To understand digital trust, start with a workflow people depend on. Trace the identities and access it uses, make ownership visible and ask how those relationships will be maintained when something changes.
Begin with something that needs to work
The login succeeds. A record opens. A service retrieves information from another system. To the person using it, everything looks ordinary.
Behind it are decisions about identity, permission and responsibility. A useful security question is whether those decisions still make sense.
Look at the connections
Imagine an application retrieving customer information. It has an identity, a way to authenticate and permission to reach certain records.
Now its purpose changes. Who reviews the access? If its credential expires, who understands the dependency? The connection needs attention beyond the moment it was created.
Make responsibility visible
For one important relationship, record the resource, the identity, the purpose of access, its owner and the next review point.
That record should help a person make a decision. An inventory can contain a great deal of information and still leave a team unsure who should approve a change.
Think beyond the first setup
People move roles. Applications are replaced. Keys and certificates need renewal or retirement.
Following that lifecycle connects the technical design with everyday responsibility. It makes a hidden dependency easier to recognise before it interrupts something people rely on.
Bring it back to the business
Start with one useful workflow. Trace what it trusts and who keeps those relationships working.
The result is a conversation people can act on: what needs attention, why it matters and who owns the next decision. That is a useful step beyond knowing which products are installed.
IDEAS TO TAKE WITH YOU
- Trace one workflow and the access it depends on.
- Give each important access decision an owner.
- Include review, renewal and retirement in the conversation.
Which important connection would be hardest to explain if its original owner left?
Explore the background.
These references offer context for the questions in this essay. The perspective above is personal.
- NIST SP 800 207: Zero Trust Architecture
Background on resource focused authentication and authorisation.
Anas Kamlani
Anas Kamlani hosts a conversation across technology, business, ownership and the places we build our lives.
The story behind this spaceWhich part stayed with you? Bring a question, a lived experience or a different way of seeing it.