Notes on identity, access, and authorization, and how AI challenges the existing stack.

• Mapping RAR to AuthZEN with COAZ

  October 20, 2026 · 9 min read

• An official home for the AuthZEN OAuth issuance profile family

  September 2, 2026 · 3 min read

• A RAR entry is a product

  September 2, 2026 · 6 min read

• Claims enrichment is a search

  August 6, 2026 · 15 min read · Policy at the token endpoint, part 5

• The answer is not a boolean

  August 4, 2026 · 13 min read · Policy at the token endpoint, part 4

• Two questions, not one

  July 30, 2026 · 11 min read · Policy at the token endpoint, part 3

• The decision every OAuth spec declines to make

  July 29, 2026 · 12 min read · Policy at the token endpoint, part 2

• Scopes are still not permissions. But the token isn't going away.

  July 28, 2026 · 11 min read · Policy at the token endpoint, part 1