Strong Customer Authentication Under PSD3/PSR: What Changes in Your Auth Stack
PSD3 and the PSR refine SCA, delegated authentication and accessibility. A practitioner’s guide to what to refactor in your auth stack and what survives from PSD2.
Pillar: Pillar 10 - Identity & Access Control
Pillar 10 · Operate
Issuing Qualified Electronic Attestations of Attributes: Becoming a QEAA Provider in the Wallet Ecosystem
Businesses can issue attestations such as membership, licence or employment into users’ EUDI Wallets, but the qualified route means becoming a trust service provider. Here is what the QEAA path actually commits you to.
Selective Disclosure and the EUDI Wallet: Verifying Age or Status Without Harvesting Identity
The EUDI Wallet lets verifiers confirm age or status without collecting full identity. A hands-on look at building SD-JWT and mdoc selective-disclosure flows that request only the attribute you need and log lawfully.
Workload Identity With SPIFFE/SPIRE: Killing Static Service Credentials
Shared service credentials are the secret that eventually leaks and cannot be attributed. SPIFFE and SPIRE give every workload a short-lived, cryptographically attested identity so services authenticate on proven identity, not a stored password.
The DOJ Data Security Program: Engineering Controls for Restricted and Prohibited Data Transactions
The DOJ Data Security Program is an access-governance and data-lineage build. You cannot block a prohibited transfer you cannot see, and reconstructing lineage after enforcement starts will not do.
New Zealand’s Biometric Processing Code: Governing Facial Recognition and Voiceprints
New Zealand’s Biometric Processing Privacy Code sets proportionality, transparency and use limits for facial and voice technology. Existing deployments must comply by 3 August 2026.
The Digital ID Act 2024 and the Australian Government Digital ID System: Private-Sector Onboarding
As the Australian Government Digital ID System opens to the private sector, firms can consume assured identities to cut bespoke KYC rather than rebuild verification in-house. A design and integration reading.
The Statutory Tort of Serious Invasion of Privacy: Engineering to Reduce Exposure
Australia’s new statutory tort lets individuals sue directly for serious invasions of privacy. That makes access controls, data minimisation and monitoring governance liability controls, not just compliance hygiene.
Building an SSH Bastion Host: One Auditable Front Door Into a Private Network
Stop exposing every server’s SSH port. Build one hardened, logged bastion with ProxyJump, short-lived SSH certificates and nftables so keys never land on the jump host.
Attribute-Based Access Control With OPA: Replacing the Role Explosion
Role-based access control collapses as roles multiply to encode every exception. Attribute-based access control with Open Policy Agent computes decisions from data tags, user attributes and request context against written policy.