Generative Identity Through the Triad

Install the predict-effective-access reflex and a withholding config that defaults your assistant to coaching the access reasoning, so you never apply a grant whose true reach you cannot trace.

Configure the assistant to refuse a finished role, policy, or grant for anything consequential and instead ask the senior questions — who is the principal (human, machine, or agent), what resource and action, what transitive reach, standing or just-in-time, what deprovisioning path, what breaks if over-granted. Predict effective access by hand, run the What-If tool or policy simulator, then trace. Authentication is not authorization; disabling an account is not revoking its sessions; a role's power is its transitive reach, not its name.

Read a supplied Conditional Access policy and a nested-group RBAC assignment cold — who is admitted, what is permitted, the highest-privilege path it opens — then run the What-If / simulation and trace. Write your withholding config: senior access questions by default, forbid privileged roles / broad app permissions / tenant-wide CA as finished config, require every grant to state scope, expiry/JIT, and deprovisioning path, re-state least-privilege each session.

If you could not trace the escalation path in the cold read, the diagnostic worked. If your config lets the model emit a standing privileged grant without an expiry, it has no teeth.

Install the gate that proves an AI-generated grant least-privilege before it goes live, scored against a fixed taxonomy — and dismantle the most common false sense of security in identity.

When a generated role ships a wildcard action, an app requests tenant-wide read/write, or a CA policy locks out the only admin who can fix it, the consequence is yours. The myth that has to die: “we have MFA, so we're covered.” Legacy second factors fall to adversary-in-the-middle, push fatigue, and token replay; only phishing-resistant MFA (FIDO2/passkeys, certificate-based) bound to device and origin holds. The defense stack: least privilege by simulation, JIT/PIM, CIEM, phishing-resistant authentication strength, no standing secrets, break-glass discipline.

Harden one generated identity change (a Conditional Access policy plus an app registration and a role assignment) through the gate: failure modes present, the highest-privilege grant and its simulation, where any secret lives and its federated/managed-identity fix, whether break-glass survives the policy, and whether “MFA” is specified as phishing-resistant.

If your policy says “require MFA” without authentication strength, name the gap. If the change excludes no break-glass account, simulate it against your admins before it ships — a lockout is an outage you inflicted.

Arm your identity rituals so each surfaces privilege drift — and design the gate that governs autonomous identity automation and AI agents as first-class identities.

Identity drifts when nothing changes: the mover who accumulates entitlements and never sheds the old, the orphaned account, the service principal whose secret outlived its purpose, the agent that holds one-task access forever. Govern every agent and NHI as a first-class identity — unique credential, least privilege, named owner, lifecycle, full attribution. The autonomous-governance trap: a bot auto-revokes break-glass mid-incident because it cannot tell documented access from drift. The fix is the decision record — and here the REVIEW clause and access recertification are the same record. The automation reads open ODRs/recertifications before it revokes, and emits an AgODR per change.

Arm one identity ritual with a single offensive move and test it (surfaces standing-access drift? gameable like a rubber-stamped review? adds a meeting or modifies one?). Then design the autonomous-governance gate: what it reads before revoking, the AgODR fields it emits, and the blast-radius tiers — with privileged and break-glass changes always gated.

If your governance gate has no “check open ODRs/recertifications first” step, you built the automation that revokes break-glass mid-incident. If your recertification is a rubber-stamp, it is sentiment theater wearing a compliance badge — make revocation the default for the unjustified.

Design the 60-day install of all three lenses over a real (or supplied) identity estate, covering both directions — AI-generated access and AI agents as identities — then defend it before a panel in the CTRL ALT PRESS voice.

A regulated enterprise runs Entra ID with on-prem AD and ADFS federation, 1Password for secrets, provisioned via Terraform/Ansible. A recent generated CA policy nearly locked out the admins, and an app secret was pasted into a chat. The org is piloting AI agents that need access to internal systems. Leadership believes “we have MFA, so we're covered.” 60 days, no new headcount, you may not stop the team using AI or deploying agents.

• The withholding config (Apprentice) and the predict-What-If-trace drill, with the grant classes it forbids generating.
• The defense stack (Defense): least-privilege-by-simulation, JIT/PIM, CIEM, phishing-resistant authentication strength, no-standing-secrets, break-glass discipline — and the explicit retirement of “MFA = covered.”
• The agent-as-governed-identity model and the autonomous-governance gate that reads ODRs/recertifications and emits AgODRs.
• The recertification program wired to the REVIEW clause, with revocation as the default for unjustified standing access.
• The 60-day behavioral markers, with “we have MFA so we're covered” and “the model wrote the policy” both banned.

Pass ≥ 18/30; distinction ≥ 24 with no dimension below 3.