Verification level answers who a persona provably is, established once and true forever. Session assurance answers something else entirely - how strongly the current login just proved it - and it has no business being stored as a fact at all.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
What Claude Code got wrong building the apidays demo (and how I caught it)
· Auth0 FGA, AI Agents, MCP
Part two of the apidays workshop series moves from planning to building. Claude reversed a hosting decision that turned out to be solving a problem that never existed, then quietly let a fourth infrastructure provider into a build I'd explicitly ruled out - twice.
Why an apidays workshop proposal had to be replanned from the requirements up
· Auth0 FGA, AI Agents, MCP
An adversarial review of a conference workshop's build plan found a genuine structural flaw in its Auth0 FGA model, not a polish problem. The check it ran on a citizen's own record was trivially always true, which meant the demo's actual premise - authorising an AI agent acting on someone's behalf - was never being tested at all.
Building Genuinely Ephemeral Sessions with Auth0 Actions and Next.js
· Auth0, Customer Identity Products, Actions
Auth0's Manage Sessions with Actions APIs let a Post-Login Action set a non-persistent cookie mode and short expiry on the Authorization Server's own session. Getting a genuinely ephemeral login end-to-end took matching that on the app's own session too, and an access token that turned out not to be a JWT.
Auth0 Token Vault: Connecting Google Calendar and GitHub on a User's Behalf
· Auth0, Customer Identity Products, Identity Security
Auth0's Token Vault lets your app call Google or GitHub APIs with a user's own consent, without the user's password ever touching your app. Getting it working end to end took five separately-gated prerequisites, each with its own unrelated-looking error message.
Adversarial review, real bugs, and dead ends: building an OpenFGA model with Claude Code
· Auth0, Customer Identity Products, Auth0 FGA
An adversarial review across two different AI models caught a real OpenFGA semantics bug in the model behind this series, and also produced confident, specific-sounding nonsense that didn't survive being checked. Both outcomes are worth writing up.