On the costliest decision in a PAM programme — and why it is rarely the one being discussed in the room.
The decision a PAM programme spends most of its meetings on is rarely the one that will most determine its outcome. The one that will is made earlier, made quickly, and made by people who do not yet know it is the decision.
[Placeholder — body text to follow. The full piece will run in late May.] The longer body of this note unpacks four positions, each held loosely, each defensible against a serious internal challenge. The first concerns the moment at which a privileged access programme commits to a model of human-to-machine identity, and why that commitment is almost always made under-discussed.
[Placeholder paragraph.] Lorem ipsum is not the firm's house style. The published note will read in the voice of the rest of the practice: full sentences, paragraphs, restraint where the temptation is to flourish. The reader will know more at the end than at the beginning. They will not feel sold to.
What the decision actually is
[Placeholder section.] A short, technical framing of the decision in question — the choice between a model that treats human privileged identity as the primary control surface and one that treats workload identity as the primary control surface — with an honest account of where the implementer's incentives diverge from the buyer's. The framing is the work; the recommendation is downstream of it.
Why it is rarely the decision being discussed
[Placeholder section.] An account of the social dynamics of a typical steering committee in month four of a PAM programme — the topics that consume the agenda, the topics that consume the corridor afterwards, and the structural reasons the two sets do not overlap. The argument is not that steering committees are badly run. The argument is that the meeting is the wrong instrument for the decision.
What a defensible record looks like
[Placeholder section.] A short worked example of the steering minute that captures this decision in a form an auditor, a successor CISO, or a regulator can read in two years and follow without further commentary. The example is anonymised. It is short. It contains the dissent.
[End of placeholder body.]