Never trust, always verify, applied to real systems.

Writing on Zero Trust

• Oct 10, 2026 19 min read

  Zero Trust for AI: Part 1, What the OpenAI and Hugging Face Incident Reveals

  Trace the OpenAI and Hugging Face incident through agent authority, shared state, dataset processing flaws, and privilege expansion to understand what Zero Trust must enforce.

  AI Zero Trust Read →
• Jul 25, 2026 4 min read

  Your AI Agents Can Act. Can Your Security Model Keep Up?

  AI agents turn access into action. Explore the identity, data and authorization questions behind Zero Trust for AI, and what my live O'Reilly course covers.

  Zero Trust AI Read →
• Jun 1, 2026 12 min read

  Entra Agent ID Across Clouds: Part 5, Anti-Patterns

  Final article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Closes the loop with the variants and failure modes that consume the same operational budget as the federated pattern without delivering its security properties, and ends with the takeaways worth pinning to the team wiki.

  Digital Identity Zero Trust Read →
• May 15, 2026 16 min read

  Entra Agent ID Across Clouds: Part 4, FIC, Cross-Tenant, and OBO

  Fourth article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Opens up the Federated Identity Credential as a first-class object: single-tenant, cross-tenant SaaS shape, and the orthogonal world of on-behalf-of (OBO) where the agent acts for a signed-in user.

  Digital Identity Zero Trust Read →
• May 1, 2026 26 min read

  Entra Agent ID Across Clouds: Part 3, Managed Identity and Entra Objects

  Third article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Pins down what the UAMI actually is in this architecture, why SAMI breaks federation, the three distinct Entra objects (UAMI, Blueprint, Agent Identity) and the three claims (sub, azp, oid) they each populate, and the production trade-off between federating the UAMI or the Agent Identity to the cloud.

  Digital Identity Zero Trust Read →
• Apr 25, 2026 26 min read

  Entra Agent ID Across Clouds: Part 2, Federation End to End

  Second article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Walks the federated pattern as two parallel federations sharing one managed-identity JWT, explains why a laptop cannot participate, and shows what actually travels on the wire (including the audience GUID that catches most first deploys).

  Digital Identity Zero Trust Read →
• Apr 15, 2026 15 min read

  Entra Agent ID Across Clouds: Part 1, Lower Environment and Secrets

  The opening article in a five-part series on running Microsoft Entra Agent ID against third-party clouds (AWS, GCP). Covers the two trust environments behind every cloud-agent deployment, and walks the secret-based pattern (the shape you use on a laptop, on a CI runner, or in any non-Azure dev box) end to end.

  Digital Identity Zero Trust Read →
• Aug 10, 2020 1 min read

  Podcast: Security Patterns For Client-Side Apps Running In The Browser

  Great to have Dr. Philippe De Ryck on the podcast. He talked about various security challenges faced by developers while working with client-side applications.

  Zero Trust Read →
• Feb 21, 2016 17 min read

  Using Client Certificate Authentication for Web API Hosted in Azure

  During recent customer engagement there was a discussion around client certificate [a.k.a tls mutual] authentication and how to use it with asp.net web api that is hosted on azure as a azure api app.

  Digital Identity Zero Trust Read →

Other topics