Jamal Jones
All profiles

Scorecard profile

Accelerator

Identity is infrastructure the business runs on. The work now is keeping it that way.

Take the scorecardAll four profiles

Where it sits

Identity is infrastructure the business runs on: fast for the right people, invisible when it works, and measured in terms leadership recognizes.

On most of the scorecard's questions, a typical Accelerator picks the best answer. New starters get their access on day one because of their role, requests are approved by policy or granted just in time, and leavers lose access within hours everywhere it's connected.

Business leaders see identity metrics next to operational ones, and identity is part of the business case for a new product, acquisition or partnership from the start. The program is funded against the outcomes it makes possible.

I'd argue the main risk at this band is its own success. Identity that works is invisible, and invisible programs get asked in a lean year why they cost so much. Meanwhile the business keeps adding identities the program wasn't designed for, most recently AI agents acting on their own.

A misty city avenue at dusk, every traffic signal green and cars moving through

How to recognize it

  • New starters have the access their role needs on day one, without a ticket.
  • Most access is pre-approved by policy or granted just in time, and the time it takes to grant access is a tracked metric with a target.
  • Access from an old role is removed automatically when HR records the move, and leavers lose access within hours everywhere it's connected.
  • Access reviews focus on risk, and low-risk access is certified automatically.
  • Every service account, key, certificate and agent is in a maintained inventory, and none can be created without an owner.
  • Machine credentials are short-lived and rotate automatically, and you've tested how quickly you can revoke one.
  • Partners sign in through their own identity providers by default, with scoped and time-limited access that ends when their directory removes them.
  • Customers use passkeys by default, with extra checks saved for risky actions, and sign-in success is reviewed alongside conversion.
  • Account recovery is designed and measured as a primary flow.
  • Business leaders see identity metrics next to operational ones, and identity is in the business case from the start.

Strengths

What Accelerators get right

  • Speed and safety come from the same system. When access follows roles and policy, granting it quickly and removing it quickly are the same capability, so the program doesn't have to trade one for the other.
  • The business trusts it. Teams plan around identity instead of around its delays, and leaders bring it into decisions early because it has made earlier decisions go faster.
  • And it speaks the business's language. Metrics that sit next to operational numbers let identity argue for funding in terms of outcomes, which in my view is the argument that lasts from one budget cycle to the next.

Costs

What it costs

  • The costs at this band come from being good at it.
  • Invisibility is the first. When nothing breaks, it's hard to show what identity prevented, and a program that looks effortless is an easy target for cuts.
  • Complexity is the next. Policy-driven and just-in-time access depend on rules that take real expertise to maintain, and those rules drift as exceptions pile up. Every exception granted to meet a deadline brings back a small piece of the old, manual program.
  • Expectations rise too. Once access takes minutes, a slow day is a business incident, and the tolerance for anything manual disappears.
  • And new kinds of identity keep arriving. AI agents that act on their own, and agents acting for partners, need owners, scopes and an exit process, and they're often created by teams who don't think of them as identities at all.

The usual shape of the result

Tends to lead

Time-to-yesGovernance that runs itselfIdentity and the business

Varies

Customer sign-in

Tends to lag

Machine identityPartner access

At this band, lagging means slightly behind the rest of a strong program. Workforce access and the business link lead because everything else was built on them. Machine identity is the area most likely to slip, because the population keeps growing and changing shape. Partner access depends partly on the partners: you can only federate with organizations whose own identity is ready.

Customer sign-in is the one to watch even here. A strong workforce program says little about the front door customers use, and that door is usually built by a different team.

Staying an Accelerator

These are the moves I'd keep making.

  1. 01

    Treat AI agents as part of the workforce

    Give every agent an owner, a scope and a way to be switched off before agents arrive in volume. The inventory, ownership and revocation practices that work for service accounts carry over, but agents are created faster and by more teams, so the approved way to create one has to be easier than the shortcut.

    Read The Silent Workforce
  2. 02

    Put an end date on every exception

    Give every policy exception an owner and an expiry, and review the list on a schedule. Exceptions are how an automated program slowly turns back into a manual one.

    Read Two Jobs, One Acronym
  3. 03

    Keep the metrics in front of the business

    Keep time-to-yes visible to delivery leaders, so a slow week shows up as a business problem instead of a queue. Report what identity made possible, such as how quickly an acquisition's people were working inside your systems, alongside what it prevented.

    Read The Hidden Cost of "No"
  4. 04

    Extend federation to partners' agents

    Partners will send agents as well as people. Give those agents the same scoped, time-limited federation, so an agent acting for a partner loses access when the partner's directory removes it.

    Read The Collaboration Multiplier
  5. 05

    Make recovery and passkeys a product goal

    The next gains in customer sign-in are in account recovery and passkey adoption. Product design shapes both as much as security does, so give the product team a share of the target.

    Read The Customer Experience Equation

Talking to leadership about it

At this band the conversation is about what identity lets the business do next. Lead with outcomes leadership already values, like how quickly new hires become productive or how fast an acquisition was brought inside your systems.

Don't let the story shrink to "nothing broke." It's true, it's forgettable, and it invites the question of whether the program still needs its budget.

Then point at what's arriving. AI agents and partners' agents are the next population of identities, and asking for the investment while they're still few is an easier conversation than asking after one of them has done something nobody approved.