The TRUST post ended with a promise: PKI next, because it’s the clearest case of one technology serving both TRUST and CRED. The CRED post sharpened that into two claims: short-lived agent credentials have a quantum advantage, and SAML has no migration path at all. Both claims are true. This post is where they land. ...
In my last post, I used Mike Schwartz’s diagram, which decouples Identity from Access Management, to place the four dimensions of AIdentity Governance™: TRUST, CRED, PRIV, and BEHAVE. TRUST anchors the Identity side. It asks whether a principal has been vouched for, and whether that accountability chain still holds. CRED completes the Identity side. It asks a narrower and more urgent question: can this principal prove it is who it claims to be, right now? ...
Mike Schwartz of Gluu recently shared a diagram arguing that Identity and Access Management are very different problems, each large and complex in its own right, and that it may be time to decouple them. His diagram places four quadrants side by side: Identity, Access Management, Governance, and Observability. It also splits Identity into three lobes: Organization, Human, and Software. I think he’s right. His diagram also gave me something I’ve wanted for a while: a way to draw the four dimensions of identity governance I first proposed at CISA in 2016, TRUST, CRED, PRIV, and BEHAVE. ...
I updated the four dimension framework today. Section 4.2 introduces the TRUST posture model — the four components that make up a principal’s TRUST position: Human Identity Assurance, Traditional Non-Person Entity Assurance, Agent Identity Assurance, and System Integrity Assurance. It ends with a caveat I meant sincerely: no platform will surface all of these signals, so organizations should treat this as a governance architecture to work toward rather than a formula to compute precisely. ...
When I was at CISA, we organized identity governance around four capability areas: TRUST, CRED, PRIV, and BEHAVE. They were mapped to CDM program requirements, documented in federal reference architecture, and implemented across U.S. agencies. But I’ve always thought the word “capability areas” undersells what they actually are. They’re dimensions. A dimensional space in which every principal — every human, every device, every service account, every agent — exists at a specific coordinate, and where the enterprise’s security posture is a function of its ability to continuously characterize that position across all four axes simultaneously. ...
In November 2016, I gave a presentation at CISA that proposed something simple: every enterprise, regardless of size or sector, needs to be able to answer four questions about every principal operating on its networks. Not at onboarding. Not at audit time. Continuously. Those four questions became the foundation of the CDM program’s Identity and Access Management capability — a framework used across U.S. federal agencies to govern who has access to what, under what conditions, and whether they’re behaving accordingly. We called the four dimensions TRUST, CRED, PRIV, and BEHAVE and they were central to the CDM Program Phase 2. ...