#453 - Treating Identity Like a Product with Eve Maler

Eve Maler, founder of Venn Factory and author of Mastering Digital Identity, joins Jim McDonald and Jeff Steadman for her tenth appearance on Identity at the Center. Eve shares what she has learned since the book came out, from writing for non-technical executives (and keeping AI out of the manuscript) to the strange places identity ends up on the org chart. The conversation covers treating identity as a product, why identity can be a business model in disguise, how CISOs can influence CIAM when they are not the boss of it, and the identity debt that AI is now calling due. Eve also explains why intent looks more like purpose of use than finer-grained authorization, how contract language can help frame agent mandates, what trust means to humans versus security teams, and the early work on UMA for Agents (U4A) to govern third-party agents through a resource-centric, protect surface mindset. The episode wraps with travel tips from all three frequent flyers.

Connect with Eve: https://www.linkedin.com/in/evemaler/

Eve's book "Mastering Digital Identity" - https://masteringdigitalidentity.com/

MyTerms: https://myterms.info/

UMA for Agents: https://u4a.ai/

Kwaai AI Lab - https://www.kwaai.ai/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Introduction and Eve's tenth appearance

02:40 Life since publishing Mastering Digital Identity

04:49 Writing for non-technical executives

06:36 AI and the book writing process

09:00 Identity as a product: feedback from leaders

10:29 The strangest places identity lives on the org chart

11:46 Metrics that work across functions

13:40 Identity as a business model in disguise

15:14 Identity's unhoused problem

16:56 Who is accountable for identity?

18:33 Security versus usability

20:43 Is identity the product or part of the product?

24:04 Normalizing product replacement

25:53 CISOs, CIAM, and "You're Not the Boss of Them"

28:03 Defining identity debt

29:27 How AI exposes identity debt

31:38 The organizational roots of identity debt

32:52 What intent means for AI agents

34:23 Poisoned intent and contracts as a model

36:15 Laws of robotics and the policy stack

39:21 MyTerms and IEEE 7012

40:04 Trust as a human word

43:29 UMA for Agents and third-party agents

47:27 The protect surface and what practitioners should consider

51:10 U4A maturity and how to get involved

53:43 Travel tips from frequent flyers

1:02:10 Wrap up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Eve Maler, Venn Factory, Mastering Digital Identity, identity as a product, identity product management, identity debt, technical debt, CIAM, customer identity, CISO, identity ownership, identity metrics, board-level identity, AI agents, agentic AI, non-human identity, NHI, intent, purpose of use, trust, zero trust, protect surface, UMA, User-Managed Access, UMA for Agents, U4A, third-party agents, MyTerms, IEEE 7012, Kwaai, consent phishing, phishing-resistant authentication, passkeys, NIST 800-63, IAM, identity and access management, travel tips