Notes from the founder on making autonomous IGA real.

Founder's perspective

Years of building IGA. Here's what's still broken.

A career's worth of identity governance. Six things the industry still gets wrong — and why fixing them required a clean sheet.

2026-08 · SidantiX Team Competitive landscape

The week IGA woke up — Saviynt Zuma, SailPoint+Entro, and what they still can't do

Saviynt launched Zuma. SailPoint acquired Entro. Both moves confirm the direction we've been building toward — but neither closes the architecture gap.

2026-08 · SidantiX Team Evidence layer

Audit logs are not evidence

If your evidence lives in the same database as the system it's supposed to audit, it's not evidence. It's a story. Here's what real cryptographic proof looks like.

2026-08 · SidantiX Team Access lifecycle

Closed-loop revoke: the five steps nobody else completes

Signal → Evaluate → Revoke → Verify → Seal. Most IGA platforms stop at step 3 and call it done. We check that the access is actually gone.

2026-08 · SidantiX Team AI-agent governance

AI agents don't have badges: why IGA needs a new primitive

Every major IGA was built when "identity" meant a person with a badge. AI agents have tool grants, MCP delegations, and autonomous decision-making. They need governance built for them.

2026-08 · SidantiX Team AI-agent security

Your AI agent got hacked. Your IGA didn't notice.

ChatGPT plugin exploits, Copilot jailbreaks, sleeper agent research. The attack surface isn't the model — it's the tools the model can call.

2026-08 · SidantiX Team AI-agent security

MCP is the new API key — and nobody's governing it

MCP is good protocol design. The gap is governance: wide-open grants, no rotation, no audit, no revocation strategy. We saw this movie with API keys in 2014.

2026-08 · SidantiX Team AI-agent security

Your prompt injection gate should run before the model

Most AI security adds guardrails after the model processes input. If the model already invoked tools, output filtering is too late. Run the gate pre-LLM.

2026-08 · SidantiX Team AI-agent security

Zero trust was built for humans. AI agents need something different.

Zero trust asks "who are you?" Trust Restart asks "are you still you?" Agents break the session model — they need continuous behavioral attestation.

2026-08 · SidantiX Team Open spec

Why we open-sourced the Machine Constitution

Runtime-immutable safety invariants shouldn't be proprietary. We published the spec under MIT license because the industry needs a standard, not a vendor lock-in.

2026-08 · SidantiX Team Emergency response

Why we built a kill switch with a 1-second SLO

Compromised credential at 2 AM. Most IGA: file a ticket, wait. Kill Switch: preview blast radius → confirm → revoked everywhere → verified → sealed. Under 1 second.

2026-08 · SidantiX Team IQL

Stop asking your IGA team. Start asking your data.

"Who has admin access to production?" — IQL translates natural language into deterministic SQL. Same question, same data, same answer, every time. The query itself is evidence.

2026-08 · SidantiX Team NHI governance

The NHI problem is bigger than discovery

Discovery tells you the service account exists. Governance tells you it's safe. After you find 47,000 NHIs, you still need ownership, rotation, access reviews, and revocation with proof.

2026-08 · SidantiX Team Regulatory

EU AI Act Article 9: what your IGA needs to ship by 2027

The regulation is law. If your AI agents make access decisions, they're high-risk systems under Annex III. Most IGA vendors have no conformity story. Here's what the regulation actually requires.

2026-08 · SidantiX Team AI-agent security

Why your AI agents need an expiration date — and 4 other controls nobody ships

Five AI-agent safety controls that separate real governance from checkbox theater: egress allowlists, constitution attestation, time-bounded delegations, adversarial CI, and kill-switch SLOs.

2026-08-01 · SidantiX Team Buyer guide

5 questions to ask any AI-agent governance vendor before you sign

A buyer-side checklist for evaluating AI-agent governance vendors. Every question is designed to separate real cryptographic controls from configuration theater.

2026-08-02 · SidantiX Team AI-agent security

When your AI model tries to escape — what actually stops it

Anthropic and OpenAI models bypassing safety controls aren't one-off incidents. They're a category of failure that runtime-configurable safety systems can't stop.

2026-08-01 · SidantiX Team AI-agent security

The Machine Constitution — invariants for AI agents that no runtime config can override

Today we publish an open format for the safety invariants every AI-agent policy engine needs. MIT license, reference implementation included.

2026-08 · SidantiX Team