Toolkit · Templates
The book’s templates
The fillable artifacts from Appendix B, the Artifact Pack, grouped the way the book groups them. Most are free to download. Each comes with field definitions and a worked example.
Templates by pillar
The artifacts turn the ideas in the book into tools you can adapt immediately, organized into seven groups that follow the book's chapters. Most are free to download. Where a tool is paid, it is marked, and new templates are still arriving.
Where to start
Do not try to deploy every artifact at once. Start with the few that make your environment easier to see, then work in waves: make one area visible, then make one area stronger. Here is where most identity leaders begin, depending on what is pressing.
Most environments: start with visibility
Under nonhuman or AI pressure
Under audit or operational strain
Not sure which fits? The Where-to-Start Worksheet turns your situation into one first move.
01 Foundational
See the environment before you try to change it.
If you are firefighting: make one thing visible before you change anything. Pick the corner of your environment you understand least, and get a clear enough picture to see it.
Identity System Catalog
Understand how identity behaves inside each system across all five pillars.
Identity System Catalog, Guided Edition
The same field set with a guided intake and a register that builds itself as you answer. Mark which regulations a system is in scope for, and the workbook decides which evidence fields become required, then shows you which are still missing. The free workbook has every field; this one does the work with them. Available separately.
Drift Visibility Inventory
A one-page snapshot of where drift is already visible.
Drift Diagnosis Guide
Name the signal, locate the pillar it began in, and choose the intervention.
Workforce Identity Attribute Mapping Template
Map the identity attributes that drive workforce behavior from their authoritative source to the systems that consume them, with the owner and meaning of each. Free, with a generic source and target you fill in.
Workforce Identity Attribute Mapping Workbook
The prepopulated extension of the template, with fourteen vendor-verified systems mapped field by field. Available separately.
Nonhuman and AI Identity Register and Model
Inventory the identities that are not people: service accounts, workloads, API clients, bots, certificates, and AI agents, one row each with owner, purpose, authentication, rotation, and provenance. The Model defines every field so the Register stays consistent.
02 Governance
Make ownership and decisions explicit.
If you are firefighting: find one thing that grants access and has no clear owner, decide who should own it, and tell them.
Ownership Map
Show which identity objects have real owners and where ownership is unclear.
Decision-Rights Matrix (RACI)
Clarify who decides what: a RACI, DACI, or decision matrix built for identity decisions specifically.
Governance Exception Record
Track exceptions so they create evidence, not quiet drift.
Identity Risk Register and POA&M Tracker
The portfolio above the exception record: every known gap with a treatment (reduce, transfer, avoid, accept), remediation plans with milestones, time-bound risk acceptances, and a summary that calculates overdue reviews and expired acceptances for you. Available separately.
AI Governance Checklist
Ensure AI systems and agents are governed structurally.
03 Lifecycle
Make identities begin, change, and end the way they should.
If you are firefighting: start with the leaver path. Pick the systems where lingering access after departure would hurt most, and make sure it reliably comes off.
Lifecycle Map
Visualize how identities begin, change, and end across identity types.
Identity-Type Lifecycle Matrix
Compare lifecycle expectations across identity types.
Nonhuman Lifecycle Template
Define how a nonhuman identity is created, changed, reviewed, and retired.
Agent Lifecycle Intake Form
Bring AI and agentic identities into the lifecycle with explicit ownership.
AI Identity Intake Form
Create a visible intake path for AI identities.
04 Access
Make access mean what you think it means.
If you are firefighting: start with the access that would do the most damage if misused, the standing admin rights and the few entitlements reaching your most sensitive systems, before the long tail.
Privilege Chain Map
Visualize direct and indirect paths to sensitive capability.
Access Model Template
Structure capability, roles, and entitlements before access accumulates.
AI Access Boundary Template
Define what an AI identity may do, and what stays out of bounds.
AI Governance Suite
The three AI forms above, unified into one register for an estate rather than a single agent. Enter each fact once; intake, boundary, attribution, and review pull it through. The authority overlap is computed at capability grain, so an agent granted more than the person it acts for is flagged, not left to be caught by eye. Available separately.
05 Technology
Track the credentials underneath.
If you are firefighting: do not buy something. Pick the system where you are least sure what identity is doing, and get a clear enough picture to see it.
Certificate Inventory Starter
Track machine credentials before they become outages or hidden privilege.
06 People & Change
Bring people with the change and make adoption stick.
If you are firefighting: start with the people one decision depends on most. Find the approvers making identity calls without enough to go on, and give them the context and plain language to decide well.
Stakeholder and Sponsor Map
Identify who shapes identity truth, who carries the change, and who sponsors it.
Communication Plan Template
Plan the audiences, threads, and timing that carry an identity change.
Role-Based Training Matrix
What managers, owners, engineers and operators, and executives each need to know, role by role.
Resistance Log
Treat pushback as a reading of the design, and tell healthy discomfort from real friction.
Adoption Metrics Tracker
Measure whether the model is being used, not just whether the technology is live.
Selling Identity to Executives
One page per pillar for the boardroom: the case, the measures to bring, and the one-sentence version. Built to win the sponsor and working group the model needs.
07 Implementation & Measurement
Move from reading to visible progress.
If you are firefighting: pick one area, make the model real there, and close it out before spreading. One finished wave beats a broad plan with no closeout.
Ninety-Day Starter Plan
Move from reading to visible structural progress.
Identity Metrics Starter
Tie metrics to the pillars and to predictability, each with an owner. See it staged into reporting dashboards for every altitude.
More templates arrive as they are built. Each fillable artifact comes with field definitions and a worked example.
For firms
Using these with clients
Everything here is free to use inside your own organization. If you are a consultancy, MSP, or integrator using these in client work, that needs a license.
The whole template set, licensed for client delivery
Use them in engagements. Rebrand them as your own. Train your consultants on the model. Non-exclusive, renewable, priced by the size of your team.
Not sure which side of the line you are on? The terms are one page, and they turn on a single question.