev and ops begins.Mon, 31 Mar 2025 00:00:00 GMThttps://www.igafieldnotes.com/blog/hacked-data-real-projects-fake-invoices/https://www.igafieldnotes.com/blog/hacked-data-real-projects-fake-invoices/A Plymouth fraud case shows how data theft plus social engineering can bypass every control you've built — by impersonating a vendor you already trust.Sat, 31 Aug 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/unmasking-usps-phishing-scam/https://www.igafieldnotes.com/blog/unmasking-usps-phishing-scam/A 'delayed package' text from USPS landed in my inbox. Three checks in a sandbox were enough to confirm it was a phishing scam.Mon, 19 Aug 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/booking-com-magic-link-scam/https://www.igafieldnotes.com/blog/booking-com-magic-link-scam/Scammers don't need to spoof Booking.com — they trigger it to send you a real login link. MFA doesn't help. Here's why.Sat, 27 Jul 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/lockbit-bank-ransomware-humans-still-the-weak-link/https://www.igafieldnotes.com/blog/lockbit-bank-ransomware-humans-still-the-weak-link/A LockBit ransomware attack on a bank started with one employee clicking a link. The lesson isn't 'train harder' — it's 'design assuming the click happens.'Tue, 09 Jul 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/rockyou2024-largest-password-leak/https://www.igafieldnotes.com/blog/rockyou2024-largest-password-leak/The leak itself isn't the danger — it's what attackers do with it next. A practical take on why MFA stopped being optional.Fri, 05 Jul 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/patelco-ransomware-attack-anatomy/https://www.igafieldnotes.com/blog/patelco-ransomware-attack-anatomy/A credit union with $9B in assets and 400,000 members gets hit. Walking through how ransomware actually unfolds — and what the real impact looks like.Wed, 03 Jul 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/teamviewer-midnight-blizzard-password-spray/https://www.igafieldnotes.com/blog/teamviewer-midnight-blizzard-password-spray/The TeamViewer breach is a textbook case of why MFA strength — not just MFA presence — is the line between an attempted attack and a successful one.Mon, 01 Jul 2024 00:00:00 GMThttps://www.igafieldnotes.com/blog/detecting-phishing-real-world-example/https://www.igafieldnotes.com/blog/detecting-phishing-real-world-example/Gmail's built-in filters didn't flag this one. Six small signals — none of them obvious individually — told the real story.Tue, 30 Apr 2024 00:00:00 GMT