Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Notebook
Identity × Security
Who or what is acting — users, service accounts, devices, AI agents. · Protect it — hardening, least privilege, detection, evidence.
Opinion notes
The CyberArk you don't have to buy
Completing an open-source identity stack with governance and privileged access — and why an AI coding agent finally makes it cheaper than CyberArk.
Nobody holds an SSH key here, including me
A private CA as the single SSH trust root: short-lived certs for humans (SSO+MFA), 10-minute ones for machines, and host certs that kill known_hosts TOFU.
Idea notes
The confused deputy comes for your AI agents
When an orchestrator agent delegates to a sub-agent, it can quietly hand over a token that does far more than the sub-agent should. Here's the token-chain risk, IBM and Red Hat's Kagenti blueprint, and a zero-trust pattern you can run without re-platforming onto Kubernetes.
Idea notes
Could open-source IAM replace Active Directory and Entra ID?
Where midPoint plus Authentik can replace the Microsoft identity stack in a hybrid Windows/Linux shop. And where it can't. A thought experiment, not a build.
Giving an AI agent the keys, safely
Wiring our identity agent into a secrets manager without handing it the kingdom: read-only by default, segregation of duties, and writes you have to mean.
Skills, MCP, and where the credentials belong
A simple question (do our agents need MCP?) that quietly turned into a clearer picture of skills, MCP servers, and the identity layer sitting underneath both.
A Cisco ISE MAB fallback that won't lock you out
A critical-auth VLAN so a dead RADIUS server doesn't take a whole floor offline.