Long-form writing
on identity engineering.

Buying Guide / Security · 7 min read

What to Ask Any Identity Vendor Before You Sign

The questions that separate a rehearsed demo from a mature identity platform: about isolation, key rotation, revocation, and what a vendor won't promise.

Integration / Buying Guide · 7 min read

Choosing Between Hosted and Embedded Login: The Trade-Off Nobody Explains

Hosted login keeps credentials off your domain; embedded login gives you the pixel. The real trade-off is whose attack surface you're actually equipped to defend.

Standards / Passkeys · 7 min read

What Passkeys Actually Change, and What They Don't

Passkeys remove phishing and credential reuse by construction. They don't fix recovery, session handling, or authorization. What actually changes, and what still needs scrutiny.

Security / Multi-Tenant · 7 min read

How Tenant Isolation Should Be Enforced, and How to Tell Whether a Vendor Really Does It

Tenant isolation claims are universal; the mechanism behind them isn't. How isolation should be enforced, and the one question that reveals whether a vendor actually does it.

Engineering / Reliability · 7 min read

What 'Fail Visibly' Means, and Why Silent Fallbacks Are Dangerous in Authentication

Fail visibly means a missing security config stops the service instead of quietly defaulting. Why silent fallbacks are more dangerous in authentication than an outage.

Accessibility / Trust · 7 min read

Why We Refuse a Brand Palette That Fails Contrast

We refuse to publish a tenant's brand color if it fails WCAG AA contrast, with no override. What that non-negotiable gate says about which vendor claims are actually enforced.