Uploaded August 2026 | Updated September 2026, 2 weeks ago
Jeff and Jim open with the unavoidable topic of AI agents and the tension between enabling innovation and governing agent permissions, then run through a packed fall conference schedule. The August mailbag pulls questions from Singapore, Toronto, Prague, Johannesburg, Helsinki, and Seoul. They discuss when externalized authorization makes sense, why passkey recovery can become the weak link in phishing-resistant authentication, what EU digital identity wallets may mean for enterprises, how continuous access evaluation changes the meaning of terminating access, and how to build resilience around a centralized identity provider without creating a second full-scale IdP. The episode closes with a lighter question: if every IAM product needed a giant warning label, what should it say?
Connect with us on LinkedIn:
Jim McDonald: linkedin.com/in/jimmcdonaldpmp
Jeff Steadman: linkedin.com/in/jeffsteadman
Visit the show on the web at idacpodcast.com
00:10 - Welcome and have we talked about AI too much?
01:32 - Governing AI agents without becoming the progress prevention department
03:50 - Fall conference season and IDPro
04:40 - Cybersecurity Summits in Chicago and Atlanta
06:40 - SailPoint Navigate, InfoSec World, FIDO Authenticate, and Identiverse DC
10:40 - 3D printing, challenge coins, and superfan status
11:56 - August mailbag begins
12:19 - Singapore: Is externalized authorization ready for mainstream IAM?
20:30 - Toronto: Passkeys, account recovery, and help desk social engineering
25:55 - Prague: What should enterprises do about EU digital identity wallets?
31:44 - Johannesburg: Continuous session revocation and what “terminate access” really means
38:04 - Helsinki: Designing identity resilience around a centralized IdP
45:23 - Seoul: What warning label should every IAM product have?
48:26 - Wrap-up and how to send future mailbag questions
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, IAM, identity and access management, August 2026 mailbag, externalized authorization, authorization, policy-based access control, passkeys, account recovery, phishing-resistant authentication, identity verification, EU digital identity wallet, continuous access evaluation, shared signals, session revocation, token revocation, identity resilience, identity provider, disaster recovery, business continuity, AI agents, agentic identity, IDPro, FIDO Authenticate, Identiverse DC, InfoSec World, SailPoint Navigate
Jeff and Jim open with the unavoidable topic of AI agents and the tension between enabling innovation and governing agent permissions, then run through a packed fall conference schedule. The August mailbag pulls questions from Singapore, Toronto, Prague, Johannesburg, Helsinki, and Seoul. They discuss when externalized authorization makes sense, why passkey recovery can become the weak link in phishing-resistant authentication, what EU digital identity wallets may mean for enterprises, how continuous access evaluation changes the meaning of terminating access, and how to build resilience around a centralized identity provider without creating a second full-scale IdP. The episode closes with a lighter question: if every IAM product needed a giant warning label, what should it say?
Connect with us on LinkedIn:
Jim McDonald: linkedin.com/in/jimmcdonaldpmp
Jeff Steadman: linkedin.com/in/jeffsteadman
Visit the show on the web at idacpodcast.com
00:10 - Welcome and have we talked about AI too much?
01:32 - Governing AI agents without becoming the progress prevention department
03:50 - Fall conference season and IDPro
04:40 - Cybersecurity Summits in Chicago and Atlanta
06:40 - SailPoint Navigate, InfoSec World, FIDO Authenticate, and Identiverse DC
10:40 - 3D printing, challenge coins, and superfan status
11:56 - August mailbag begins
12:19 - Singapore: Is externalized authorization ready for mainstream IAM?
20:30 - Toronto: Passkeys, account recovery, and help desk social engineering
25:55 - Prague: What should enterprises do about EU digital identity wallets?
31:44 - Johannesburg: Continuous session revocation and what “terminate access” really means
38:04 - Helsinki: Designing identity resilience around a centralized IdP
45:23 - Seoul: What warning label should every IAM product have?
48:26 - Wrap-up and how to send future mailbag questions
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, IAM, identity and access management, August 2026 mailbag, externalized authorization, authorization, policy-based access control, passkeys, account recovery, phishing-resistant authentication, identity verification, EU digital identity wallet, continuous access evaluation, shared signals, session revocation, token revocation, identity resilience, identity provider, disaster recovery, business continuity, AI agents, agentic identity, IDPro, FIDO Authenticate, Identiverse DC, InfoSec World, SailPoint Navigate
