Blog
Notes from the build
How to give a contractor temporary Azure access (with PIM, not a standing role)
The safe way to give a contractor temporary Azure access using Entra ID Privileged Identity Management or a time-limited guest invite, instead of a permanent role assignment.
How to give a contractor temporary GCP access (without a service account key)
The safe way to give a contractor temporary Google Cloud access with service account impersonation or a time-bound IAM condition, and why handing over a key is the wrong move.
How to monitor AI agent behavior in your cloud
What to log for AI agents, which anomalies to watch for, why cloud audit logs alone aren't enough, and how to stop a destructive agent session as it happens.
How to manage cloud access for a small team (no VPN, no enterprise PAM)
A practical way to manage cloud access on a small team: individual identities, least privilege, access that expires, and watching what sessions do, without a VPN or enterprise PAM.
Offboarding an engineer from AWS: the access IT checklists miss
Why disabling SSO doesn't revoke an engineer's AWS access, the IAM keys, sessions, and tokens people forget, and how to make offboarding a non-event.
Offboarding an engineer from Azure: the access checklists miss
Why disabling an Entra ID account doesn't revoke Azure access, the sessions, service principals, and secrets people forget, and how to make offboarding a non-event.
Offboarding an engineer from GCP: the access checklists miss
Why suspending a Google Workspace account doesn't revoke GCP access, the service account keys and IAM bindings people forget, and how to make offboarding a non-event.
What is the four-eyes principle? (dual control for cloud teams)
A plain definition of the four-eyes principle, how it relates to dual control, where to apply it in a cloud team, and how to use it without becoming a bottleneck.
What permissions should an AI agent have in your cloud?
How to scope cloud permissions for an AI agent: its own identity, read-only by default, least privilege, why scoping isn't enough on its own, and time-bound access.
Do you need a PAM tool? Privileged access management for small teams
What privileged access management (PAM) is, what a PAM tool actually does, how it differs from IAM, and whether a small cloud team needs one or a lighter option.