Conversations I’ve had recently with knowledgeable people in the industry are leading me towards a roadmap, or maybe an atlas – or, possibly, a timeline of identity services. That is, there seems to exist a continuum along which your identity projects should travel beginning with identifying the users and other objects in your system.

My friend Archie Reed (he’s a “distinguished technologist” in HP’s Security Office) – even though he violently disagrees with me – helped me to better define the object that is a virtual directory and place it in the identity system context. This is needed to get from the multifarious identity stores throughout the enterprise to a single one, at least as perceived by other applications and services. This then enables a provisioning system to normalize and standardize authentication systems throughout the organization – from account setup through single sign-on to automated password reset.

Later, in chatting with Brian Cleary, Aveksa's new vice president of marketing, we agreed that provisioning needed to be in place in order to successfully implement role management. But roles, by themselves, aren’t much good for anything. Rather, roles are a necessity in order to build a reasonably effective entitlement management solution. Even Bridgestream’s vice president of marketing Ed Zou (with whom I also spoke recently) was willing to admit that roles aren’t an end in themselves but a building block for more “interesting” activities.

It’s roles plus rules that provide the fine grained access control that entitlement management promises. But we can now see that entitlement management isn’t the end point; it’s just another marker on the road to a fully implemented identity service. There’s another necessity for entitlement management which really doesn’t play in the role space and that’s the “identity of things” – objects (computers, printers, phones, cars, conference rooms, etc.), applications and services - which are the targets of the entitlements that are managed.

Once the entitlement management, with its fine grained access control, is in place we can move on to the next major plateau – context-based access. That’s even finer grained control, because it can vary by time-of-day, day-of-the-month, user-location, state-of-the-target and just about any other contextual condition we can measure: who, what, when, where, how and maybe why some user (in some role) wants to access some thing (in accordance with some rule).

Dave Kearns is a consultant and editor of IdM, the Journal of Identity Management.