DAC8 Due Diligence: Self-Certification and User Onboarding Data Changes
DAC8 pushes tax-residence and TIN collection into your onboarding flow. Retrofit the data model and validation now, so users arrive reportable instead of leaving gaps to chase.
Pillar: Pillar 10 - Identity & Access Control
Pillar 10 · Operate
Privileged Access Management Under NYDFS: Meeting the New Access-Governance Bar
The amended NYDFS Section 500.7 pushes firms from standing admin rights toward least-privilege, just-in-time access. A reference pattern for the architecture and the review evidence a supervisor will ask for.
Age Assurance for the Children’s Online Privacy Code and Social Media Minimum Age
Australia’s under-16 social media rules and forthcoming children’s privacy code force platforms to build age assurance that is both effective and privacy-preserving. Here is how to do it without an identity-collection honeypot.
Relying-Party Registration and the Trust List: The Plumbing Behind EUDI Wallet Acceptance
Accepting the EUDI Wallet is not an API integration you switch on. You first have to register as a relying party and verify every counterparty against the trust list. Here is the plumbing.
Wallet-Based Strong Customer Authentication: Where EUDI Meets PSD2/PSD3 KYC
The EU Digital Identity Wallet can carry high-assurance identity into onboarding and strong customer authentication. A pattern for placing it in your identity architecture without ripping out KYC that works.
Accepting the EUDI Wallet: The Relying-Party Integration Every Bank and Platform Faces by 2027
Obliged relying parties must accept the EU Digital Identity Wallet by around late 2027. This is an OpenID4VP integration and a trust-list problem, not a compliance memo.
Migrating a Fleet From SSH Passwords to Key-Only Auth Without Locking Anyone Out
Switching off SSH password auth before keys are proven is how you brick a fleet. The safe order: distribute keys, verify every login on every host, keep a break-glass path, then disable passwords last.
Bulk Active Directory Cleanup With PowerShell: Finding and Disabling Stale Accounts
Find dormant Active Directory users and computers on LastLogonTimestamp, then disable, quarantine and log them with a dry-run and a full audit trail in PowerShell.
Why I Switched All My Git Remotes From HTTPS to SSH (and the One Case Where HTTPS Still Wins)
A hands-on decision on git SSH vs HTTPS auth: token rotation churn, corporate MITM proxies, a per-host ~/.ssh/config, and the one case HTTPS still wins.
Agent Identity with OAuth Token Exchange (RFC 8693) for MCP Access
Agents sharing a static API key are unattributable and over-privileged. RFC 8693 token exchange gives each agent a delegated, audience-scoped identity that carries the on-behalf-of chain into every MCP call.