Identity at the Edge
I work on secure, Zero-Trust cloud environments and decentralized identity platforms — systems where authentication and authorization live at the edge, not buried in application code.
What I Work On
- Decoupled Authorization Patterns: Moving authorization logic out of application code and into the edge layer (APISIX / Envoy / Traefik).
- Identity Provider Architecture: Keycloak tuning, federated and multi-tenant deployments, self-hosted identity infrastructure.
- Policy Engine Integration: Externalizing authorization decisions to Open Policy Agent (OPA) or Cedar, with hard-separated feature-flag layers.
- AI Agent Identity & Agentic IAM: Workload identity and delegation for autonomous agents — SPIFFE/SPIRE, OAuth 2.0 Token Exchange (RFC 8693), and Model Context Protocol resource indicators (RFC 8707).
- Secrets & Workload Identity: Dynamic secrets with Vault/OpenBao, per-workload least-privilege scoping, and auto-unseal architectures.
How I Write About It
Everything published here runs somewhere before it gets written about. The posts document what actually happened — including the bugs that shipped, passed review, and were only caught by testing the enforcement path rather than the component that computes the answer.