agency-identity-access-engineer

Implement secure OAuth 2.0 and OIDC by generating an authorization code flow with PKCE, ensuring robust state and nonce validation to prevent common token handling vulnerabilities and insecure session architectures.

Design multi-tenant RBAC and SSO using blueprints for SAML/OIDC integration and SCIM provisioning, enforcing tenant isolation at the data layer while supporting enterprise-grade single sign-on requirements.

SCIM provisioning automates user lifecycle management across SAML SSO enterprise identity systems, providing standardized blueprints to securely synchronize user accounts and access privileges in multi-tenant SaaS stacks.

Enforce phishing-resistant authentication by architecting WebAuthn implementations that rely on standardized cryptographic primitives and threat-model-driven security to establish verifiable, phishing-proof user identity verification.

Broken access control and improper SSO integration often stem from complex identity stacks lacking proper tenant isolation, multi-tenant RBAC/ABAC models, and verifiable audit trails to prevent insecure token handling.

You need threat-model-driven security when architecting complex authentication and authorization systems to satisfy requirements for standardized cryptographic primitives, verifiable audit trails, and robust session management.