A book by Becky Sandberg
Identity decides who, and what, is allowed to act.
Every person, service account, workload, and AI agent in your organization acts on the strength of an identity.
When that system is governed, nobody notices it. When it drifts, the failure shows up somewhere else first: in the breach, the failed audit, the project that stalls because no one can get access. This book shows how to run identity as the security discipline it already is.
Where are you starting from?
Pick the line that sounds most like you. Each one leads to the two or three pages that will help first.
You lead identity, or answer for it
Know what to ask and where the real exposure sits.
You have to make the case upward
Frame identity the way a board hears it: revenue, growth, cost, risk, and time.
You do the hands-on work
This is where the five pillars become design.
An audit is bearing down
Start from where you actually are, and move fast.
You are the whole identity function
One person or two. The model still holds at your size.
You are new to identity
Start with what identity is, and the words people use for it.
What this is
Run identity as a discipline, not a pile of tools
For years, identity has been treated as a tooling problem. Buy the platform, turn on the features, and assume clarity will follow. It does not. Technology does not create clarity. It can only enforce the clarity you already have, or expose the fact that you never had it.
The Modern Identity Operating Model is a vendor-neutral way to run identity well. It is built on five pillars that answer the questions which actually keep identity sound: who is accountable, how access begins and ends, what an entitlement really permits, whether your tools serve a model you chose, and whether the people who own decisions understand what they own.
AI does not fix identity. It exposes identity.
The same fine-grained, expiring, function-scoped access that AI agents need is the direction human access is heading too. The organizations that do well are the ones with a model underneath, so that what is true for a person and what is true for a workload follow the same shape. This book is how you build that model.
Where everything you already run fits
If you have spent years in identity, you already know the pieces. The five pillars do not replace any of them. They reorganize them around what each piece is for. Looking for authentication? It lives in Technology. Access reviews and privileged access live in Access.
| Pillar | The question it answers | What lives here |
|---|---|---|
| Governance | Who decides, who owns what, and whether the rules are written down. | Policy, ownership, decision rights, standards, exceptions, and AI governance rules. |
| Lifecycle | Whether identities begin, change, and end the way they should. | Source of truth, HRIS integration, joiner-mover-leaver, and the lifecycle of nonhuman and AI identities. |
| Access | Whether access means what you think, and is no larger than it needs to be. | Entitlements, access roles, application authorization, privileged access, certifications, and access reviews. |
| Technology | Whether your tools serve a model you defined, or quietly define how you work. | Directories, the IGA platform, provisioning, cloud IAM, and authentication, from SSO and MFA to passwordless, federation, and conditional access. |
| People & Change | Whether ownership is real and the work is shared. | Ownership clarity, communication, training, adoption, and the human side that decides whether the rest holds. |
Praise
What readers are saying
"One of the best treatments of the topic I've ever seen."
"Modern Identity Operating Model is a practical and refreshing guide for identity leaders navigating an increasingly complex digital landscape. The clear structure, practical frameworks, and chapter-end checklists provide readers with a roadmap they can immediately apply."
"The Modern Identity Operating Model turns identity from a technical discipline into a practical operating capability grounded in governance, accountability, lifecycle management, and measurable risk reduction. It gives security and business leaders a valuable framework for moving IAM from policy and theory into decisions, controls, and outcomes that strengthen the organization."
"Cuts through the identity confusion with clear definitions and delineations, essential tools, and the hard-won wisdom of years of real-world practice. Becky's book is a timely and necessary resource for all IAM practitioners and decision-makers."
"The shift from focusing on tools to building a real organisational capability is exactly what the world and domain need right now."
"This book provides practical blueprints and easy-to-apply models to focus on modern identity management challenges, while also explaining the often confusing and jumbled landscape of identity management from the views of the practitioner to the program owner."
"A thoughtful and comprehensive exploration of identity, this book brings much-needed clarity to both what identity encompasses and what it does not."
"This feels like a book that should be required college reading for anyone that is going into IT."
Progress over perfection
You are closer than the audit made you feel.
Identity does not get fixed in one heroic project. It gets better in small, real steps, and every one of them counts. Any one of these is a win worth taking.
Name one owner
Pick a single system and write down who actually owns access to it. That name is where governance starts.
One system, now owned.Ask who decides
Take one access decision and find out who is authorized to approve it. If nobody can answer, that is the finding.
One decision with a name on it.Set one expiry
Give one piece of standing access an end date. Access that expires on its own is access you never have to chase.
One thing that cleans up after itself.Review one entitlement
Take a single entitlement and ask what it actually grants. Most audit surprises start as a name nobody questioned.
One permission you can explain.Retire a stale account
Find one account nobody has signed into in ninety days and confirm whether it still needs to exist. Usually it does not.
One fewer door left open.Catalog one system
Walk one system through the catalog with its owner. One honest row beats a blank inventory every time.
One row you can defend.Start with the free toolkit.
One or two people covering security at a small company, and identity is one of several things you own? This page is written for exactly that.
Reading the book? Everything it points you to
When the book says something is at modernidentityoperatingmodel.com, this is where it lives.
- What identity is, and why it deserves the seat: the case in five minutes.
- The predictability assessment (Chapter 4): a quick, honest read of where you stand.
- Every figure, full size and in full color.
- The fillable artifact pack (Appendix B and Chapter 24), plus the additional templates the chapters introduce.
- The full Identity System Catalog (Chapter 11).
- The ownership-model reference.
- Delivery discipline, the fuller treatment promised in Chapter 12.
- The metric library and threshold guidance (Chapter 18), with the per-level dashboards.
- Each pillar’s business case, by audience (Chapter 21).
- The framework-by-framework walkthrough (Appendix C), with the framework-by-pillar coverage table and every source (Appendices D and E).
The book
Get The Modern Identity Operating Model
A practical framework for leading human, nonhuman, and AI identity.
Coming soon
Paperback and ebook. Get a note when it publishes, or explore the free toolkit in the meantime.
Buying for a team, a class, or an event? Copies for 10 or more.
Updates
New templates and guides, when they are ready
A short email when something new is published or a template is updated. No more than once a month, and you can leave any time.