The book
The Modern Identity Operating Model
A practical framework for leading human, nonhuman, and AI identity.
Identity has outgrown the old playbook. Human accounts, nonhuman identities, and now AI agents all have to be governed, and bolting on another tool will not bring order. This book lays out an operating model that does, in plain terms any organization can adopt.
What this is
Run identity as a discipline, not a pile of tools
For years, identity has been treated as a tooling problem. Buy the platform, turn on the features, and assume clarity will follow. It does not. Technology does not create clarity. It can only enforce the clarity you already have, or expose the fact that you never had it.
The Modern Identity Operating Model is a vendor-neutral way to run identity well. It is built on five pillars that answer the questions which actually keep identity sound: who is accountable, how access begins and ends, what an entitlement really permits, whether your tools serve a model you chose, and whether the people who own decisions understand what they own.
AI does not fix identity. It exposes identity.
The same fine-grained, expiring, function-scoped access that AI agents need is the direction human access is heading too. The organizations that do well are the ones with a model underneath, so that what is true for a person and what is true for a workload follow the same shape. This book is how you build that model.
Governance
Who decides, who owns what, and whether the rules are written down.
Lifecycle
Whether identities begin, change, and end the way they should.
Access
Whether access means what you think, and is no larger than it needs to be.
Technology
Whether your tools serve a model you defined, or quietly define how you work.
People & Change
Whether ownership is real and the work is shared.
Who it is for
Written for the people who carry identity
The identity and IAM leaders setting direction. The CISOs and security leaders who answer for the risk. The governance, audit, and risk teams who have to prove it. And the practitioner doing the work with more systems than time. If you have ever inherited access that nobody could explain, you are the reader.
Drift is normal. It is the signal, not the verdict.
The book does not pretend you start with clean foundations. Almost no one does. It meets you where you are, names the human cost of the mess honestly, and gives you a structure that takes friction off people instead of adding to it.
Praise
What readers are saying
"This is one of the best treatments of the topic I've ever seen, and I think you've done the information security profession a great service."
"The Modern Identity Operating Model turns identity from a technical discipline into a practical operating capability grounded in governance, accountability, lifecycle management, and measurable risk reduction. It gives security and business leaders a valuable framework for moving IAM from policy and theory into decisions, controls, and outcomes that strengthen the organization."
"Cuts through the identity confusion with clear definitions and delineations, essential tools, and the hard-won wisdom of years of real-world practice. Becky's book is a timely and necessary resource for all IAM practitioners and decision-makers."
"Modern Identity Operating Model is a practical and refreshing guide for identity leaders navigating an increasingly complex digital landscape. The clear structure, practical frameworks, and chapter-end checklists provide readers with a roadmap they can immediately apply."
"A thoughtful and comprehensive exploration of identity, this book brings much-needed clarity to both what identity encompasses and what it does not."
"The shift from focusing on tools to building a real organisational capability is exactly what the world and domain need right now."
"This book provides practical blueprints and easy-to-apply models to focus on modern identity management challenges, while also explaining the often confusing and jumbled landscape of identity management from the views of the practitioner to the program owner."
"This feels like a book that should be required college reading for anyone that is going into IT."
Progress over perfection
You are closer than the audit made you feel.
Identity does not get fixed in one heroic project. It gets better in small, real steps, and every one of them counts. Any one of these is a win worth taking.
Name one owner
Pick a single system and write down who actually owns access to it. That name is where governance starts.
One system, now owned.Ask who decides
Take one access decision and find out who is authorized to approve it. If nobody can answer, that is the finding.
One decision with a name on it.Set one expiry
Give one piece of standing access an end date. Access that expires on its own is access you never have to chase.
One thing that cleans up after itself.Review one entitlement
Take a single entitlement and ask what it actually grants. Most audit surprises start as a name nobody questioned.
One permission you can explain.Retire a stale account
Find one account nobody has signed into in ninety days and confirm whether it still needs to exist. Usually it does not.
One fewer door left open.Catalog one system
Walk one system through the catalog with its owner. One honest row beats a blank inventory every time.
One row you can defend.Start with the free toolkit.
One or two people covering security at a small company, and identity is one of several things you own? This page is written for exactly that.
Where to go next
Three ways in
The toolkit
The assessment, the worksheet, the catalog, and the book’s templates, free to download and use.
The writing
Short field notes on running identity as a discipline, drift, ownership, and governing AI identity.
Speaking
Keynotes, workshops, and leadership sessions on the modern identity operating model.
The book
Get The Modern Identity Operating Model
A practical framework for leading human, nonhuman, and AI identity.
Coming soon
The book is on its way, and retailer links will appear here when it publishes. In the meantime, explore the free toolkit.