Identity & Access

Tokens, Conditional Access, and proving who is really signing in. The control plane every attacker eventually targets.

Token binding, primary refresh tokens, session keys, and defending against replay.

Policy design, coverage gaps, and defensible enforcement scoping.

Auth methods, registration gaps, and the road to passwordless.