IGA focuses on managing and governing digital identities and their access rights within an organization. It ensures proper identity lifecycle management, entitlements, compliance, and role-based access controls (RBAC).
We can clearly recommend this technology. It has been used for longer period of time at many customers and it has proven to be stable and useful.
Cloud Infrastructure Entitlement Management (CIEM) is a category of security technologies and practices designed to manage, analyze, and govern identities, access rights, and permissions within cloud environments. CIEM addresses the complexity of modern cloud platforms, where large numbers of human and machine identities interact with highly granular and rapidly changing cloud services.
Identity Proofing establishes that a claimed identity belongs to the person claiming it, before any credential is issued against it: evidence is collected, validated against the source that issued it, and verified as belonging to the applicant. The evidence is classically a passport, increasingly a digital credential from a wallet. Every control layered on top inherits that one decision, because a phishing-resistant credential bound to the wrong human is a strong credential for an impostor, and nothing about the sessions that follow looks anomalous. Two problems dominate the discipline. Synthetic media is cheap, so the question is not only whether a document is forged but whether the camera saw a person. And the same decision recurs whenever a credential is recovered rather than issued, usually on far weaker evidence than enrolment demanded.
Policy-Based Access Control (PBAC) is an access control model in which a policy decides each request at the moment it is made, instead of the application checking an entitlement that someone granted in advance. The rules live in one governed place rather than in the code of every application, and they can combine roles (Role-Based Access Control, RBAC), attributes of the user, the resource and the context (Attribute-Based Access Control, ABAC), and relationships between them (Relationship-Based Access Control, ReBAC). Organizations turn to PBAC when role-based access has grown into more roles than anyone can review, and it moves the hard part of authorization from granting access to keeping accurate the attributes that policies read.
The System for Cross-domain Identity Management (SCIM) is an open standard protocol for automating the exchange of identity information between identity providers and the applications that hold user accounts. SCIM 2.0, an IETF Proposed Standard defined in RFC 7643 (core schema) and RFC 7644 (protocol), gives provisioning a common REST API and a common user and group schema, so that accounts can be created, changed and deactivated in each application without a separate integration per application. It is the protocol that turns a leaver in the HR system into a disabled account everywhere, which single sign-on on its own does not do.
Workload and Machine / Non-Human Identity (NHI) Management is the practice of issuing, renewing, and revoking identities and credentials for everything that authenticates without a person at the keyboard: microservices, continuous integration and delivery (CI/CD) pipelines, cloud service accounts, Internet of Things (IoT) devices, and other automated workloads. These identities outnumber human ones in most environments, and the static keys and passwords traditionally behind them are among the most exploited paths into a system. Workload identity frameworks such as the Secure Production Identity Framework for Everyone (SPIFFE) replace them with short-lived, attested credentials used over mutual TLS or OAuth 2.1 client credentials. Autonomous AI agents introduce non-determinism and recursive delegation on top of these primitives, which the radar covers through the AI Agent Registry and Lifecycle for per-instance identity and provisioning, and OAuth Token Exchange and Identity Chaining for carrying user context across delegation hops.
We have used it with success and recommend to have a closer look at the technology in this ring. The goal of items here is to look at them more closely, with the goal to bring them to the adopt level.
An AI Agent Registry is the authoritative inventory of the agents operating in an environment, recording which agents exist, what identity each holds, which runtime instance it maps to, and where it sits in its lifecycle from provisioning through decommissioning. It is the least novel and most immediately actionable part of agent identity: the first governance problem organizations encounter is the inability to enumerate what they are running, well before any question of delegation. Registries supply the discovery layer that A2A Agent Cards are published against, the subject data that policy-based access control (PBAC) policies evaluate, and the inventory that posture and audit tooling consumes.
Policy as Code (PaC) manages access policies the way software is managed. Policies are written in a declarative policy language, kept in version control, tested automatically and released through a pipeline to the decision points that enforce them, instead of being edited in an administration console. What an organization gains is control over change: every change to who may do what has an author, a reviewer and a test run, the decision points run a known version, and a bad change is undone by releasing the previous one. The price is that the repository becomes part of the access control system, and the right to merge into it is a right to grant access.