Skip to main content
Style:
Size:

Chapter 13: Building Your IAM Roadmap

We have reached the end of the journey. You have the theory, the framework, and the target architecture. Now, you need the map to actually get there.

A Target Operating Model (TOM) tells you what you are building. The Roadmap tells you when and how you are going to build it without getting fired along the way.

If you try to implement a massive Identity overhaul in a single "big bang" release, you will fail. You will break production, lock out the CEO, and the project will be canceled by Friday.

The secret to a successful IAM roadmap is iterative value delivery. You must prove to the business that you are making them safer and faster in small, measurable chunks. We break the roadmap into three horizons.

Horizon 1: Fix the Basics (Months 0-6)​

The Goal: Stop the bleeding and secure the perimeter.

In this phase, you are not buying fancy AI security tools. You are closing the massive, gaping holes in your current infrastructure.

  1. The Orphan Account Purge: Run a script comparing Active Directory to the HR database. Disable any account that belongs to a terminated employee. (This is your ultimate "Quick Win").
  2. Phishing-Resistant MFA (Humans): Roll out FIDO2 security keys or device-bound biometrics to your highest-risk users (IT Admins, Executives, Finance). Do not roll this out to everyone yet.
  3. NHI Discovery (Bots): Run automated scanners across your code repositories and network traffic. You don't need to fix the bots yet; you just need to know how many you have.
  4. Just-In-Time (JIT) Access (Control): Revoke 24/7 Domain Admin rights from your IT staff. Implement a portal where they must check out permissions for a maximum of 4 hours.

Horizon 2: Automate, Segment & Bridge the Brownfield (Months 6-18)​

The Goal: Remove humans from routine paths, build bulkheads, and tackle technical debt.

Now that the bleeding is stopped, you start building the Target Operating Model architecture while addressing enterprise reality.

  1. HR-Driven Provisioning (Joiner/Leaver): Integrate your Identity Provider directly with the HRIS via SCIM. When HR clicks "Hired," accounts and base group memberships provision automatically. When HR clicks "Terminated," session tokens revoke immediately via CAEP webhooks.
  2. Zero Trust Network Access (ZTNA): Begin migrating applications off the traditional VPN and behind the Identity Proxy (PEP). Start with web-based SaaS and intranet portals before tackling core databases.
  3. Secrets Management & OIDC Workload Federation: Migrate critical CI/CD pipelines to OIDC federation and onboard high-risk service accounts to Secrets Vaults with dynamic rotation.
  4. Brownfield Migration & Legacy Identity-Aware Proxies: Real enterprises possess legacy applications that cannot speak modern SAML/OIDC. Rather than undergoing expensive 5-year application rewrites, place Identity-Aware Proxies (IAPs) in front of legacy HTTP/NTLM workloads to enforce modern FIDO2 MFA at the edge.

Horizon 3: Modernize & Autonomous Governance (Months 18-36)​

The Goal: Dynamic trust, relationship-based authorization, and AI workload governance.

This is where you implement the advanced frameworks we discussed in the latter half of the book.

  1. Ephemeral Tokens & SPIFFE/SPIRE (Bots & AI): Move away from static credentials toward dynamic, short-lived cryptographic SVIDs and mTLS for microservices.
  2. Continuous Certification (Mover): Roll out automated, event-triggered access reviews. Implement Continuous Certification dashboards so managers visually audit permissions rather than rubber-stamping spreadsheets.
  3. AI Security Proxies, MCP Sandboxing & RFC 8693: Deploy Model Context Protocol (MCP) isolation and OAuth Token Exchange for internal agentic AI deployments, enforcing Human-in-the-Loop circuit breakers for high-risk mutations.

Visualizing the Timeline​

A successful roadmap relies on strict dependencies. You cannot implement ZTNA (Horizon 2) if you haven't deployed Phishing-Resistant MFA (Horizon 1).

Interactive Tool: The Roadmap Dependency Explorer​

Adjust phase durations and explore how upstream delays affect downstream Horizon 2 & 3 milestones:

IAM Roadmap & Critical Path Dependencies

Adjust foundational milestone durations to see how dependency delays cascade across Horizons 1, 2, and 3.

Prerequisite for ZTNA Migration.

Prerequisite for AI Guardrail Proxy.

M0
M6
M12
M18
M24
Horizon 1 & 2 (Human Workloads)
FIDO2 MFA Rollout (3m)
ZTNA Network Migration (5m)
Horizon 2 & 3 (Non-Human & AI Workloads)
Secrets Vault Migration (6m)
AI Guardrail Proxy Deploy (4m)

The Final Review: The 5 Pillars of Success​

As you execute this roadmap, your project will veer off course. A vendor will overpromise, a stakeholder will push back, or a new AI capability will completely disrupt your architecture. When you get lost, step back and evaluate your current challenge against the 5 Pillars:

  • People: Are the owners clearly defined, and is the leadership team trained on the changes?
  • Process: Are we automating a good process, or just speeding up a broken one?
  • Technology: Is the software enforcing the Zero Trust architecture, or are we falling back to legacy flat networks?
  • Control: Are we applying the right guardrails (MFA, JIT, Scoped Tokens, MCP isolation) to the right identities?
  • Impact: Are we successfully reducing the blast radius of a breach?

💡 Scenario & Solution: De-nesting Toxic Active Directory Groups in a 20-Year-Old Enterprise Without Breaking Production​

The Scenario: A Fortune 500 manufacturing firm has an on-premises Active Directory environment with 12,000 security groups. Over 20 years, IT administrators nested groups 8 layers deep (e.g., All_Contractors is nested inside Engineering_Tools, which is nested inside Domain_Admins). When the IAM team tries to delete a legacy group, production ERP systems fail because an undocumented service account was inheriting database access through the nested tree.

Why It Happened: Uncontrolled group nesting created invisible, circular permission inheritance that made direct deletion extremely risky.

The Architecture Solution:

  1. Graph-Based Entitlement Analysis: Deploy an identity analytics tool (or run BloodHound / PowerShell graph queries) to map the entire AD DAG (Directed Acyclic Graph) of group memberships.
  2. Shadow Audit Logging: Enable AD Event ID 4627 (Group Membership Enumeration) on domain controllers to monitor which specific nested groups are actively evaluated during production Kerberos ticket granting.
  3. Flatten & Replace via RBAC/ABAC: Identify unused nested branches (over 90 days inactive), construct flattened direct role groups, and link them to modern Cloud IdP SCIM assignments before systematically deprecating the legacy nested containers.

If you can answer those questions confidently, you are not just building an IAM program. You are building an organization that can survive the chaotic, inevitable transition from Human Workloads to the Autonomous AI Future.

Good luck out there.