A Fireside Chat between Mike Cook, CEO of IDENTOS, and Eve Maler, Founder of Venn Factory

In 2026, healthcare networks and public sector organizations are facing a massive modern challenge: how to securely share data across deeply fragmented, independent systems without overwhelming users with security friction. Traditional security boundaries are breaking under the demand for instant, connected services.

To explore why so many high-stakes digital transformations lose momentum at the implementation phase, IDENTOS CEO Mike Cook sat down with digital identity pioneer Eve Maler—co-creator of global standards like SAML (Security Assertion Markup Language) and UMA (User-Managed Access), and author of the new book, Mastering Digital Identity: From Risk to Revenue. What follows is an unvarnished look at the “Execution Gap” between identity theory and deployment reality.

‍

Mike Cook: Eve, it’s great to sit down with you. I was actually thinking back to when we first met in D.C. and you introduced me to Alice and Bob. Before meeting you, I wasn’t an identity nerd under the hood; I was just looking at the human outcome—thinking about my mom, her health, and how hard it was to navigate a siloed system. That's what IDENTOS was born out of. You and the UMA group called yourselves UMAnitarians, and I think that shared focus on the human side of data sharing is why we’ve always been so aligned.

Eve Maler: Oh, Alice and Bob! They are the classic characters everyone in cryptography and identity has to know. For anyone reading who isn't a tech geek, Alice and Bob are the standard placeholder names we use to map out how real people interact with security systems, instead of using dry terms like "Party A" and "Party B." And you're completely right, Mike—the whole reason we called ourselves UMAnitarians is because we were looking at how to give “Alice” control over her data when she wants to share it with “Bob.” It was always about supporting real-world human relationships, not just protocols.

Mike Cook: And looking at the broader market today, leaders are still struggling to support those relationships. First, congratulations on the launch of Mastering Digital Identity. It’s a book about how identity is really an organization's business model in disguise, and how to design it with intention before failure forces the issue.

I just wrapped up a meeting with a provincial government minister and their newly appointed Chief Digital Officer. It struck me during our talk that leaders are still deeply paralyzed by the fundamental question of how to securely connect massive, siloed legacy entities. In your book, you write about the “CEO's Identity Death Spiral”: the moment an executive realizes identity is a survival problem, not an IT problem. In your experience, why do brilliant leaders still treat identity like basic utilities or plumbing?

Eve Maler: To answer your question, the day-to-day work of digital identity and access management routinely feels like either invisible IT infrastructure or purely a restrictive security control to an executive. Both are woefully incomplete pictures of the positive and negative impacts of digital identity.

When the CEO, the board, and C-suite leaders sit down to work on major strategic initiatives, it is incredibly rare for them to include identity-focused programs in that mix. They leave it to the geeks. But as I advocate in the book, we have to start treating identity as a product, and its owner must act like an Identity Product Owner. This shifts the executive focus to product-market fit, converts internal stakeholders into actual customers, and brings in all the best practices built up around product management disciplines.

Mike Cook: We see that “infrastructure bias” play out in the field constantly. Projects stall or lose funding because they are viewed by procurement as a cost-center “buzzkill” rather than a true driver of modern citizen services.  In my conversation with the provincial minister I could see a predictable tipping point in the discussion.  The head nods come when you flip the script from securing access across silos of government to empowering citizens across silos of government.  How can leaders use your Four Ps framework — Protection, Personalization, Payment, and People — to fundamentally shift that mindset?

Eve Maler: There are three specific moves leaders can make to pivot away from that mindset. First, they need to gain support to reframe identity as a product rather than merely a perimeter, as I mentioned. Second, the Identity Product Leader can now battle the zero-sum thinking that’s common in identity and access management, where it’s always security vs. experience, or risk vs. reward, by optimizing outcomes across those Four Ps: the identity elements that simultaneously impact risk, go-to-market, transactions, and human connection. Finally, they need to tune the success metrics for their programs to be board-relevant across all of these elements.

Take a real-life example like a customer call center. If you look at customer authentication  through a single lens, you fail. It’s common to find ineffective and unpleasant methods being used, such as having the help desk staffer quiz the caller about whether they know facts found in the customer profile. But if you strive to improve security and fraud, customer experience, upsell, and loyalty all at once, you can optimize for methods that work better on every measure, such as sending a verification challenge to their mobile device during the call. When we think about consumer, citizen, and patient interactions in 2026, these are examples of high-expectation users. We aren’t the boss of them. We have to serve highly diverse user bases with complex constraints, which means putting extra effort into increasing security and privacy all while serving individual human needs carefully.

Mike Cook: That brings up a massive gap in how the market buys technology. Most enterprise executives associate identity strictly with Single Sign-On, the login box. They think once they’ve enabled a user to log in, the job is done. But you’ve co-created the foundational protocols of the web, including XML, SAML, and UMA, and you openly admit that identity is still the “red-headed stepchild” of many organizations. From your perspective, where is the industry getting stuck between having a standard and actually delivering a trusted solution?

Eve Maler: The login box is often an executive's entire world. But a standard is only a small part of the big picture. Identity management, and standards like SAML, are designed to deliver key identity signals into a decision-making flow, namely identification, authentication details, and attributes about the user.

But those signals are not themselves the decision. The decision is where it gets a lot harder. For every one login, there are exponentially more operational decisions that have to be made downstream. This is where business logic and application semantics get bound up into the problem. Written authorization policies must account for real-time operational semantics, which is a much more complex space, but much more satisfying because you’re actually getting to an answer about what to do with the specific person standing in front of you.

Mike Cook: In the industry, we hear everyone trying to solve this by talking about an "Identity Fabric." It’s an evocative phrase, but sometimes it just feels like another layer of language that obscures what's happening under the hood.

If we strip away the marketing language and pedestrianize it for an executive, what are we actually talking about? At IDENTOS, we look at the Identity Fabric as a way to unify all those different pieces. It takes the entry-level identity management signals—things like provisioning credentials, account creation, and MFA verification—and stretches that fabric over the real-time data needed for decisions. It connects who a person is to their dynamic relationships, transaction-level data, and business compliance rules.

Eve Maler: Exactly. It’s about how you make those pieces travel together. I see it as enabling a "consent fabric"—how do you actually make permissions and authorizations for data sharing travel across independent rails to respect and prove a user's wishes?

A great example of this evolution is happening in the financial standards world with things like Rich Authorization Requests (RAR). It's been called “OAuth scopes that don't suck”. Instead of traditional, rigid access buckets, we can now get down to the precise transaction level. But to execute that, the application has to interface with specialized, real-time data structures. That’s where the fabric comes in. It provides the substrate. If an organization has low maturity around that basic substrate, they are going to struggle to put any advanced authorization or privacy solutions in place.

Mike Cook: Relying strictly on the login box creates an illusion of choice, forcing citizens or clinicians to re-authenticate and re-consent across a dozen different fragmented software applications. That reality ties directly into another concept from your book that I absolutely love: “Consent Theater.”

In healthcare and the public sector, digital consent is usually a compliance charade, a paper signature trail or an annoying cookie banner we click just to clear the screen. I am currently in the “sandwich generation,” managing health data and settling digital estates for aging family members, and the friction is unbelievable. How do we move past this theater into what you call “Mutual Agency”?

Eve Maler: Most end-users in our connected world have dissatisfaction levels that are completely off the charts because of this. Digital consent forms and checkboxes today lack meaningful legal or ethical weight. Think of protocols like OAuth, which focus extremely little on the actual “systems of engagement” surrounding authorization.

My husband has a saying: “As soon as you solve your most important problem, your next most important problem gets a promotion.” Now that we’ve made strides in baseline authentication, authorization and permissions are getting a promotion. We need a “consent fabric” where authorizations for data sharing actually travel with the individual. Permissions shouldn't be trapped in isolated applications; they need to be a transparent, first-class resource that users can manage via a dashboard and retract at will to build genuine, mutual trust.

Mike Cook: Treating consent as a first-class, queryable resource was actually the exact design thesis we used when building our platform. And that requirement is scaling rapidly because the “users” are changing.

You state in the book that non-human identities already outnumber humans by a factor of as much as 50, warning that AI has weaponized every security weakness we've tried to patch. If a government or healthcare CIO looks at your “Make Your Vision Actionable”℠ methodology, how does anchoring identity programs in what you call “nanovisions” prepare them for this era of Agentic AI?

Eve Maler: A nanovision is a statement of belief that enables an identity program to serve the higher purpose of the organization as a whole. This type of anchoring is critical because there’s no turning back from AI; "Agentic" was the buzzword of 2025, and 2026 is the year of “Intent.” Now we have to govern what those agents are trying to do. We have worked so hard as an industry to enforce the principle of least privilege, but an autonomous AI agent is fundamentally a most privileged engine. If it is trying to serve a vaguely expressed human intent, it will go to the ends of the earth to fetch an answer, which results in lateral movement across systems — a scary prospect.

By applying the Four Ps to AI agents and anchoring your identity and access roadmap to the organization’s highest vision and strategy, you can prioritize innovation that delivers on what is still a very difficult proposition: real, auditable governance over chains of human-in-the-loop consent, delegation to sub-agents, and authorized agentic actions.

Mike Cook: This is where traditional Role-Based Access Control (RBAC) completely falls apart. In clinical healthcare, a doctor’s static role doesn't change, but their relationship context — which patient they are treating, at what clinic, and at what hour, changes by the minute. You can't secure an AI agent or a dynamic medical team with a static role lookup.

At IDENTOS, we built a “Relationship Engine” focused entirely on Policy-Based Access Control (PBAC). It allowed us to show governments that they could integrate complex ecosystems via policy rather than hardcoding endless pairwise connections. How do you see this relationship-aware architecture acting as the ultimate unlock for the execution gap?

Eve Maler: There is an immense amount of business value that this kind of relationship layer provides. As we discussed, SAML is a “just the facts” standard for singular identities. But identity relationships, such as patient-to-provider, parent-to-child, or human-to-agent, contribute a completely different class of rich signals. These signals sit much closer to actual, real-time business decisions about data sharing.

The healthcare and public sectors are massive, highly risk-averse ecosystems composed of semi-independent entities with a special duty of care to humans. If policy-based access control allows these groups to integrate in a lighter-weight, dynamic fashion, it becomes an incredibly powerful unlock, especially when paired with AI to make data-sharing transparent, fresh, and fully auditable.

Mike Cook: I couldn't agree more, Eve. Moving from static perimeters to a dynamic relationship layer is the only way we give clinicians their time back and keep data safe. Thank you for sitting down to map out this frontier with me.

About the Authors

‍