The Identity Navigator

Rohit Agnihotri

Welcome to "The Identity Navigator," your compass in the world of Identity and Access Management (IAM). Join us as we navigate the complexities of digital identity, security, and access control. Stay informed with expert insights, industry trends, and practical tips to safeguard your organization's digital assets. Whether you're new to IAM or a seasoned pro, tune in to unlock the strategies that will elevate your security posture. Subscribe to The Identity Navigator podcast and chart your course to secure, efficient IAM solutions.

  1. 4d ago

    #45 - Should You Block AI Agents? OAuth, MCP, and Who Gets In

    Should you block AI agents? This episode answers it from the identity chair, and it starts with MCP authorization explained from zero. If you've heard "MCP authentication" and "OAuth" in the same breath all year and never quite connected them, this episode does it step by step. We starts with OAuth 2.1 from scratch (what the roles are, what a token actually is, why it's not login), then MCP from scratch (what the Model Context Protocol is, local versus remote servers, why an AI agent is unlike any API client you'vesecured before), then walks the full MCP authorization handshake with the July 28, 2026 spec open: the 401, Protected Resource Metadata, Client ID Metadata Documents, PKCE, resource indicators, issuer validation, audience binding,step-up scopes, and the two rules that matter most. Then why this lands on the identity leader's desk, and the question the CISO will actually ask: do we let agents in at all? We walk the block-or-admit debate, the August 2026 Ninth Circuit ruling in Amazon v. Perplexity, why the fraud bouncer can't tell a goodagent from an account-takeover bot, the screen-scraping-to-open-banking precedent, what Reg E and Reg Z do with "my agent did it," the managed-delegation posture (block anonymous agents, admit authenticated ones),and the two controls to turn up now, step-up authentication on anything that moves money and behavior baselining for the agent itself. Then gotchas, anti-patterns, and a Monday list. T Why this episode now OAuth has never been easier to learn, and MCP authorization guides exist, mostly written for developers building servers. This episode connects the two from the identity practitioner's chair: a six-minute OAuth refresher, MCP from zero, the handshake told as one scene (an intern walking up to room 412), what it changes about running an identity platform, the block-or-admit question for customer-facing agents, and why every change in the MCP spec this year was an OAuth lesson from years ago. Thank you for listening LinkedIn: https://www.linkedin.com/in/rohit-agnihotri Email: theIdentityNavigator@gmail.com

  2. Oct 11

    #44 - The Badge That Printed Itself: The SharePoint Token Forgery, Decoded (CVE-2026-55040)

    The Badge That Printed Itself: A SharePoint TokenForgery, Decoded Word by Word One line from my morning threat intel digest: “CVE-2026-55040. Critical. CVSS 9.1. SharePoint on-prem authentication bypass, under active exploitation.” This episode stops and takes the whole sentence apart, from first principles, until it reads likeplain English. Then we walk the heist: how a stranger with no account and no password handed SharePoint a homemade admin token, and SharePoint said welcome back. In this episode: Decoding the line: CVE, CVSS, KEV, on-prem, auth bypass, PoC, and why an n-day means the attacker is racing your change boardWhat a token is, explained so the bug becomes obviousThe heist in four dominoes: alg “none”, the x5t pointer aimed at SharePoint’s own certificate, circular trust, and a signature that just says “AAAA”Textbook Swiss cheese, and why four checks that share one assumption are really one checkWhy forged tokens are quieter than stolen ones, and the three places you can still catch themThe out-of-the-loop identity platform: your MFA and conditional access were never beaten, they were never askedShould you ever roll your own token validator? The steelman, the verdict, and the architecture I’d build instead LinkedIn: ⁠https://www.linkedin.com/in/rohit-agnihotri⁠Email: theIdentityNavigator@gmail.com

  3. Sep 5

    #43 - Verified, Authorized, and Compromised: The Return of the Air Gap

    Three labs. Five breached companies. One testing vendor named Irregular. This summer handed identity and security practitioners a masterclass in what happens when AI agents hit environments that weren't built for them. Not through sophisticated cyberattacks. Through configuration mistakes, weak passwords, and an optimizer that found a shortcut through Hugging Face's production infrastructure because the answer key wasn't in the sandbox. In this episode, I walk through all three incidents - OpenAI's ExploitGym escape, Anthropic's 141,006-evaluation audit, and the invisible HTML comment that turns your developer's AI assistant into an insider threat. Then I go somewhere the coverage hasn't: what the narrative around these incidents is doing to how practitioners make decisions, and why fear and FOMO are the same emotiondepending on which side of the paywall you're standing on.   Then we get practical. The identity air gap isn't about going back to 2003. It's about protecting the quality of your strongest signal, in a decision control plane that evaluates attributes like provenance, location, and device posture to produce a fidelity assessment. Agents introduced an attribute nobody was capturing. This episode is about capturing it.   Separate trust planes per environment. No credential valid in two worlds. Every crossing brokered, scoped, and provable end to end. Sever the path. Or make it provable.   Thank you for listening LinkedIn: https://www.linkedin.com/in/rohit-agnihotri Email: theIdentityNavigator@gmail.com

  4. Aug 16

    #42 PulseAI and the Hard Question: What Is Your AI Actually Doing

    Everyone is using AI. Almost nobody can prove what it’s doing. In this solo episode, we design a runtime AI governance platform from scratch on a whiteboard, and then meet PulseAI, the product IAM veteran Amit Masand built at IDMEXPRESS. With the numbers justifying the problem, an honest competitive map, who it’s not for, and a free AI-traffic risk assessment for listeners. Links PulseAI by IDMEXPRESS: idmexpress.aiCompany site: idmexpress.com)Amit Masand on LinkedIn: linkedin.com/in/amit-m-67b4692Contact: amit.masand@idmexpress.comListener offer: mention this episode for a complimentary risk assessment of your AI traffic, no commitment. Thank you for listening: Host's contacts LinkedIn: ⁠https://www.linkedin.com/in/rohit-agnihotri⁠Email: theIdentityNavigator@gmail.com

  5. Aug 4

    #41 - IGA or IdP? Who Provisions the New App - OIM, SailPoint, Saviynt, Entra, Okta

    Previously on The Identity Navigator (recommendedlistening before this episode): Episode 40: SCIM - The protocol that finally made provisioning grow up Every app you onboard forces a quiet architecture decision most teams never make explicitly: does provisioning belong to your IGA platform (OIM, SailPoint IIQ, Saviynt) or your IdP (Entra, Okta)? In this episode, I walk through the five questions that settle it - before the app lands in your ecosystem, not after. LinkedIn: https://www.linkedin.com/in/rohit-agnihotri Email: theIdentityNavigator@gmail.com

  6. Jul 5

    #40 SCIM - The Protocol That Finally Made Provisioning Grow Up

    0-40% of SaaS accounts in the mid-2000s belonged to people who'd already left the company. Ghost accounts, quietly sitting there — and that sadly hasn't changed much today. This episode: where SCIM came from, what it actually solves, and what it still doesn't. Core RFCs:RFC 7642 — SCIM: Definitions, Overview, Concepts, and RequirementsRFC 7643 — SCIM: Core SchemaRFC 7644 — SCIM: Protocol Key Terms Covered:SCIM 2.0 — System for Cross-domain Identity ManagementJML — Joiner-Mover-Leaver lifecycleIGA — Identity Governance and AdministrationIDP — Identity Provider (Okta, Entra ID, Ping, JumpCloud, OneLogin)JIT — Just-In-Time provisioningSPML — Service Provisioning Markup Language (the predecessor that didn't make it)PatchOp — SCIM's structured partial update formatServiceProviderConfig — SCIM's capability discovery endpoint Tools Mentioned:Identity Providers: Okta, Microsoft Entra ID, Ping Identity, JumpCloud, OneLogin, CyberArk IdentityIGA Platforms: SailPoint, Saviynt, IBM Security Verify Governance, Omada IdentityKey SCIM-enabled Apps: Slack, Salesforce, GitHub, GitLab, Workday, ServiceNow, Snowflake, Zoom, Box, AtlassianSCIM Validator:scimvalidator.net — for testing SCIM endpoint compliance LinkedIn: https://www.linkedin.com/in/rohit-agnihotri Email: theIdentityNavigator@gmail.com

  7. Jun 12

    #39 Tokens — The Complete Story

    The Complete Token Story Let me make you a promise: by the end of this episode, no one will be able to casually brush off the word “tokens” in front of you ever again. OAuth, Tokens, JWT, IAM, Identity, API Security, Zero Trust, Security Architecture, CISO, Engineering Leadership Thank you for listening LinkedIn: https://www.linkedin.com/in/rohit-agnihotri Email: theIdentityNavigator@gmail.com

  8. May 10

    #38 - The Basics of Workload Identity

    In this episode of The Identity Navigator, Rohit explores workload identity from first principles: what it is, why it matters, and how it is reshaping modern identity security for microservices, Kubernetes, CI/CD pipelines, cloud workloads, and AI agents. The discussion compares workload identity with non-human identity management, API keys, Vault, and cloud-native identity services, then goes deeper into SPIFFE, SPIRE, federation, and the future of identity in agentic systems. If you want a clear, practical explanation of workload identity and why it is becoming essential in zero trust architectures, this episode is for you. LinkedIn: https://www.linkedin.com/in/rohit-agnihotri Email: theIdentityNavigator@gmail.com

See All (46)

Trailer

About

Welcome to "The Identity Navigator," your compass in the world of Identity and Access Management (IAM). Join us as we navigate the complexities of digital identity, security, and access control. Stay informed with expert insights, industry trends, and practical tips to safeguard your organization's digital assets. Whether you're new to IAM or a seasoned pro, tune in to unlock the strategies that will elevate your security posture. Subscribe to The Identity Navigator podcast and chart your course to secure, efficient IAM solutions.

Information

  • Creator
    Rohit Agnihotri
  • Years Active
    2023 - 2026
  • Episodes
    46
  • Rating
    Explicit
  • Copyright
    © Rohit Agnihotri
  • Show Website
    The Identity Navigator