As data flows from one place to another, across boundaries, it is controlled. Who can request data, and who can respond with data is all based on identities.
You login to a server, or access your bank statement. Whatever you can do or see is decided on the basis of an identity.
As an example, I remember that as a young man, I walked into a bank office and the teller would already know who I was and what I came for. From how I looked and walked, they established my identity, derived my authorization from that and handed me my money. I only needed to sign at the dotted line.
These days, we log in to e-banking, and the physical element is reduced to the bank trusting the 2FA device you use for authenticating yourself. In a digital world, identity is mostly established through digital means, not physical.
And it is the identity provider, not you, who makes the call on your identity.
It is not just people who have identities with rights. In a cloud world, and even more so in an agentic AI world, there is something that can act on your behalf, as an agent. The simplest example is a script or bot that runs at midnight, searches the internet, and installs or updates software, while you sleep. Does it have your access rights? More? Less?
Does it have an identity on its own? It should, otherwise it will be hard to allocate access rights to it.
What happens when we scale this up? We need to be able to efficiently talk about identities, boundaries, access rights, and who controls these, at scale.
Let’s start with identities, and how they are built up.