Every guide, in one place

A developer's guide to GDPR compliance

The first time a customer sends a security review, the instinct is to treat it as an obstacle.

A developer’s guide to startup security

Almost every incident worth writing about starts with something that was working exactly as designed.

A guide to organization modeling

The engineering questions that matter are rarely about which tool.

Authentication glossary

It is easy to read a specification and conclude the problem is solved.

Authentication vs. authorization

A design is a set of bets.

Authorization glossary

Compliance has a reputation for being paperwork.

Best practices for CLI authentication: A technical guide

It is easy to read a specification and conclude the problem is solved.

Best practices for MCP secrets management

The uncomfortable part of building for agents is that the old assumptions quietly stop holding.

Best practices for secrets management

Almost every incident worth writing about starts with something that was working exactly as designed.

Common SAML security vulnerabilities and how to defend against them

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

Crossing the Enterprise Chasm

The gap between selling to teams and selling to companies is not a pricing change.

DDoS attacks and botnets explained

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

Decoding and solving the five most common SAML errors

It is easy to read a specification and conclude the problem is solved.

Enterprise readiness checklist: Steps to scale your business

Moving upmarket is usually described as a go-to-market decision.

Every SCIM attribute explained

The value of a standard is that two parties who have never spoken can interoperate.

How SCIM provisioning works

It is easy to read a specification and conclude the problem is solved.

2 May 2025

How to build secure AI agents that are Enterprise Ready

The uncomfortable part of building for agents is that the old assumptions quietly stop holding.

How to get Enterprise Ready: Guide for SaaS product managers

The gap between selling to teams and selling to companies is not a pricing change.

How to get SOC 2 compliance: A developer’s guide

Auditors are not asking you to be perfect.

How to identity a phishing email

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

How to migrate enterprise SSO connections from Auth0 to Paycux

There is a specific moment when a deal stops being about your product.

How to pick an identity as a service (IDaaS) provider: A guide for busy startups

It is easy to read a specification and conclude the problem is solved.

How to write your first Service Level Agreement (SLA)

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

Implementation challenges of a homegrown SCIM solution

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

Implementing a generic SCIM client

The value of a standard is that two parties who have never spoken can interoperate.

JWT validation: how-to and best libraries to use

It is easy to read a specification and conclude the problem is solved.

Key differences between CCPA and GDPR: How location affects enterprise compliance

The first time a customer sends a security review, the instinct is to treat it as an obstacle.

Managing SAML X.509 Certificates

It is easy to read a specification and conclude the problem is solved.

MCP, ACP, A2A, Oh my!

Most of the difficulty with agents is not the model.

OpenID Connect vs. SAML

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

OTP bots explained: What they are and how to stop them

Almost every incident worth writing about starts with something that was working exactly as designed.

SAML vs OAuth: A technical guide

The value of a standard is that two parties who have never spoken can interoperate.

SCIM 2.0 vs SCIM 1.0: What’s the difference between the two versions?

It is easy to read a specification and conclude the problem is solved.

SCIM best practices

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

SCIM vs JIT: Key differences explained

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

SCIM vs SSO: What's the difference and how do they work together?

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

SCIM: What it is and how it works

The value of a standard is that two parties who have never spoken can interoperate.

Security policy document examples for B2B SaaS apps

Almost every incident worth writing about starts with something that was working exactly as designed.

Security threats in single-page applications and how to defend against them

Security work is mostly the business of removing footguns before someone finds them.

SOC 1 vs. SOC 2 vs. SOC 3: Why your company needs compliance to grow

The first time a customer sends a security review, the instinct is to treat it as an obstacle.

SSO best practices

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

The 4 main types of access control

A design is a set of bets.

The complete guide to OAuth 2.0

It is easy to read a specification and conclude the problem is solved.

The developer's guide to domain verification

A design is a set of bets.

The developer's guide to RBAC

The engineering questions that matter are rarely about which tool.

The developer's guide to user management

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

The developer’s guide to auth sessions

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

The developer’s guide to Directory Sync and SCIM

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

The developer’s guide to Fine-Grained Authorization (FGA)

The engineering questions that matter are rarely about which tool.

The developer’s guide to SSO

It is easy to read a specification and conclude the problem is solved.

UI/UX best practices for IdP & SP-Initiated SSO

Shipping is the easy half.

Understanding cross-site scripting (XSS) attacks

Security work is mostly the business of removing footguns before someone finds them.

Understanding CSRF attacks

Almost every incident worth writing about starts with something that was working exactly as designed.

Understanding the OAuth 2.0 Client Credentials flow

The value of a standard is that two parties who have never spoken can interoperate.

Unlocking the power of SCIM: streamlining enterprise user management

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

What are JSON Web Tokens (JWTs)?

It is easy to read a specification and conclude the problem is solved.

What are SCIM groups?

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

What does it mean to distill a machine learning model or LLM?

Agents changed the shape of the problem.

What is a brute force attack?

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

What is a SIM swapping attack?

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

6 May 2026

What is Attribute Based Access Control (ABAC)?

Auditors are not asking you to be perfect.

What is authentication (authN)?

Almost every incident worth writing about starts with something that was working exactly as designed.

What is authorization (authZ)?

Almost every incident worth writing about starts with something that was working exactly as designed.

What is CMMC 2.0 and who needs it?

The gap between selling to teams and selling to companies is not a pricing change.

6 May 2026

What is device fingerprinting and how does it work?

The engineering questions that matter are rarely about which tool.

What is email spoofing?

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

What is entitlement management? A guide to secure access

Compliance has a reputation for being paperwork.

What is federated identity?

Most systems do not fail because someone chose the wrong database.

What is fine-grained access control?

Most systems do not fail because someone chose the wrong database.

What is Google Zanzibar?

The engineering questions that matter are rarely about which tool.

What is ISO compliance?

The first time a customer sends a security review, the instinct is to treat it as an obstacle.

6 May 2026

What is Just-In-Time Provisioning and how do you use it?

It is easy to read a specification and conclude the problem is solved.

What is MFA, and why does your app need it?

Security work is mostly the business of removing footguns before someone finds them.

What is multitenant authentication?

It is easy to read a specification and conclude the problem is solved.

What is OpenID Connect (OIDC)?

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

What is password hashing?

Security work is mostly the business of removing footguns before someone finds them.

What is RBAC? How it works and when to use it

Almost every incident worth writing about starts with something that was working exactly as designed.

What is Relationship-Based Access Control (ReBAC)?

The engineering questions that matter are rarely about which tool.

What is SAML and how does it work?

It is easy to read a specification and conclude the problem is solved.

What is Single Logout?

Protocol work looks tedious from the outside and turns out to be where the interesting failures live.

What is the Model Context Protocol (MCP)?

Agents changed the shape of the problem.

What is user provisioning?

Compliance has a reputation for being paperwork.

When is it a good time to start enterprise sales?

There is a specific moment when a deal stops being about your product.

2 May 2025

Which authorization strategy is best for your app?

Most systems do not fail because someone chose the wrong database.