A Digital Identity Digest

In this episode, Heather Flanagan offers a practical field guide to digital identity standards, explaining how organizations like the OpenID Foundation, W3C, IETF, and FIDO Alliance shape specifications, drafts, and published standards through very different processes and cultures. Discover how to interpret standards maturity, understand what a draft really means, and evaluate where work sits in t...

Heather Flanagan reflects on Gartner IAM and what it reveals about digital identity decision-making, identity access management priorities, and enterprise buying behavior. The conversation explores how process, not product, often drives outcomes in real-world IAM programs. Learn why overlooked process maturity, invisible identity standards, and interoperability gaps matter, and discover how AI hyp...

In this episode, Heather Flanagan looks back at the most read Digital Identity Digest posts of 2025, exploring what resonated across digital identity, governance, credentials, and AI. The recap reveals patterns behind shifting priorities, recurring debates, and the questions shaping standards work and system design. Discover how topics like agentic AI and authentication, delegation, decentralizati...

In this episode Heather Flanagan examines how web payments and digital identity are converging at the W3C, exploring digital wallets, browser-based APIs, and regulatory pressure shaping modern payment flows and trust on the web today as standards discussions reveal shifting assumptions across ecosystems. Discover how Secure Payment Confirmation, passkeys, browser-bound keys, and the Digital Creden...

In this episode of The Digital Identity Digest , Heather Flanagan explores how two emerging browser APIs—FedCM and the Digital Credentials API—are reshaping the identity layer of the web. Learn why browsers are shifting from passive intermediaries to active participants as privacy reforms and regulatory pressure accelerate. Discover how these APIs differ in governance, user experience, and archite...

In this episode, discover how today’s rapidly shifting digital identity landscape is bringing new practitioners into the field and challenging long-held assumptions about IAM, trust frameworks, and governance. Learn why even foundational concepts can feel unexpectedly complex as identity becomes integral to products, security, and global compliance. In this episode, discover how community expertis...

This episode explores what the “open web” truly means amid shifting standards, AI automation, and evolving economic pressures. Drawing on discussions from IETF 124 and W3C TPAC, it highlights how browser architects, policy experts, and researchers are reexamining long-held assumptions about access, interoperability, and the role of automated agents. Learn why openness isn’t a binary state but a mu...

Digital identity wallets are becoming a central focus in global identity conversations, driven by regulatory pressure, rapid technical evolution, and growing expectations around interoperability. This episode examines how layered architectures, protocol choices, and platform behaviors shape the user experience in ways that are often misunderstood. Listeners will learn why the Digital Credentials A...

This episode explores the regulator’s dilemma at the heart of digital infrastructure, where accountability, compliance, and governance reshape the systems they aim to protect. Heather Flanagan examines how modern identity, critical infrastructure, and risk management challenges emerge as digital environments outgrow traditional oversight models. Listeners will learn why compliance-era controls no...

When every digital system is labeled as critical infrastructure , do we actually make the Internet safer—or just more fragile? In this episode of The Digital Identity Digest , Heather Flanagan examines the growing tension between protection, control, and interdependence in our global digital ecosystem. Through examples from the U.S. and EU, Heather explores how expanding definitions of “critical”...

When AWS went down, payments failed and digital life froze — exposing how fragile our cloud-based world really is. In this episode of Digital Identity Digest , Heather Flanagan explores why AWS, Stripe, Twilio, and Okta have become the new critical infrastructure of global commerce. Discover how invisible digital dependencies shape resilience, why uptime isn’t true stability, and what “too big to...

For decades, standards development has been anchored in the idea that the Internet is (and should be) one global network. If we could just get everyone in the room—vendors, governments, engineers, and civil society—we could hash out common rules that worked for all.

I've been having an intellectually fascinating time diving into Internet fragmentation and how it is shaped by supply chains more than protocols. There’s another bottleneck ahead, though, one that’s even harder to reroute: people. Innovation doesn’t happen in a vacuum. It requires human talent that builds systems and sets standards.

I had one of those chance airplane conversations recently—the kind that sticks in your mind longer than the flight itself. My seatmate was reading a book about artificial intelligence, and at one point they described the idea of an “infinitely growing AI.” I couldn’t help but giggle a bit.

Many people reading this post grew up believing and expecting in a single, borderless Internet: a vast network of networks that let us talk, share, and build without arbitrary walls. I like that model, probably because I am a globalist, but I don't think that's where the world is heading.

When not distracted by AI (which, you have to admit, is very distracting) I’ve been thinking a lot about delegation in digital identity. We have the tools that allow administrators or individuals grant specific permissions to applications and service.  In theory, it’s a clean model.

With the right motivation, even I will write a blog post on a dare. And the dare I got was to write a post about what librarians and pirate captains have in common, and why it matters for standards development. (If you can’t have fun when writing, what’s the point?)

Google recently gave us something we’ve been waiting on for years: hard numbers on how much energy an AI prompt uses. According to their report, the median Gemini prompt consumes just 0.24 watt-hours of electricity — roughly running a microwave for a second — along with some drops of water for cooling.

We’ve been talking about identity and access for people for decades (millennia if you think outside tech). Policies, role assignments, reviews, zero trust — these are familiar tools. The assumptions that go into them, however, don't quite work when the "user" is no longer a person." Enter in the AI Agent.

We don’t spend much time thinking about the roads we drive on—until one cracks, collapses, or dumps us somewhere we didn’t mean to be. Identity in the age of agentic AI? Same deal. It’s infrastructure. Like a good road, it needs to be ready for traffic we can’t imagine.

Let’s start with a confession: I love bots. Or at least, I love the idea of them. They’re efficient, tireless, and, if designed well, can be downright helpful. (They can also be downright unhelpful, but that's a topic for a different blog post.) But the incentives around bot traffic are completely out of balance, and that makes things messy.

This one’s for everyone who’s ever said, "I’m not technical enough to participate in standards development." If you’ve wondered what working group chair skills actually matter, I have news for you: you don’t need to be a spec-writing wizard to be effective. I do get it, though.

If you want to follow what's happening in AI, it helps to know where the conversations are happening. That doesn't just mean the headlines and white papers; it means the standards bodies, working groups, and protocol discussions shaping the infrastructure AI systems will have to live with (and live inside).

Disinformation. Misinformation. Malinformation. These terms get used interchangeably, but they’re not the same thing. That distinction matters when designing resilient infrastructure that supports trust. Most of our efforts to address these problems focus on content, activities like fact-checking, moderation, and takedown requests.

I went to Geneva to understand what, if anything, people were saying regarding digital identity and standards in a governance-focused forum. My brain is now full. I adore the topic of identity and the standards development process; everything from the brilliant minds, the challenges, and the intense edge cases.