Break-Glass Access That Does Not Quietly Become Normal Access
A practical design for emergency access that remains independent, time-bounded, observable, testable, and difficult to normalize into an ordinary administration path.
open-source
Latest
Proving Least Privilege with Denial Tests
Least privilege is not proved by showing that approved work succeeds. It is proved by testing the nearby actions, resources, identities, and conditions that policy must deny.
The Architecture Review Must End with a Decision
An architecture review earns its cost only when it produces an explicit decision, bounded conditions, accountable owners, verification criteria, and a durable record.
Retiring a Security Platform Without Bringing It Back by Accident
Decommissioning is the controlled removal of authority, dependencies, identities, and startup paths, not a power-off event.
backup
·
A Backup Is Not Recovery Evidence
A completed backup proves data was written somewhere. Recovery evidence proves the right service can be restored safely, within its objective, without colliding with production.
Threat Modeling the System That Actually Exists
A useful threat model tracks live trust boundaries, administration paths, transition states, recovery systems, evidence dates, and the changes that made the old model wrong.
Prompt Injection Is an Authorization Failure with Words Attached
After reading my post on AI firewalls, a friend asked for my take on prompt injection. Prompt injection becomes dangerous when untrusted content can steer a software principal into using authority that the content never possessed.