Conversation

so yeah I really think that we need some tooling to allow for streamlined NIST 800-207 section 4.4 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf - "Zero Trust with collaboration across enterprise boundaries" - access limitations with semi-automated self-service provisioning of access credentials.

if we're going to be seeing the aipocalypse and finding every service continually getting pwned over and over again, then building tooling to mitigate the blast radius of any particular service being pwned by an attacker is only sensible.

the lack of a simple, easily deployed services stack here means that anyone trying to implement this has to fight with half a dozen different tools (lol LDAP and its friends) and maintain, effectively, an ops department to manage it - something that's not very feasable for small orgs.