Evaluation to deployment
Implementation blueprints.
Vendor comparisons tell you what to buy; blueprints show you how to build it. Each one is a reference architecture for a common business model, with the core flows, data model, protocols, build-vs-buy calls, anti-patterns, and an implementation checklist.
- B2B SaaS
B2B SaaS CIAM with organizations, roles, and enterprise SSO
A B2B SaaS identity system is organized around the Organization (tenant), not the individual user. The three capabilities that make or break enterprise deals are per-organization SSO (SAML and OIDC), SCIM provisioning, and tenant-scoped roles with an audit trail. Design the Organization as the configuration boundary from day one; retrofitting tenancy later is the most expensive mistake in this space.
3 core flows · 8-step checklist
- B2C e-commerce
B2C e-commerce and consumer CIAM
Consumer identity optimizes for two things at once: the lowest-friction login that still resists fraud, and a profile plus consent model that feeds marketing without breaking privacy law. The modern default is passwordless (passkeys, social, email OTP) with a risk engine that only steps up authentication when signals warrant it, typically at checkout.
3 core flows · 8-step checklist
- Legacy migration
Migrating from homegrown or workforce IAM to modern CIAM
The safe way to migrate customer identity is almost never a big-bang cutover. It is a phased coexistence: stand up the new CIAM, dual-run, and lazily migrate each user on their next login (re-hashing or verifying their password against the old store), then cut over once the long tail is drained. The hardest constraints are password-hash portability and zero forced re-registration.
1 core flows · 8-step checklist
- Marketplace
Marketplace and two-sided platform CIAM with fraud controls
A marketplace has two user types with very different trust requirements: buyers want frictionless signup, sellers (who receive money) need verification and KYC. The design centers on a role model that separates buyer and seller, identity verification gating seller payouts, and a risk engine that concentrates friction on high-value, high-risk actions rather than on every login.
2 core flows · 7-step checklist
- Healthcare
Healthcare patient identity with proofing and HIPAA controls
Healthcare patient identity has to balance accessibility with assurance: patients need an easy way in, but the system touches ePHI, so it needs identity proofing, strong authentication, minimum-necessary access, and audit logging. Design to NIST 800-63 assurance levels (IAL2 proofing, AAL2 authentication) and to the HIPAA Security Rule from the start, and require a BAA from any vendor in the path.
2 core flows · 7-step checklist
- Agentic & API
Agentic, non-human, and API identity
As AI agents and automations act on users' behalf, identity has to extend beyond humans. The design gives every agent and workload its own identity (not a shared API key), issues short-lived, narrowly-scoped tokens, records explicit delegation and consent, enforces fine-grained authorization at the API, and keeps a revocable, traceable audit trail. The failure mode to avoid is agents inheriting a human's full session.
2 core flows · 7-step checklist