Heather Flanagan

We'd definitely love to have you! Ping me if you have questions about participating.

Cool! I didn’t know that either!

Internet Shutdowns and the Reality of a Fragmented Internet Heather Flanagan examines internet fragmentation through the lens of modern internet shutdowns. Using recent, well-documented cases, she explains how connectivity is selectively constrained and why shutdowns are no longer rare emergencies but predictable outcomes of network architecture and governance. Discover how these shutdowns directly impact digital identity systems, from federation failures to lost auditability. Learn why treating the network as neutral and always available is increasingly risky, and why architects, policymakers, and identity teams must rethink assumptions about global interoperability and resilience.

Internet shutdowns make Internet fragmentation real. They’re not technically hard, and they’re becoming normal. Using Iran as a case study, this post looks at how shutdowns work, why they’re increasing, and what they mean for identity, platforms, and global interoperability.

“It is impossible to protect privacy from authoritarianism without addressing consumer privacy.” - from Daniel J. Solove, Privacy in Authoritarian Times - final published version here: papers.ssrn.com/sol3/papers.... #PrivacyMatters

This week’s mantra turned out to be: “Murder is a choice I am not making today.”

OH in a meeting: “They are like assholes. Everyone has them, and everyone should have just one.”

Inside the OpenID DCP Working Group: Issuance, Presentation, and Reality In this episode of The Digital Identity Digest, discover how the OpenID Foundation’s Digital Credentials Protocols Working Group is shaping real-world digital credential issuance and presentation. Learn why standards decisions around interoperability, credential formats, and web-based flows matter for implementers, regulators, and identity architects navigating a complex digital identity ecosystem. Discover how pseudonymous authentication, assurance profiles like HAPE, and conformance testing influence deployments and regulatory alignment. Learn why following the work of the OpenID DCP Working Group offers insight into where digital identity standards are stabilizing, stalling, and reshaping systems.

Digital credentials don’t standardize themselves. A candid tour of the OpenID DCP Working Group: what’s done, what’s dormant, and where real momentum exists—from OpenID4VC, HAIPm and conformance, to ISO alignment and hard tradeoffs.

New use for ChatGPT: write the text for an angrygram email, feed it to ChatGPT requesting a more professional version, and use that for the actual email.

Doesn't make me personally less angry, but at least I sound professional about it!

Hand knit sweater

I can haz sweater!

I could have gone a bit more drawn in at the waist, but it’s pretty good.

Now to figure out what to do with the remaining 500yards of Aran weight Shetland 3-ply.

Looking at my stats, gotta say that people do surprise me.
I didn’t expect my Field Guide to Digital Identity Standards Bodies or Web Payments and Digital Identity Standards to be the most-listened episodes of my audioblog, but here we are.
Thanks; it makes the effort to produce them feel worth it.

Finishing off the last quart of sweet cider we made this past apple season. I definitely need to make more next year!

The AI System That Never Was In this episode of The Digital Identity Digest, learn why the idea of an “AI system” is quietly breaking down under modern AI governance and deployment realities. Heather Flanagan examines how agentic workflows, standards debates, and policy frameworks are exposing gaps between governance language and real-world AI architectures. Discover how this disconnect affects digital identity, accountability, and interoperability, and why unclear definitions create governance risk. Learn why engineers, standards bodies, and policymakers are struggling to align, and why fixing AI language is essential to building enforceable, trustworthy identity and governance frameworks.

I spent winter break reading a backlog of info on AI policy, standards, and deployment. One pattern I noticed: we’ve been using the term “AI system” as a shared shorthand, even though we don’t actually agree on what it refers to in practice.

I have thoughts on that.

#AI #AIpolicy #standards

A Field Guide to Digital Identity Standards Bodies In this episode of The Digital Identity Digest, Heather Flanagan offers a practical field guide to digital identity standards, explaining how organizations like the OpenID Foundation, W3C, IETF, and FIDO Alliance shape specifications, drafts, and published standards through very different processes and cultures. Discover how to interpret standards maturity, understand what a draft really means, and evaluate where work sits in the standards development lifecycle, helping implementers, architects, and policy professionals better assess risk, readiness, interoperability, and real-world impact across the digital identity ecosystem.

This is not a thrilling post. It is a reference. I put together a field guide to how identity standards actually get made across the IETF, W3C, OpenID Foundation, and FIDO. I’ll be pointing back to this all year.

#standards #OIDF #IETF #W3C #FIDO

Process, Standards, and the AI Rogue Wave: Notes from Gartner IAM In this episode of The Digital Identity Digest, Heather Flanagan reflects on Gartner IAM and what it reveals about digital identity decision-making, identity access management priorities, and enterprise buying behavior. The conversation explores how process, not product, often drives outcomes in real-world IAM programs. Learn why overlooked process maturity, invisible identity standards, and interoperability gaps matter, and discover how AI hype distorts expectations across IAM platforms. This episode connects operations, standards, and incentives, offering practical insight for architects, security leaders, and teams navigating sustainable digital identity strategies.

My first post of 2026 is up. Notes from Gartner IAM on process vs product, where standards disappear in buying conversations, and the irony of AI hype warnings surrounded by AI marketing. Walking the floor was… instructive.

#Gartner #IAM

ICYMI 2025: What You All Read the Most This Year In this episode, Heather Flanagan looks back at the most read Digital Identity Digest posts of 2025, exploring what resonated across digital identity, governance, credentials, and AI. The recap reveals patterns behind shifting priorities, recurring debates, and the questions shaping standards work and system design. Discover how topics like agentic AI and authentication, delegation, decentralization, interoperability, and credential terminology signal where identity architecture is headed. The episode explains why governance matters more than technology alone and why clear language and standards alignment are critical for resilient, trustworthy digital identity systems.

2025’s top posts are in: AI agents, delegation headaches, governance gaps, and the slow fragmentation of the Internet. Here’s a roundup of what sparked the most discussion this year — and what these trends suggest for 2026.

Cat laying on a newly knitted sweater.

Not only is the hoodie finished, it is now feline approved and covered in cat spit.

Web Payments and Digital Identity Standards Are Converging – #TIL In this episode Heather Flanagan examines how web payments and digital identity are converging at the W3C, exploring digital wallets, browser-based APIs, and regulatory pressure shaping modern payment flows and trust on the web today as standards discussions reveal shifting assumptions across ecosystems. Discover how Secure Payment Confirmation, passkeys, browser-bound keys, and the Digital Credentials API influence fraud prevention, interoperability, and auditability, and why agentic AI, mandate-based consent, and wallet fragmentation make identity design decisions increasingly critical for payments, institutions, and users worldwide.

I spent some time with the Web Payments discussions at W3C TPAC, and wow—there’s a lot shifting between payments and digital identity. Here’s my take on what stood out based on a review of the meeting minutes.

#DCAPI #WebPayments #DigitalCredentials

If you’re wondering what the Internet has become, Cloudflare Radar offers a good overview. In the top 10, there’s nothing outside the large conglomerates. I hope we can change this trend over the next 10 years.

If you’re wondering what the Internet has become, Cloudflare Radar offers a good overview. In the top 10, there’s nothing outside the large conglomerates. I hope we can change this trend over the next 10 years.

#internet #openinternet #diversity #opensource […]

[Original post on paperbay.org]

Two APIs Walk Into a Browser: FedCM vs. the DC API In this episode of The Digital Identity Digest, Heather Flanagan explores how two emerging browser APIs—FedCM and the Digital Credentials API—are reshaping the identity layer of the web. Learn why browsers are shifting from passive intermediaries to active participants as privacy reforms and regulatory pressure accelerate. Discover how these APIs differ in governance, user experience, and architectural philosophy, and why their proximity raises questions about future convergence. In this episode, explore what this evolution means for federated login, verifiable credentials, wallet ecosystems, and the broader digital identity landscape.

How “smart” and “dumb pipe” identity APIs are reshaping the browser’s role in digital identity. What happens when FedCM and the DC API sit this close together?

#FedCM #DigitalIdentity #DCAPI #WebStandards #IdentityStandards

Knitted hoodie work in progress photo with a cat napping next to it.

Work in progress, with feline supervision.

(Tracy hoodie, patten by Cocoknits)

The Identiverse Call for Proposals is open, which means it’s officially “that time” again.
You know the time: when the hallway rants, hard lessons, and half-formed ideas either stay memes… or become talks.

If you’ve got a topic you keep wishing someone would cover—this is your sign. 📝

Four speaking engagements are now official in Q1 2026: TIIME, The Identity Salon, BSides Seattle, RSAC (this last one confirmed today).

Whew.

What I Wish I Knew When I Started in Identity In this episode, discover how today’s rapidly shifting digital identity landscape is bringing new practitioners into the field and challenging long-held assumptions about IAM, trust frameworks, and governance. Learn why even foundational concepts can feel unexpectedly complex as identity becomes integral to products, security, and global compliance. In this episode, discover how community expertise, evolving standards, and differing approaches to risk shape modern digital identity work. Learn why embracing collaboration, asking better questions, and thinking both locally and globally helps practitioners build resilient, future-ready identity systems that can adapt to constant change.

New post is live! While I’m moderating a panel at Gartner IAM, I’m sharing my own answers to “What I Wish I Knew When I Started in Identity.” Reflections, early lessons, and a few surprises.

#DigitalIdentity #IAM #IdentityProfessionals

Long haired cat, laying on top of a compression bag, paws crossed and being ever so judgy.

The paw crossing as she “helps” me pack is killing me.

I mean, srsly, I don’t know how people *live* that don’t get into their jammies and into bed with a lovely heating pad and warm blankies at 6pm every night.

Also, get off my lawn.

British public’s verdict is in: Die Hard is not a Christmas movie Survey also reveals Britons’ favourite festive film, views on tear-jerkers and family cinema trips

Look, we also voted for Brexit, and Boaty McBoatface, but my faith in the wisdom of the British people has been given a lift:

www.theguardian.com/film/2025/de...

If you want access to those reports (and the ones coming in 2026), you can subscribe here: theidentitysalon.com/sign_up/

The conversations are candid, sometimes spicy, often way ahead of where the industry is publicly. I enjoy these sessions more than just about anything I do, and the reports we publish after each one have become my favorite thing to go back and reread when I'm connecting dots.

I work with Andi Hindle and Ian Glazer on something called The Identity Salon — a small, invitation-only space where senior identity folks talk about the stuff you can’t really talk about on conference stages.

That sounds like a fun thing to do... and, done!