-
The Joins Nobody Owns: How Identity, Asset, and Rotation Registries Get Wired Together
The last essay in the identity series ended with a promise: the next thread would cover the joins. This is that essay — why the join between your identity provider and your asset inventory is a maintained artefact with an owner, what happens to an exercise when the join is stale, and why the join work is where a quarterly cadence quietly dies.
-
Quarterly Cadence: How Identity Purple Teaming Survives a Year in a Regulated Environment
The first three essays in this thread built the framework. The fourth is the one the framework was for: what happens when the same exercise runs four quarters in a row in the same environment, against the same boundary, with the previous gap list as its scope. This is a longitudinal essay — one anonymised regulated environment, four quarterly runs, the deltas in the gap list, the CDE model, the response time, and the evidence pack. It closes the identity series with the thing the previous essays deferred: a cadence that survives a year.