Opinion notes
AI is humanized compute
AI isn't a new domain, it's compute grown up enough to act. Treat it like staff: a broad junior, always inside a human accountability tree, carrying its own papers.
Notebook
Identity
Who or what is acting — users, service accounts, devices, AI agents.
Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Idea notes
The shape of identity in a business
Identity is the control plane for who and what can do what. The trick to keeping it sane: nest accounts into groups and roles, and never pin a permission on a user.
Opinion notes
The CyberArk you don't have to buy
Completing an open-source identity stack with governance and privileged access — and why an AI coding agent finally makes it cheaper than CyberArk.
Nobody holds an SSH key here, including me
A private CA as the single SSH trust root: short-lived certs for humans (SSO+MFA), 10-minute ones for machines, and host certs that kill known_hosts TOFU.
Opinion notes
Expert hands, junior judgment
Implementing AI isn't buying a tool. It's staffing a team: expert at the task, junior at the call. Why that reshapes hiring, not just headcount.
Idea notes
The confused deputy comes for your AI agents
When an orchestrator agent delegates to a sub-agent, it can quietly hand over a token that does far more than the sub-agent should. Here's the token-chain risk, IBM and Red Hat's Kagenti blueprint, and a zero-trust pattern you can run without re-platforming onto Kubernetes.
Idea notes
Could open-source IAM replace Active Directory and Entra ID?
Where midPoint plus Authentik can replace the Microsoft identity stack in a hybrid Windows/Linux shop. And where it can't. A thought experiment, not a build.
Giving an AI agent the keys, safely
Wiring our identity agent into a secrets manager without handing it the kingdom: read-only by default, segregation of duties, and writes you have to mean.
How the agent fleet is wired, in five layers
From a typed request to a guarded action against a real system, a walk down the stack that turns Claude Code into a fleet of homelab operators: the CLI, the shared agent-core, the agents, their skills, and the actions they perform.
Skills, MCP, and where the credentials belong
A simple question (do our agents need MCP?) that quietly turned into a clearer picture of skills, MCP servers, and the identity layer sitting underneath both.
A Cisco ISE MAB fallback that won't lock you out
A critical-auth VLAN so a dead RADIUS server doesn't take a whole floor offline.