A Brutalist Approach to Identity and Access Management

Brutalist Identity and Access Management (IAM) is not a new framework, but a return to first principles: reduce complexity, eliminate unnecessary trust, and make every identity, permission, and authentication path explicit, visible, and auditable.

Every identity, whether human, service, workload, API, or AI agent, must have a clearly defined purpose. Access should be granted using least privilege, continuously verified, and revoked as soon as it is no longer required. No identity is trusted simply because it exists inside the environment.

Human authentication should move toward passwordless methods such as passkeys, hardware security keys, biometrics, or platform authenticators. Where passwords remain, they should be unique, protected by MFA, and managed through password managers. Identity lifecycle management must be automated, with provisioning and deprovisioning tied directly to authoritative business systems.

Privileged access should be rare, isolated, and ephemeral. Standing administrative privileges should be eliminated wherever possible in favor of Just-In-Time access with strong approval workflows and automatic expiration. Administrative actions should be fully logged, continuously monitored, and regularly reviewed.

Non-human identities now outnumber human users in most organizations and require the same discipline. Service accounts, workloads, APIs, and AI agents should authenticate using short-lived tokens, certificates, or workload identities rather than static secrets. Long-lived credentials should be aggressively eliminated. Secrets that cannot be removed must be stored in secure vaults, rotated automatically, and continuously monitored for misuse.

AI agents introduce additional identity challenges because they combine identity, automation, and delegated authority. Agent identities should operate with tightly scoped permissions, explicit tool access, immutable logging, and strict separation between instructions, data, and credentials. Every action taken by an agent must be attributable, auditable, and reversible.

Brutalist IAM reduces risk by shrinking trust boundaries and eliminating ambiguity. The fewer identities you have, the less standing privilege you maintain, and the shorter the lifetime of credentials, the harder the environment becomes to compromise.