Deepak Gupta

A Phased Build Roadmap

Build in four phases and do not start a phase until the previous one has passed its gate. Each phase should be something you could run in production on its own, so the project delivers value even if priorities change.

Phase	What ships	Planning estimate	Gate before the next phase
1. Minimum viable login	Email and password, sessions, verification, reset, rate limiting, audit events	2 engineers, 2 to 3 months	Gate 1
2. Consumer-grade	Passkeys, MFA, social login, breached-password checks, recovery	3 to 4 engineers, 6 to 9 months	Gate 2
3. Platform-grade	OAuth and OIDC provider, SAML SSO, SCIM, multi-tenancy, admin console	5 to 8 engineers, 12 to 18 months	Gate 3
4. Enterprise-grade	Multi-region, data residency, SOC 2 and ISO 27001, 99.99% target, 24x7 on-call	A permanent team of 8 or more	Ongoing audits

The durations are my planning estimates from Chapter 1, assuming the team sizes listed there. The gates matter more than the dates: shipping SSO before you have passed a malicious-SAML test suite is how in-house identity systems end up in breach reports.

What each gate proves

Gate	Proof required before the next phase
Gate 1	Third-party penetration test of login, reset, and sessions passed; load test including a credential-stuffing burst passed; audit events flowing
Gate 2	Passkey share of successful sign-ins rising week over week; every recovery path tested with and without MFA; breached-password checks live
Gate 3	OpenID Foundation conformance passed; SAML malicious-response suite passing; SCIM tested against major IdPs; key rotation rehearsed

Staffing the long run

After phase 4, identity does not get smaller. Plan for a permanent team that owns protocol upgrades, browser and OS changes, library patches, audits, incident response, and the next standard that lands. In my experience, the teams that succeed treat identity as a product with a roadmap, not as plumbing that was finished once.

A closing question

If you have read this far and still want to build, you probably have a real reason. So here is the question I would ask your team before the first commit: who will own this system five years from now, and what will they need from the decisions you make this quarter?

Key takeaways

Build in four phases, each runnable in production on its own.
Gates matter more than dates: never ship SSO before a malicious-SAML suite passes.
After phase 4, identity does not get smaller; staff a permanent team with a roadmap.

About the author

Deepak Gupta founded LoginRadius in 2013 and scaled it to serve more than 1 billion users, building its authentication, single sign-on, and multi-region infrastructure and helping define what is now called customer identity and access management (CIAM). In 2024 he started GrackerAI, which does Generative Engine Optimization for B2B cybersecurity vendors.

He holds 5 granted patents spanning DDoS defense, IoT authentication, searchable encryption and AI fake-news detection, and has written 6 books. As a former CISO he has been through SOC 2, ISO, GDPR and CCPA audits. He runs two practitioner communities, Start with Identity and LogicBalls, and maintains the CIAM Compass vendor directory. More at guptadeepak.com/about.

Sources

Standards and specifications

Password storage and policy

MFA and threats

Compliance and privacy law

All sources accessed November 2026.