WebFrolic field notes · 41 articles
Practical, technically grounded perspectives on identity flows, tenant boundaries, authentication, access governance and security operations. Each article starts with a real design question and ends with something teams can test or take into a review.
The library
Use search or select a topic. Each article includes a short flow and practical review points.
Featured · Continuous identity
A session can remain technically valid after its token is stolen. See how session fingerprinting, active-session limits and network firewall rules create layered opportunities to detect and contain replay.
Read the featured article →Curated reading paths
Short, connected reading journeys for the questions teams most often need to evaluate.
Understand identity classes, tenant boundaries and shared operational models.
Compare authenticators, session risk and the assurance decisions around them.
Explore delegated credentials, permission boundaries and resource access.
Connect provisioning, access review, offboarding and audit evidence.
Showing all 41 articles
Security controls · Session protection
A valid session can be stolen after sign-in. Explore how continuous session fingerprinting, active-session limits and network firewall policies work together to detect and contain replay.
Read article
Authorization design · Security architecture
Custom-resource and identity-provider permissions can each decide whether API-key invocation is supported, separating delegated integrations from actions that require an authenticated user session.
Read article
Identity architecture · Visual essay
Email, SMS, push, HOTP and TOTP wear the same name but fail differently. The popular choice stores a symmetric key the server must be able to use — which is closer to plain text than to a password hash.
Read articleIdentity architecture · Visual essay
A three-part visual essay on identity sprawl, the fragile bridge between customer and workforce systems, and a shared identity model with rules suited to each identity type.
Read articleIdentity architecture
When an agent calls an internal API, whose identity is it using? For most teams the answer is a shared service account or a key carrying one person’s permissions.
Read articleIdentity architecture
We matured how employees get access. Almost none of that machinery was ever pointed at the identities doing most of the work.
Read articleIdentity architecture
“The integration did it” is where too many incident reviews stop. Dual attribution is what makes automated action reviewable.
Read articleIdentity architecture
Signup, authentication, enrollment and recovery are not interchangeable screens. They are connected state transitions, and the security of the journey depends on the sequence being valid.
Read articleB2B SaaS
For B2B software, each customer organisation has its own people, groups, domains and administration boundaries. A tenant label alone does not define or enforce those boundaries.
Read articleOperations
Shared operational accounts make it difficult to attribute actions, rotate credentials and maintain integrations after team members leave. A named service identity changes the question from “who knows the password?” to “what is this identity allowed to do?”
Read articleSecurity operations
Support teams help people regain access and resolve account issues. Those powers also create a target for social engineering, so support procedures should be treated as part of the identity security design.
Read articleIdentity lifecycle
When a customer becomes an employee, the identity crosses a trust boundary. If the transition is treated as a simple role change, yesterday’s privileges can remain in the wrong place.
Read articleIdentity lifecycle
A departure notice is not an access-control operation. Reliable offboarding finds every path that granted access and proves it has been removed or intentionally retained.
Read articleIdentity lifecycle
Provisioning creates access, but lifecycle management is the whole loop: change, review, suspend, remove and verify. The removal path deserves the same design attention as the welcome journey.
Read articleGovernance & compliance
An access review should be more than a periodic approval spreadsheet. Its purpose is to compare today’s permissions with the work a person is expected to do and remove grants that no longer make sense.
Read articleGovernance & compliance
Access needed for a short task should not become permanent by default. Expiry is a policy decision: choose where time limits help, how exceptions work and how enforcement is verified.
Read articleAuthentication & passkeys
Counting authentication steps is not the same as measuring assurance. Teams need to understand what each authenticator proves, how factors differ and which operations need stronger evidence.
Read articleAuthentication & passkeys
Two prompts can still rely on one kind of evidence. Understanding the difference between authenticator count and factor diversity helps teams set MFA policy without overstating protection.
Read articleAuthentication & passkeys
A strong authentication requirement can protect an important action and still create a dead end when users need to maintain their credentials. Designing the recovery route is part of the control.
Read articleAuthentication & passkeys
Passkeys and security keys can improve sign-in security, but device trust depends on more than the presence of a public-key credential. Attestation and user-verification policy need a clear purpose.
Read articleAuthentication & passkeys
An authenticated session is not necessarily sufficient proof for every credential change. Enrolment rules must stop a hijacked session from adding the attacker’s own way back in.
Read articleAPI & protocols
A well-protected secret can still be replayed from the wrong place. Network restrictions add another boundary by limiting where a credential is accepted.
Read articleAPI & protocols
An API key should have a reason to exist, an owner, a scope and an end-of-life process. Treating it as a string to distribute is how integrations become orphaned authority.
Read articleAPI & protocols
PKCE binds an authorization-code exchange to the client that initiated it. Making it a default changes the question from “Did we remember?” to “Is there a reviewed reason not to?”
Read articleAPI & protocols
Certificate rotation is routine trust maintenance that can become an incident if every participant changes state at the same moment. Plan for overlap, validation and rollback before expiry forces the issue.
Read articleAPI & protocols
OIDC adds an authentication layer on top of OAuth 2.1, while OAuth 2.1 is primarily an authorization framework. Choosing between them starts with what the application needs to know or do.
Read articleSecurity controls
Rate limiting can slow credential stuffing, limit abuse of recovery flows and buy response time after account compromise. A single global threshold rarely fits every identity and operation.
Read articleSecurity controls
Network filtering is more useful when it protects sensitive identity operations—not only the perimeter around servers and databases.
Read articleSecurity controls
An audit trail is most valuable when it is built into how actions happen, not added later to satisfy a reporting request. It should answer who did what, to which resource, under which context, and why the system allowed it.
Read articleSecurity controls
Users and administrators need to know where an identity is active, how to revoke access and what remains valid after a sensitive event.
Read articleSecurity controls
When an authenticator or policy is found to be flawed, the response must identify affected identities, contain exposure and restore assurance without treating every account as identical.
Read articleArchitecture & administration
Customers, employees and administrators do not face the same risks or responsibilities. One global authentication policy can burden everyone or under-protect identities with the greatest authority.
Read articleArchitecture & administration
Self-service is useful, but an administrator changing information that determines their own authority can create a conflict of interest. Sensitive profile changes need a controlled path.
Read articleArchitecture & administration
Test accounts are useful only when they behave predictably, stay out of privileged paths and disappear when no longer needed. Treating them as ordinary users with a label misses their special risk.
Read articleArchitecture & administration
Automated identity tests need repeatable verification, but test conveniences must not become a backdoor into real accounts. Keep OTP retrieval scoped, auditable and isolated.
Read articleArchitecture & administration
Custom attributes help a product adapt to different organisations, but every new field raises questions about ownership, validation, visibility and policy impact.
Read articleGovernance & compliance
Evidence is easier to produce when the product records meaningful events as work happens. Compliance becomes harder when teams must reconstruct decisions from incomplete logs and manual spreadsheets.
Read articleGovernance & compliance
The written policy is only part of the security posture. Exceptions that never expire and privileges nobody uses can turn small conveniences into a permanent attack surface.
Read articleGovernance & compliance
Requesting access, approving it and reviewing it later are often treated as separate jobs. Connecting them creates a clearer record of why access exists and whether it should continue.
Read articleArchitecture & administration
Global roles can have a wide blast radius. Strong authentication, resource scoping and network restrictions should work together to control where those roles can be assumed and what they can change.
Read articleSecurity engineering
A feature can pass isolated tests and still create a vulnerability when combined with another feature. Identity systems need tests for chains, state and policy interactions—not just individual endpoints.
Read articleNo articles match that search. Try another term or select “All articles”.
A technical question?
Browse documented capabilities or request a walkthrough around the identity journey you need to validate.
