Identity Security · IAM · AI Governance
Prithvi Poreddy
Product leader in Identity Security & AI Governance, building trustworthy systems for humans & machines while sharing insights on technology, risk, and design.
Latest writing
AI Agent Tools Are Entitlements. Govern Them Like It.
Per-user OAuth answers who the user is. It doesn’t answer which tools they should get through the agent. Treat each tool as an entitlement, requested, approved, reviewed, and revoked like any other access.
The Bottleneck Was Never the Tooling
SSO onboarding is slow because of the queue, not the tooling. A working prototype shows the routine path does not need an administrator, and the one checkpoint that should stay human.
SSF, CAEP, RISC, and SCIM Events: the standards turning Zero Trust from a principle into a reality
A practical breakdown of how SSF, CAEP, RISC, and SCIM Events work together to close the gap between Zero Trust as a principle and Zero Trust as a functioning architecture.
Build vs Buy for Identity Security: Strategy, Capability, and Risk
Stop asking if you can build. Start asking if you should. A framework to help identity and security teams make better build vs buy decisions by evaluating strategic necessity, execution capability, and total risk.
When SaaS Vendors Control Your Identity: Email Serves Two Masters
Practical strategies for maintaining immutable identifier architecture internally while working within SaaS platform constraints that require email as the primary identifier.
Stop Treating Email Addresses as Identifiers
Email addresses as identifiers create security risks, audit gaps, and technical debt. Learn the three-layer approach to proper identity management.
CAEP and Zero Trust: Why AI Agents Make This Critical (Part 4 of 4)
The future isn’t incremental. AI agents require transaction-level authorization. Zero Trust demands continuous verification. CAEP provides the infrastructure for both—and what’s coming in the next 3-5 years.
Implementing CAEP: Architecture Patterns and Policy Design (Part 3 of 4)
From direct IdP connections to centralized event hubs—understand the architecture patterns that work at scale, how to design effective policies, and avoid common implementation pitfalls.
How CAEP Events Actually Work: Real Scenarios You Face Today (Part 2 of 4)
From contractor termination to session revocation in under 3 minutes. See exactly how CAEP events flow through your systems and why different applications respond differently to the same security event.
CAEP Explained: Why Your Federated Sessions Are Broken (Part 1 of 4)
A contractor’s access ends at 5 PM, but their sessions stay active for hours. This isn’t a bug—it’s how federation works. CAEP fixes the structural problem nobody talks about.