People Over Protocols: Lessons From The Identity Front Lines

Forbes

4 days ago

Gerry Gebel, Strata Identity Head of Standards, former Burton Group analyst and tech executive at Chase Manhattan Bank (now JPMorgan Chase).
'Tech is easy. People are complex.' That quote, from GE Aerospace's Chief Information Security Officer, Sulohita Vaddadi, in a recent episode of my company's video series, The Identity Heroes, echoes similar comments I have heard from others in the past.
After more than two decades in identity and access management (IAM)—working on standards, protocols and platform strategy—it was a good reminder to reinforce the importance of the human element. Co-hosting The Identity Heroes reminded me many times: The most complex challenges in identity usually aren't technical. They're human.
In dozens of conversations with CISOs, CTOs, architects and policy pioneers, one theme kept surfacing: IAM may be built on code, but it's people who make it run—our judgment, our alignment and our ability to communicate.
As AI agents and machine identities emerge, keeping the human in the loop has never been more critical.
Many Roads To Identity
One of the most refreshing insights from the series so far has been how few identity leaders set out to work in IAM. They found it by accident—or rather, it found them.
Sulohita started in biomedical engineering before becoming a CISO at one of the largest industrial companies in the world. Eve Maler, who was the first chair of the SAML standard, was originally trained in linguistics. I've spoken to identity professionals who began in marketing, audit, military intelligence, theater, even selling carpets.
There's a pattern here. Identity attracts problem-solvers. The field is messy, dynamic and spans every layer of modern enterprise infrastructure. But because IAM didn't even exist as a formal practice 25 years ago, today's leaders often learned the hard way—by being handed tangled systems, impossible deadlines and finding a way to deliver value to the project.
If you're new to identity and wondering if you belong here, you do. There's no one path to becoming a leader in this field. Curiosity, resilience and empathy will get you further than any certification.
Humans In The Machine
Yes, you need to understand policy engines, protocols and lifecycle management. But none of that matters if you can't navigate the human dynamics surrounding identity.
Sulohita shared an example of ending a major identity project—not because the technology was flawed, but because the business stakeholders weren't aligned. Despite a solid technical plan, the initiative lacked shared ownership, timely engagement from key stakeholders and clear communication around priorities.
Rather than force a solution into an unreceptive environment, she made the call to stop the project early. In her words, 'It would've failed silently'—not due to a misconfigured system, but because the people who needed to support it weren't ready or bought in.
Eve Maler reminded me that consent isn't a checkbox—it's a conversation. The challenge of identity isn't just verifying someone's claims—it's embedding user agency and trust into the system architecture. It's part of the challenge when we attempt to replicate human, in-person interactions in an online space.
That's what 'human-in-the-loop' means to me: Identity decisions that require human judgement, context and accountability. You can automate provisioning. You can't automate judgment.
Here are the core skills that I've learned matter most in IAM, and why they matter:
• Communication: Get alignment from non-technical stakeholders.
• Empathy: Understand real-world user behavior, not just edge cases.
• Risk Fluency: Navigate compliance, liability and business risk.
• Adaptability: Evolve alongside regulations and organizational priorities.
Tools change. Standards evolve. But these skills endure.
Ushering In The Next Generation
If you're already working in IAM, you know how complex the job can be. But you also have the chance to shape the next generation of leaders—and they need more than just playbooks.
Here's what I tell new entrants to the field:
• Learn to explain IAM in plain language. If your business peers don't understand what you're doing, a project won't get funded. Go beyond the technical details—clarify how identity supports their goals. Like seamless onboarding for HR, compliance for legal and risk reduction for security. When stakeholders see how IAM ties to business outcomes, they're more likely to support it.
• Expect ambiguity. Identity spans HR, legal, IT, security and business units. Navigating gray areas is part of the job. Each group brings different expectations and priorities, so it's your job to bridge them. Make it clear why identity matters to them, and build consensus by showing how your project advances shared business goals.
• Tie identity to what each department cares about. It's not enough to say IAM is important—you have to show why it matters to marketing, finance, HR or legal. Frame identity in terms of their priorities: faster access to tools, cleaner audit trails, smoother customer experiences. When each team sees how your project supports their outcomes, it stops being 'your' initiative and becomes ours.
• Own your missteps. Some of the best leaders I spoke to got there by learning from failed rollouts, missed audits or painful retros. No one gets through their career with zero errors or mistakes; it matters how you handle those situations and move forward.
• Find a mentor—and become one. The field is still small enough that relationships matter. Mentors, in one way or another, have had a huge impact at different points in my career. One of the most lasting impressions you can make is to help mentor someone who is finding their way in our industry. Pay it forward.
And for senior professionals: Be vocal about the human side of identity. Encourage your teams to think in terms of risk, clarity and consequence, not just configuration.
After all these conversations, one thing stands out: Identity and its associated technology are the infrastructure of business, but they still require people to design, build and operate.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?