I help product teams design and operate authentication and authorisation systems that remain secure, understandable, and maintainable as the product grows.
>>> What I help with
- Choosing between Auth0, Keycloak, or custom OAuth - based on product and risk profile
- Designing OAuth/OIDC flows for public clients, with explicit control over token exposure
- Defining authorisation boundaries that survive team and product growth
- Stabilsing or migrating existing identity systems without user disruption
- Designing and evolving core user identity models — from initial user records to long-term lifecycle management
>>> Background
I've worked with authentication at multiple levels: implementing OAuth 2.0 flows for public clients in security-sensitive applications, operating a self-hosted identity provider, and integrating managed identity platforms while defining application-level authorisation models. This has given me a practical view of where identity decisions tend to fail — and how to avoid that.
>>> Areas of focus
- —OAuth 2.0 / OpenID Connect (PKCE, token lifecycles, client types)
- —Identity platforms such as Keycloak and Auth0
- —Role and policy-based authorisation models
- —Security-sensitive and regulated contexts
- —Authentication review, migration, and recovery scenarios
- —User identity data modelling and lifecycle management (provisioning, retention, deprovisioning)
>>> How I work
- Prefer early involvement, where identity decisions are still cheap to change
- Document assumptions and trade-offs so teams understand what they're accepting
- Comfortable owning both architectural decisions and their production implementation when required
- Opinionated when needed, conservative by default
>>> Good fit
- +SaaS or product teams handling sensitive data
- +Teams without a dedicated identity specialist
- +Products past the "prototype" phase
- +Teams needing to architect login flow or session management
>>> Not a fit
- −Quick hacks or bypassing security standards
sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855