|

Isidro's picture

Isidro Rodríguez

Nineteen years as a systems engineer, the last decade in identity and access management. Day to day I work on corporate identity providers at enterprise scale: authentication policy, phishing-resistant factors, joiner-mover-leaver lifecycle, service accounts, and the automation that runs all of it. Okta Certified Professional.

Identity is where systems either hold together or quietly fall apart. The automation that saves a team twenty hours a week is one forgotten API key away from being the incident report.

Most of what I write starts from the same observation. Automation platforms and AI agents are being handed credentials faster than anyone is governing them. An n8n workflow with a stored token is a service account. A coding agent running under someone's session is an unmanaged identity. The IAM playbook already covers this. It just has not been pointed at it yet.

So that is what I write about: identity engineering, lifecycle automation, and the places where the two quietly go wrong.

Strong opinions. Working code. No vendor cheerleading.

Expertise.

Where I spend my time. The through-line is identity: what can reach a system, how that access gets granted and taken away, and how much of it can be automated without losing the audit trail. The frameworks are the enterprise ones, least privilege and joiner-mover-leaver and Zero Trust, ISO 27001 and SOX and PCI DSS. The interesting problems are always further down, in the implementation.

  • Identity Lifecycle and Governance

    Joiner-mover-leaver as an engineering problem, not a ticket queue. Provisioning and deprovisioning over SCIM, access reviews that produce evidence instead of spreadsheets, and governance for the service accounts nobody remembers owning. Granting access is the easy half. The hard half is proving the removal actually happened, inside the window you promised the auditor.

  • Authentication and Access Design

    Policy, factors, and privilege, in the order they have to happen. Authentication policy, phishing-resistant factors, privileged access, and the Zero Trust patterns from NIST 800-207 applied to environments that already exist and cannot stop working. Moving an entire workforce off passwords and SMS is less a technology decision than a sequencing one, and the sequence is where most rollouts stall.

  • Automation With an Identity Model (n8n, Okta Workflows, AI agents)

    Every workflow holds a credential, which makes every workflow an identity. Process automation built with scoped credentials, rotation, and audit logging from the first version rather than the third. Treating a workflow as an identity is the whole difference between an automation and an access path nobody is watching, and it costs almost nothing when you do it at the start.

Perspectives.

Writing on identity engineering, lifecycle automation, and the security questions that get skipped when automation moves faster than governance. The earlier essays cover fundamentals, NIST CSF and the RMF and the eight domains, which are still the groundwork for everything after them.

The Automation That Removes Access Is the Most Dangerous Thing You'll Build

The Secrets Manager Combination Nobody Ships Yet

A trending language is not a migration plan

AI coding agents are unmanaged identities

The AI cybersecurity arms race

The NIST Risk Management Framework

Implementing the NIST Cybersecurity Framework

The eight domains of cybersecurity

Cybersecurity is more than just a buzzword

See all writing →

Get in Touch.

Questions about identity engineering or automation, speaking and podcast invitations, or a note on something I wrote. I read everything and answer when I can.