Identity as a control plane: least privilege, just-in-time and privileged access, non-human identities, and catching drift before it turns into exposure.
I'm an IT and identity security professional with hands-on work across IAM. I treat identity as a control plane: least privilege, just-in-time and privileged access, non-human identities, and catching drift before it turns into exposure. Lately that includes AI agents, which I think need the same isolation and least privilege as any other identity. These are the labs and tools I build to work through those problems.
I work on projects when time allows, and on whatever has my interest at the moment.
| Project | What it is | Status |
|---|---|---|
| Lab-in-a-Box | Self-hosted identity governance lab with Keycloak, Vault, and Gitea |    |
| Local MCP Toolbox | Read-only MCP server with allowlists, redaction, and audit records |    |
| crowdkeeper | Access audits and joiner, mover, leaver automation for Atlassian Crowd |    |
| acasentry | Access and identity review for Azure Container Apps |    |
| kube-foundry | Local Kubernetes platform with GitOps, policies, and tested rollback |    |
| detdrift | Flags detection rules broken by telemetry schema changes |    |
| RedDock | Local scoped discovery and evidence tool for authorized environments (in progress) |    |
| TerraForma-IaC | Generates readable Terraform from guided inputs; does not deploy |    |
| bbwarden | Least-privilege and offboarding review for Bitbucket Cloud and Data Center |    |
| Linchpin | Read-only identity review across Entra ID, Okta, Crowd, and Bitbucket exports: admins without MFA, stale accounts, leavers still active |    |
- linchpin v0.2.1 · 2026-10-15
- detdrift v1.1.0 · 2026-10-15
- crowdkeeper v0.2.3 · 2026-10-15
- bbwarden v0.2.4 · 2026-10-15
- acasentry v0.2.2 · 2026-10-15
JobDorking (inactive): one Google search across job boards and company career pages. Not actively worked on; the source is private.