Identity conferences discuss wallets, proofing, AI, and future trust models. Many organizations are still dealing with duplicate accounts, legacy systems, and unclear ownership. This post is about why identity maturity is uneven, and why practical progress matters more than generic advice.

Wallet and digital credential adoption is accelerating through regulation, mobile IDs, and age assurance laws. That does not mean the market is mature. Standards remain unsettled, ROI is uneven, and trust models are still forming. Here's my latest take on what comes next.

Identity Systems Don’t Make Decisions Heather examines why identity systems do not actually make decisions on their own, and how enterprise security outcomes emerge from fragmented, distributed processes. By unpacking how identity, risk, and policy tools interact, this episode reframes modern…

What the AI Vendor Landscape Reveals About Fragmented Identity Systems Heather explores how the AI vendor landscape reveals deeper challenges in fragmented identity systems and enterprise security architecture. By examining how tools function across identity, signals, policy, and enforcement…

NEW BLOG: From CDT’s Nick Doty, “Distributing the Keys for Private Access to the Web.” Every lock needs a key – but encrypted DNS and Encrypted Client Hello (ECH) only work if users can obtain the configurations that enable them.

Your talk was accepted. Excellent. Now you get to navigate the *abundance* of advice on how to prepare. A few practical tips on what actually matters and how not to make things harder than they need to be.

“Think of the children!” is a powerful argument. But building age verification into the internet raises real questions for privacy and identity systems. I took a closer look at where age assurance stands today.

I am the adultiest adult to ever have adulted. Annual exam AND dental appointment all in one day! Wooooo! I am now going to go back to avoiding acting like a grown-up for the rest of the day. Neener neener!

When AI agents start buying things online, the web’s architecture gets interesting. Identity, payments, delegation, liability... all suddenly matter in new ways. A few thoughts on the emerging world of agentic commerce.

Just recorded (and now live!) on the IDAC podcast 🎙️ Thanks to Jeff and Jim for a sharp, enjoyable conversation. It’s always an honor to be on the best identity-focused podcast. www.identityatthecenter.com/listen/episo...

It’s a super low key day. Just ask my neighbors.

oooh, a second April 1st RFC! This is a subtle one: RFC 9949, BUSA-TLS: Mandatory Audio Component (MAC) Pre-Shared Key (PSK) Derivation for TLS 1.3 Using 2 Live Crew's "Banned in the U.S.A." www.rfc-editor.org/info/rfc9949

I wish there were a good answer here. The tension between competing regulations and what's technically possible makes this a nightmare for any company that has to deal with it. I do actually have a post coming out about it on April 14. (Sorry I didn't respond on thread; interaction was restricted)

I was worried we wouldn't see an April 1st RFC this year, but they've come through! RFC 9948: Internet Protocol Police (IPP) - Schedule of Punishments www.rfc-editor.org/info/rfc9948

Last time I asked whether AI-enabled browsers fit the W3C definition of a Web User Agent. Short answer: mostly yes. But that raises the more interesting question: What needs to change in the Web Platform Design Principles to make that answer a comfortable yes? Some thoughts.

Right now, we’re calling them “AI browsers.” But like most things labeled AI, that name probably won’t last. Soon they’ll just be… browsers. Which makes this question worth asking now: if a browser starts acting on your behalf, does it still fit the W3C definition of a Web User Agent? Maybe.

To all the independent journalists out there, a colleague of mine has a request, if you have a few minutes and are open to chat about your process:

The protective case for my new laptop arrives today, which leaves me with some very important decisions to make. What stickers go on the new case? (In addition to these two, of course)

There are oodles of great nuggets in the @aaronfrancis.com keynote from the Commit Your Code conference. Some that really resonate for tech blogging…

If you work in digital identity, you will eventually run into ISO and ISO/IEC work. This guide breaks down how ISO, IEC, and JTC 1 actually operate, and why participation and timelines often feel very different from more open SDOs.

Shopify is preparing for an ecommerce transformation via AI shopping agents, says president Harley Finklestein.

Poll: Nearly 1 In 10 Adults Have Postponed Retirement Due To Healthcare Costs https://theonion.com/poll-nearly-1-in-10-adults-have-postponed-retirement-due-to-healthcare-costs/

It’s pretty, but I’m glad I’m not outside.

How NOT to Get Your Conference Submission Binned Heather Flanagan explores why conference submissions succeed and why many proposals get rejected during call for proposals review. As a content chair, she shares what reviewers look for in an abstract, including clear outcomes, audience fit, and…

Digital wallets are moving into production — and suddenly the difference between selective disclosure and ZKPs really matters. Here's a practical look at where the complexity actually lands.

#til that Organic Roasted Seaweed is more addictive than potato chips nom nom nom nom.

Ooooh, it's pruning season and folks are in the yard working on my orchard. I love seeing the cleanup before spring and am just sad that I'm not out there with them. (I'm prepping for some meetings and events over the next 10 days and am going to miss all the pruning fun.)

We’re hosting an absolutely amazing lineup of speakers and talks this year. Take a look and pls join us if anything looks interesting. It's free + virtual. www.scylladb.com/2026/02/17/m...

This post tackles a bunch of questions around what "success" means when it comes to technical standards. Is it purely about adoption, or is there room for technical purity? Should a standard describe reality, or shape it? Let's discuss! #standards #techindustry

As generative AI evolves, a Google VP warns that LLM wrappers and AI aggregators face mounting pressure, with shrinking margins and limited differentiation threatening their long-term viability.

Erlend did a pretty good job responding to the “Be wary of Bluesky” article, but I’ll add a couple of other comments

Mood

Understanding the FIDO Alliance’s Standards and Working Groups Heather Flanagan explores why the FIDO Alliance can feel difficult to follow from the outside, and why that silence is often misunderstood. This episode examines how FIDO’s approach to standards development differs from more open…

Chairs run the process. Contributors write the standards. If you want to influence how specs actually turn into something implementable, this post breaks down the skills that make contributors effective and trusted.

Twenty-three hours before my first international trip of the year. Amsterdam in February is not my favorite, but the small conference will be fun to facilitate (tiime-unconference.eu).

Internet shutdowns make Internet fragmentation real. They’re not technically hard, and they’re becoming normal. Using Iran as a case study, this post looks at how shutdowns work, why they’re increasing, and what they mean for identity, platforms, and global interoperability.

“It is impossible to protect privacy from authoritarianism without addressing consumer privacy.” - from Daniel J. Solove, Privacy in Authoritarian Times - final published version here: papers.ssrn.com/sol3/papers.... #PrivacyMatters

This week’s mantra turned out to be: “Murder is a choice I am not making today.”

OH in a meeting: “They are like assholes. Everyone has them, and everyone should have just one.”

Digital credentials don’t standardize themselves. A candid tour of the OpenID DCP Working Group: what’s done, what’s dormant, and where real momentum exists—from OpenID4VC, HAIPm and conformance, to ISO alignment and hard tradeoffs.

New use for ChatGPT: write the text for an angrygram email, feed it to ChatGPT requesting a more professional version, and use that for the actual email. Doesn't make me personally less angry, but at least I sound professional about it!

I can haz sweater! I could have gone a bit more drawn in at the waist, but it’s pretty good. Now to figure out what to do with the remaining 500yards of Aran weight Shetland 3-ply.

Looking at my stats, gotta say that people do surprise me. I didn’t expect my Field Guide to Digital Identity Standards Bodies or Web Payments and Digital Identity Standards to be the most-listened episodes of my audioblog, but here we are. Thanks; it makes the effort to produce them feel worth it.

Finishing off the last quart of sweet cider we made this past apple season. I definitely need to make more next year!

I spent winter break reading a backlog of info on AI policy, standards, and deployment. One pattern I noticed: we’ve been using the term “AI system” as a shared shorthand, even though we don’t actually agree on what it refers to in practice. I have thoughts on that. #AI #AIpolicy #standards

This is not a thrilling post. It is a reference. I put together a field guide to how identity standards actually get made across the IETF, W3C, OpenID Foundation, and FIDO. I’ll be pointing back to this all year. #standards #OIDF #IETF #W3C #FIDO

My first post of 2026 is up. Notes from Gartner IAM on process vs product, where standards disappear in buying conversations, and the irony of AI hype warnings surrounded by AI marketing. Walking the floor was… instructive. #Gartner #IAM

2025’s top posts are in: AI agents, delegation headaches, governance gaps, and the slow fragmentation of the Internet. Here’s a roundup of what sparked the most discussion this year — and what these trends suggest for 2026.