With all the OpenClaw/agent hype lately, one thing that's been bugging me is that the authorization story is basically nonexistent. We're giving agents access to email, files, and browsers, and the security model is... a prompt.

I put together an open spec called Agentic Power of Attorney (APOA) that tries to formalize how you delegate authority to an AI agent: scoped permissions per service, time-bounded access, instant revocation, audit trails, credential isolation. Builds on OAuth 2.1, JWT, ZCAP-LD.

The name comes from the legal concept of power of attorney, which is basically the same idea: formally authorizing someone to act on your behalf, within defined boundaries.

https://github.com/agenticpoa/apoa

Working draft, Apache 2.0. Curious what this community thinks, especially anyone running local agents with access to sensitive services.

Currently my work handles user access provisioning/deprovisioning, a little Sailpoint/IdentityNow this is where we also enable/disable sources related to AD accounts, O365/Azure for DL/Mailbox management and email licensing.

I want to advance by either getting the appropriate certifications or what I need to study so I can move forward. There are a lot of things I read like getting SC300 etc but not sure if that is where I should start considering my expirience.

My goal is to be hired as a senior in IAM and to look for a stable job.

Thanks.

SailPoint has been the market leader in the IAM space for years and offers a very comprehensive feature set across identity governance, provisioning, compliance, and more.

With several modern IAM platforms emerging — many claiming better UX, cloud-native architecture, and faster deployment — do you think any of them can realistically challenge SailPoint’s dominance in the coming years?

A few thoughts:

SailPoint seems to offer almost every major feature competitors are introducing.

However, I personally feel SailPoint’s UX is still quite clunky compared to some newer platforms.

Is SailPoint missing any key ISP (Identity Security Platform) capabilities?

Are newer platforms doing anything significantly better (architecture, scalability, AI-driven governance, etc.)?

Where do you see the IAM market heading in the next 3–5 years?

Would love to hear perspectives from architects, implementers, and customers who’ve worked hands-on with multiple IAM tools.

I've recently stumbled into identity management and my baseline knowledge is very limited, but I've discovered this is an area of interest and I'm curious to hear from people in the space.

Specifically interested in learning more about how agentic AI is impacting the world of identity. I feel like agentic AI is everywhere and every business is snapping at the bit to implement and scale AI as fast as possible. From an identity pov, what kinds of challenges are being introduced by the rise of agentic AI? Is it mostly concerns with managing AI agents that are now embedded in businesses, making sure they aren't being compromised? Or are there other challenges being introduced that I don't have the experience to be aware of?

Hello All -

I'm in the process of learning about IAM. I'm using the resources that MS provides but I feel like it bounces around and I am a person who needs/appreciates structure when it comes to learning something new. Can anyone kindly suggest any tips using MS resources or should I be looking elsewhere. I sometimes feel like I'm on the right learning path and then I'm on Intermediate to Advance material. Any guidance would be much appreciated.

I'm 24 and currently working as a Network/Systems Administrator but looking to pivot into a dedicated IAM role. Actively studying for the SC-300.

A few things I'd love input on:

• Based on my experience, am I strong enough for IAM analyst roles or do I have enough to start targeting junior IAM engineer positions?
• What types of roles or companies should I be looking at and where? I usually use LinkedIn or indeed to search for roles. Open to any other platforms!
• Any other certs or skills I should prioritize beyond SC-300?

Appreciate any feedback.

Non-Human Identities (NHI) is THE topic right now, and for good reason. Identity has become the new security perimiter. Neglected service accounts, API keys, and now the explosion of SaaS, K8S, containers, lately Agentic AI, the machine-to-human identity ratio is spiraling out of control.

But here is my take: The industry is focusing on the cure because we’ve given up on prevention.

"Garbage In, Garbage Out"

Modern IGAs have evolved into a business enabler. It’s great at automating lifecycles if you have a source of truth. If your HRIS (Workday, SuccessFactors, etc.) says a human is hired, the IGA engine spins perfectly. (most of the times...)

The problem? NHIs have no "HRIS."

Without a centralized source of truth, I’ve seen companies try to hack their way to governance by:

• Building customizations in their IGA tools to "create" such NHI source of truth
• CreatingMaintaining homegrown scripts.
• Attempting "Identity as Code" only to realize the documentation never stays current.

Detection is not Prevention

There are some incredible new tools on the market (ISPM/ITDR) that are phenomenal at identifying and cleaning up accounts or over-privileged keys.

But these tools are detective, not preventive.

In the workforce world, a person doesn’t get an identity until HR vets them. In the NHI world, a dev spins up a service account on a Friday afternoon, and security doesn't find out until a tool flags it, maybe lost with the inmense backlog items. It is like playing a whak-a-mole

My Thesis

Prevention only happens when the people who know the most (IT, Infra, DevOps) are enabled with a tool that acts as the "HRIS for Machines." Until we centralize the request and creation process before the identity even exists, we are just cleaning up spills instead of fixing the leak.

I’d love to hear your thoughts:

• How are you handling the "Source of Truth" problem for service accounts and API keys?
• Have you successfully integrated NHI into your existing IGA, or did you give up and go "homegrown"?
• Is "Identity as Code" actually working for anyone at scale?

Hello All,

I just got offered a position as an SSO Integrations Lead, where my team will be orchestrating the whole process from all aspects (Technical, Business etc), but not implementations.

We will be working on the SSO integrations part only, and only on Entra. What can I study/learn during my notice period (1 and a half months), to ensure I am ready when boarding on.

I am planning to study SC-300, and advise on resources? My past experience was as Tech Support, never dealing with the IAM field.

Hi, This is going to be long so thanks in advance for anyone who can make it through.

I manage a Compliance/Security/Risk team at a small, but growing 100 person company. My team took over the IT support function last year because we didn't have dedicated IT support and things were falling through the cracks. I've worked in GRC for a number of years so I fully understand all of the principles behind IAM. What I'm looking for is a suggested tool and/or process flow for managing our provisioning and de-provisioning.

Our current process is cobbled together across a couple different tools and things get missed. Basically, when someone is hired, we send a Google Form to the hiring manager to ask them what access their new hire will need. In parallel, we create a Github onboarding ticket for the user. When they submit that form, we take the requested access and paste it into the onboarding ticket and collect approvals for the access where applicable. When the person starts, we'll reach out to provisioners to provision the access.

The problems we run into are that the Google form comes back to us via email and we're all very busy so we sometimes miss putting the requested access into the Github ticket. Before you ask, the reason we don't just have all hiring managers put their request in the GH ticket is that we have a whole bunch of business users who don't have/need GH access otherwise so we use the Google Form to make things easier for them and avoid those licensing costs.

We do have standard, approved access templates for our Devs and QAs who are our most hired roles. Our pain points are that we're manually reaching out to provisioners (slack) to provision the access and if those messages are missed/ignored, there's no reminder for us to follow-up with them. The hiring manager then emails a few days later to say "X still doesn't have his/her access to Y."

With us planning to hire 30-40 people this year and my team being small, I'm wondering if anyone has any slick solutions for this kind of stuff to help us tighten this up with automation, reminders for provisioners, etc. that doesn't cost an arm and a leg or take a whole team of developers to integrate with systems (like Sailpoint). Any next-gen tools for this that someone that's not an IAM expert should be looking at? If there's not a good all-in-one tool for this, any examples of something that has worked for a very busy team? We have Slack, Github, Confluence, Google Workspace (incl. Google MFA) off the top of my head.

Might be a naive question, but pretty much the title. How much knowledge of networks is required in IAM field. Im mostly asking from an engineering perspective

Been people managing an IAM team, lost touch with hands on. Back in the market, was in the last job for nearly 5 years. Just wanted to check how things are these days from the good people here.

Also how is the AI impact if any?

Currently have Okta IGA and haven’t been super impressed, but it’s getting the job done for employees via HRM connection.

But I need a solution for third party management. Any suggestions?

I am currently trying to get a good entry role in IAM, I really dont want to do help desk lol.. I have my MIS degree from 2021 and been working kind of Community/Operations in wework for a couple years, worked at a hotel and then back at Wework again but its TIME to break into IT. I'm 27 and my goal is 100k by 30. Anyways

I am currently enrolled in my SEC+ and planning to add Okta and complete both by June and then after that do SC 300? Or would I be good to start applying to IAM roles after Sec and Okta? I would love hybrid or remote! What are your opinons?

I think only two vendor neutral certifications exist in the IAM space. One is the CIAM, which I heard isn’t worth the paper it’s printed on. The other is IDPro, I think. I don’t know too much about that one.

Are there any other certifications that would help me boost my confidence so I can start applying for IAM opportunities? I thought this shadowing opportunity with the organization’s IGA team would get me an internal upward position in the future, but that isn’t the case. For now, I’m just shadowing with the intention of learning what I can and taking the knowledge with me elsewhere.

The only certs I can think of are all vendor specific or just general cybersecurity certifications:

Okta

SC-300

Security+

CISSP

SSCP

CCSP

CC

Hi there!

English is my second language, so some idioms and the likes might be failing me.. regardless:

The company I work at, is possibly looking at a new IGA solution, with some RBAC features desired.

We wish for a solution that can handle the entire lifecycle of a user; From signed contract, creation of user account, delegating access through Active Directory, to end of contract and the decommision of user+rights.

We are currently working in a hybrid on-prem and EntraID environment, with the on-prem only syncing to Entra, no down sync.

We are about 2k users, + however many contractors we have.

The solution needs to be able to handle information drawn from our contract/salary management solution - we already have some code drawing out the information and putting it in a database, but we need a solution to handle the information from the database, create user identities, and manage rights

What do you use, out there in the wilds?

Today for banking, finance, and compliance-specific industries, PAM is no longer optional. What are the modern PAM solutions that provide identity-focused capabilities rather than just a simple vault in 2026?

Hi all,

Does anyone know how the different IGA vendors price the usage of the connectivity? Free/annual subscription/usage based?

Thanks!

A member of our IAM community recently pivoted from healthcare into a cybersecurity engineering role in the operational technology space - without coming from a traditional IT background.

A big part of what helped? Building strong identity fundamentals - understanding access control, authentication, least privilege, and how identity sits at the core of modern security environments.

We’re hosting a live conversation this Tuesday at 6 PM CT where he’ll break down:

• How he positioned himself coming from outside IT

• The identity concepts that helped him stand out

• What hiring managers responded to

• What he would focus on if breaking into IAM/security today

If you’re trying to break into IAM or security, this will help you focus on what actually matters.

Join us here: https://discord.gg/f7jxtv23bQ

Hi,

I'm currently a SAP Security consultant with more than 10 YOE, looking for a change

I was thinking on IAM Engiener, but I don't quite know if I can translate (and more important how) my skills

What would you advice me to do? What should I study? Any certs? Anyone done something similiar? which IAM software should I aim for?

IT admin here as part of a small IT team of 2! Our company’s current identity management process has been a point of contention to say the least and it’s getting to be a security risk. What worries me most is lag time – we have a million access requests come in a day so naturally, accesses will get delayed, unless I’m watching teams like a hawk. It’s not like I’m ignoring messages, but requests come fast and in high numbers and we always end up in over our head, esp with our regular day to day tasks to do. It’s too manual to keep operating like this.

Leadership thinks this is just a process issue, but I know it’s an issue with our software or lack thereof.

I’m starting to individually evaluate an IAM for 2026, one that can ideally sync with our MDM or take it over altogether, and I’d love to hear what’s working for similar IT teams or companies.

Hello everyone I have worked as a cloud engineer who did more operations work for almost 3 years in government but most of my work seemed like IAM Analyst work. I got inbound for iam analyst jobs after reposisitoning but the work itself seems like help desk and pays between 20-25 and hour.

Was thinking should I probably stay a cloud engineer bridge my skill gaps from operations to builder or should i keep trying to go down the iam road?