Identity at the Center·Oct 28, 2026·57m·Episode #457

#457 - Sponsor Spotlight - Iden

Download audio Show notes Apple Podcasts

Show notes

They dig into how deep governance has to go. Knowing someone has a GitHub account is one thing. Knowing they can approve their own pull requests is another. Pranay explains where SCIM stops short of fine-grained entitlements in SaaS, internal, and legacy apps, why a governance program is only as complete as the weakest app in the stack, how teams can sort apps into P0, P1, and P2 priorities, and when access requests should be automated versus kept in front of a human.

The conversation closes on AI. That covers using it to help practitioners and end users, the harder problem of governing AI agents that share a person's identity, credentials, and long-lived tokens, and why nobody has patience for multi-year identity programs anymore. Pranay also shares the advice he'd give his firstborn: don't typecast yourself.

Made possible with support from Iden. Learn more at idenhq.com/idac

Connect with Pranay: https://www.linkedin.com/in/ypranay/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at idacpodcast.com

00:10 Welcome and Sponsor Spotlight introduction

01:09 From venture capital to identity governance

02:41 Where the friction starts for small IT teams

04:37 Starting with the apps that lack built-in provisioning

05:21 The floor and the ceiling of who feels the pain

06:44 How deep governance has to go

11:35 When knowing "has access" is enough

13:37 Where SCIM fits and where it stops

15:18 Depth in practice: SaaS roles, GitHub, and internal apps

19:13 Breadth and the long tail of apps

21:30 Prioritizing apps into P0, P1, and P2

25:39 What governance means functionally

28:31 When to automate access requests and when to keep a human in the loop

32:18 The experience for the IGA administrator

36:25 AI for governance

43:06 Why governing AI agents is so hard

47:41 No appetite for multi-year identity projects

52:49 Lighter note: advice for a firstborn

56:05 Wrap-up

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Pranay Yadav, Iden, Sponsor Spotlight, identity governance, IGA, identity governance and administration, IAM, SCIM, fine-grained entitlements, RBAC, authorization, access reviews, joiner mover leaver, onboarding, offboarding, provisioning, deprovisioning, least privilege, segregation of duties, audit evidence, connectors, long tail of applications, SaaS governance, internal applications, legacy applications, automation, human in the loop, AI for governance, MCP, AI agents, agent governance, non-human identity, delegated identity, API tokens, Accel

← Previous

#456 - AI vs Reality with Joseph Carson

In this Sponsor Spotlight, Jim McDonald talks with Pranay Yadav, co-founder and CEO of Iden, about why identity governance still runs on tickets and spreadsheets at so many organizations. Pranay came to identity from venture capital at Accel, where he kept hearing the same story from IT teams. SSO arrives early, and everything after it gets tracked by hand. They dig into how deep governance has to go. Knowing someone has a GitHub account is one thing. Knowing they can approve their own pull requests is another. Pranay explains where SCIM stops short of fine-grained entitlements in SaaS, internal, and legacy apps, why a governance program is only as complete as the weakest app in the stack, how teams can sort apps into P0, P1, and P2 priorities, and when access requests should be automated versus kept in front of a human. The conversation closes on AI. That covers using it to help practitioners and end users, the harder problem of governing AI agents that share a person's identity, credentials, and long-lived tokens, and why nobody has patience for multi-year identity programs anymore. Pranay also shares the advice he'd give his firstborn: don't typecast yourself. Made possible with support from Iden. Learn more at idenhq.com/idac Connect with Pranay: https://www.linkedin.com/in/ypranay/ Connect with us on LinkedIn: Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/ Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/ Visit the show on the web at idacpodcast.com 00:10 Welcome and Sponsor Spotlight introduction 01:09 From venture capital to identity governance 02:41 Where the friction starts for small IT teams 04:37 Starting with the apps that lack built-in provisioning 05:21 The floor and the ceiling of who feels the pain 06:44 How deep governance has to go 11:35 When knowing "has access" is enough 13:37 Where SCIM fits and where it stops 15:18 Depth in practice: SaaS roles, GitHub, and internal apps 19:13 Breadth and the long tail of apps 21:30 Prioritizing apps into P0, P1, and P2 25:39 What governance means functionally 28:31 When to automate access requests and when to keep a human in the loop 32:18 The experience for the IGA administrator 36:25 AI for governance 43:06 Why governing AI agents is so hard 47:41 No appetite for multi-year identity projects 52:49 Lighter note: advice for a firstborn 56:05 Wrap-up IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Pranay Yadav, Iden, Sponsor Spotlight, identity governance, IGA, identity governance and administration, IAM, SCIM, fine-grained entitlements, RBAC, authorization, access reviews, joiner mover leaver, onboarding, offboarding, provisioning, deprovisioning, least privilege, segregation of duties, audit evidence, connectors, long tail of applications, SaaS governance, internal applications, legacy applications, automation, human in the loop, AI for governance, MCP, AI agents, agent governance, non-human identity, delegated identity, API tokens, Accel