Nine months ago, if someone had asked me about OAuth, OIDC, authorization policies, or identity infrastructure, I probably would have smiled, nodded, and quietly changed the subject.
Today, I spend most of my days working around these concepts.
I'm a product marketer at MonoCloud, and while I'm not an engineer, I work closely with people building identity infrastructure for users, APIs, services, and AI agents. The more conversations I have, the more architecture diagrams I stare at, and the more product decisions I unpack, the more convinced I become of one thing:
Authentication is one of the most underestimated challenges in modern SaaS.
Not because it's new.
But because the world it was designed for is disappearing.
For a long time, authentication was relatively straightforward. A user visited an application.
They entered a username and password.
The system verified their identity.
A session was created.
Access was granted.
The application knew who the user was, and that was usually enough.
For many products, authentication was treated as a solved problem. Teams picked a provider, implemented login, issued tokens, and moved on to building features that felt closer to customer value. And honestly, that approach made sense.
The internet was primarily human-driven.
Humans logged in.
Humans clicked buttons.
Humans made decisions.
The authentication layer existed mainly to answer one question:
"Who is this user?"
Today, that's no longer sufficient.
The systems we build today look very different from the systems authentication was originally designed for.
A modern SaaS product rarely consists of a single user interacting with a single application.
Instead, we have:
Identity is no longer just about users.
It's about everything acting within a system.
And every new actor introduces new questions.
Not just who they are.
But what they're allowed to do.
One of the biggest lessons I've learned while exploring this space is that authentication and authorization are often discussed together but solve very different problems.
Authentication answers:
Who are you?
Authorization answers:
What are you allowed to do?
The distinction sounds obvious until systems become complex.
A user may be authenticated successfully but still shouldn't have access to sensitive data.
An integration may be trusted but only for specific operations.
A service may be legitimate but should only access resources within a defined scope.
An AI agent may be acting on behalf of a user but shouldn't inherit unlimited permissions simply because the user authenticated earlier.
The moment we move beyond simple login flows, authorization becomes just as important as authentication.
And in many cases, significantly harder.
This becomes even more interesting when AI enters the picture.
AI agents don't behave like traditional users.
They're not opening a dashboard once a day and manually completing a workflow.
They're increasingly being designed to:
That changes the identity conversation entirely.
Consider a simple question:
If an AI agent performs an action, whose action was it? The user's?
The application's?
The organization's?
The agent's?
The answer isn't always clear.
And that ambiguity creates new challenges around trust, accountability, and security.
We're beginning to see questions emerge that traditional authentication systems were never designed to answer:
These aren't theoretical discussions anymore.
They're rapidly becoming product requirements.
It's easy to think of authentication as a security team's concern.
But increasingly, identity decisions affect product strategy, customer trust, and business growth.
Enterprise customers want clear access controls.
Compliance frameworks demand auditability.
Developers expect secure defaults.
Users expect transparency around who can access their data.
And AI-powered experiences require entirely new models of delegation and trust.
At some point, identity stops being a backend implementation detail.
It becomes a product decision.
The organizations that treat it as infrastructure alone may find themselves struggling to adapt as systems become more interconnected and autonomous.
What fascinates me most is that we're entering a period where identity is expanding beyond human users.
We're moving toward a world where applications need to understand:
And they need to manage trust relationships between all of them.
The industry is still figuring out what this future should look like.
There are emerging standards.
There are evolving best practices.
There are strong opinions.
But there are still many open questions.
Which makes this one of the most interesting spaces to learn about right now.
I'm still early in my journey learning about identity, authentication, authorization, developer infrastructure, and AI systems.
I don't claim to have all the answers.
What I do have is curiosity.
I get to work alongside people building these systems, and every week I find myself discovering concepts that completely change how I think about software, security, and product design.
This blog is my way of documenting that learning process publicly.
Over the coming months, I'll be writing about:
Not as an expert teaching from a pedestal.
But as someone learning in public, asking questions, and sharing insights along the way.
If you're building in identity, AI, developer tools, infrastructure, or SaaS, I'd love to learn from your perspective too. Because the deeper I go into this space, the more convinced I become that authentication isn't a solved problem.
It's becoming one of the defining challenges of modern software.