Practitioner thinking, from the people doing the work.

For decades, enterprise automation has followed a simple principle. If a business process could be mapped in advance, it could be automated. Workflow engines, business rules, approval systems, and orchestration platforms transformed how organisations operate by taking predictable work and executing it consistently at scale. That model remains incredibly effective. But it has limits. Many of the most valuable activities inside an enterprise cannot be fully mapped in advance. F

Abstract Keycloak is an open-source identity and access management platform that provides authentication, authorization, single sign-on (SSO), identity federation, user management, and token-based security services for applications and APIs. It enables organisations to centralise identity functions while supporting standards such as OpenID Connect, OAuth 2.0, and SAML. Keycloak gives engineering teams deep control over identity infrastructure. That control is one of its great

Abstract Keycloak deployments often begin well. They pass user acceptance testing, perform acceptably in staging, and go live without visible issues. The problems usually appear later: session state becomes inconsistent under load, Kubernetes maintenance disrupts authentication, cache replication behaves unpredictably, or a regional failover exposes assumptions that were never tested. For production environments where authentication is critical infrastructure, Keycloak must b

Abstract An agent identity model is the design that defines how a system proves which agent is acting, which user the agent is acting for, what authority the agent has, and how that authority is preserved across downstream calls. In agentic AI systems, delegation solves one major identity problem: it preserves the original human user context across agent-to-agent chains. Delegation means that an agent acts on behalf of a user while the token still preserves both identities: t

Abstract Agentic AI systems introduce an identity problem that becomes visible when agents begin calling other agents. In a simple single-agent model, OAuth2.1 authorisation can capture user consent and issue a scoped access token to one agent. That model works when the user is present, the same agent requests and uses the token, and the scope of the action is known at consent time. Multi-agent systems break these assumptions. A user may interact with one orchestrating agent,

Abstract Agentic AI systems introduce an identity problem that traditional infrastructure was not designed to fully solve. When a software agent acts autonomously, querying APIs, invoking tools, calling services, or coordinating with other agents — the identity question is not only: “What workload is making this request?” The more important question becomes: “Which human authorised this action, through which agent, for what purpose, with what scope, and can that be proven at