Remote, worldwide · Identity & access
I fix identity systems and explain them after.
Okta, Iru, CrowdStrike, Proofpoint, and identity for AI agents. I write down what actually happened, including the parts that did not work, because that is the part nobody publishes.
Read the field notes Book a call
The picture above the headline is a live drawing of a made-up company: people, service accounts and AI agents, each joined by strands to what it can reach, including super admin, all mailboxes, support tickets, customer records, source code, the production database, payroll, the finance drive, password resets and user creation. Clicking scopes one of them to its one job.
Latest field notes
All field notes- Identity Okta FastPass: a leaked password should not be enough to get in Plenty of Okta tenants still let a password and one tapped push open everything. FastPass makes a leaked password boring. Why, what it does not fix, and how I would roll it out.
- Basics What SSO actually buys you It is sold as a security control. It is a control point, and it only becomes a security control at the step almost everybody skips.
- Agents Your agent does not need admin Every internal AI agent I have seen got admin on day one, because scoping it properly would have delayed the demo. Nobody came back.
Five things I write about
- IdentityIdP design, SSO, SCIM, groups and policy.
- AgentsMachine credentials and what an agent can reach.
- DevicesEnrolment, baselines and compliance.
- BasicsFundamentals, for someone who has to fix it Monday.
- ClaimsCorrections and arguments. The unpopular thing.
What I work with
Most of the damage happens between these five, not inside any one of them.
I get called in when the handoffs stop working, and usually when nobody can say which system let something through or who owns the fix.
- 01 · Email security
Proofpoint
It arrives looking like it came from someone you already trust.
- 02 · Identity & access
Okta
The credential in that message gets used, and it works.
- 03 · Device management
Iru
It works partly because the device it came from was enrolled, so it was trusted.
- 04 · Endpoint security
CrowdStrike
The device was trusted. This is where you find out what it actually did.
- 05 · AI agents
Machine identity
And the token it reached belonged to an agent nobody scoped or rotated.
Work with me
Most access problems are structure problems wearing a security costume.
- Year three. 46 grants, 24 in use, 6 holders of super admin.
- Super admin back down to the two people who need it.
- Every agent scoped to its one job.
- Service accounts cut to what they run on schedule.
- Movers lose the old team's access. Leavers' local logins closed.
- Same company, same work. 24 grants.
The company is made up. The order of the work is not.
I audit and rebuild identity and device setups for companies that have outgrown the way theirs was first put together. Usually that is a tenant somebody stood up in a hurry three years ago that has been accumulating exceptions ever since.
What I will not do
Sell you a tool. Produce a maturity model. Recommend a rebuild when a week of cleanup would do. If the honest answer is that you do not need me, that is what the first call will tell you.
Typical engagements
- 01Okta tenant audit. Admin model, policies, group structure, service accounts.
- 02Joiner mover leaver that actually runs, instead of a document describing one.
- 03Identity for AI agents. Scoping, credentials, and knowing what they can reach.
- 04Device management chosen and set up so one person can maintain it.
Thirty minutes. Three clicks. No deck.
Pick a time that suits you, put in your name and email, and it is booked. Nothing to sit through and nobody chasing you afterwards.
- Pick a slotLive availability, shown in your own time zone
- Name and emailThat is the whole form
- One line about the problemOptional
Book a callFree, no obligation
Rather write first? hello@ominpatel.com