Where to Start When the Operating Model Is Weak

Once the environment is mapped and the partner landscape is visible, the next question becomes clearer:

Where is the operating model under the most strain?

In many environments, the first challenge is not tooling. It is one or more weak operating conditions that keep showing up in different forms.

Ownership may be vague. Identity truth may be unreliable. Lifecycle may not reflect organizational reality. Entitlements may lack purpose. Authorization logic may be governed at the wrong layer. Privilege may be convenience-based. Drift may be hard to see early.

Those conditions usually show up later as:

broken reviews

access sprawl

repeated manual correction

unmanaged nonhuman identities

privilege creep

recurring exceptions

Start with diagnosis.

Identify the weakest operating condition before selecting the next improvement step.

Separate root causes from downstream symptoms.

Prioritize conditions that destabilize multiple parts of the model.

Focus first on weaknesses that make the rest of the system harder to predict.

Avoid starting with the loudest issue if it is not the structural one.

Why it matters

Starting with the weakest condition reduces repeat correction and keeps symptoms from becoming design.

Measure:

• identity truth accuracy
• lifecycle alignment
• access purpose alignment
• privilege containment
• authentication strength
• operational reliability
• recurring exceptions tied to structural operating model weakness
• identity processes requiring repeated manual correction
• Validate:

Ask which weakness creates the most downstream instability.

Ask which issues keep repeating across tools or processes.

Ask whether teams are solving symptoms or improving root conditions.

Compare observed issues to the operating condition behind them.

The work usually goes better when diagnosis comes before deployment.

In the environments you've seen, where does the operating model usually weaken first: ownership, identity truth, lifecycle, access structure, privilege discipline, authentication, nonhuman identity governance, or operational coordination?

Post to Identity & Access Management Specialists Group

Request for Perspective

Identity practitioners and leaders, I want your perspective on something we all wrestle with.

If you work in Identity and Access Management long enough, you start to see the same patterns repeat. Tools change. Vendors change. Buzzwords definitely change. But the operating model problems stay stubbornly the same.

Over the past few months, I've been writing a multi-series body of work on the Modern Identity Operating Model.

Series 1 covers the foundations.

Series 2 focuses on implementation.

Series 3 is now being outlined and looks ahead to what identity must become in an AI-mediated, appless, autonomous world.

Series 2 is structured as a 16-post sequence, published twice a week. (Editor’s note: the series grew to 28 posts.) Post 5 went live this morning, and the conversations so far have been incredibly valuable. One theme I keep hearing is that the series needs to go deeper on how agentic AI will reshape IAM. I agree. The operating model should hold no matter what we throw at it, including the rapid rise of agentic AI and the explosion of workload identities that comes with it. If the model only works when the environment is stable, it is not a model. It is a diagram. IAM needs something sturdier than that.

I am also considering expanding this work into a larger publication, and before I take that step, I want to hear from the people who live this work every day. This group has some of the strongest practitioners in the industry, and your insight would help shape where this goes next.

📘 Series 1: The Modern Identity Operating Model

Introduction to the series:

https://lnkd.in/du9V66Jk

Links to all posts in Series 1, all published posts in Series 2, and the full outline for Series 2 are in the comments.

If you read even one post, I would appreciate your thoughts. What resonates. What you disagree with. What you have seen in the field that others should know. IAM only gets better when practitioners share what actually works.

Looking forward to the discussion.