1 min lesson

Readiness scorecard & gap plan

Put this idea into your own words: "Anything under a 4 is a gap that gets a plan."

End the prep where the loop will test you: a cold self-assessment across every dimension, each gap mapped to the exact section to revisit and a 3-day plan to close what's left. The loop grades your floor, so a single weak axis is what sinks an otherwise strong candidate.

Treat the rubric as a gap finder, not a score to admire. Mark the weakest proof, turn it into one practice rep and keep the artifact you would show an interviewer.

Rate yourself 1–5 on each row below. Be honest - a 5 you can't defend in an interview is a 2. Anything under a 4 is a gap that gets a plan.

Learn more

Advanced table

The loop screens the floor

Dimension: Identity protocols
A 4–5 means you can…: Explain SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. vs OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition./OAuth flows (auth-code + PKCE, client credentials) and when each fits.
Revisit if low: Identity protocols module + design prompt (s2)

Dimension: SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. / lifecycle
A 4–5 means you can…: Design SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. provisioning, schema mapping and drift reconciliation between IdP and apps.
Revisit if low: JML / SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. module + design prompt (s2)

Dimension: MDM / fleet
A 4–5 means you can…: Run zero-touch enrollment (ABM/Autopilot) and posture baselines across mac/Win/Linux/ChromeOS.
Revisit if low: MDM module

Dimension: Automation / IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition.
A 4–5 means you can…: Write idempotent Python/Bash against REST APIs and treat IT config as version-controlled code.
Revisit if low: Scripting drill (s1) + IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition. module

Dimension: Zero-trust
A 4–5 means you can…: Combine identity + device posture + context into per-request access via an identity-aware proxy.
Revisit if low: Zero-trust module + design prompt (s2)

Dimension: Compliance
A 4–5 means you can…: Map controls to SOC 2 / ISO 27001, run access reviews and produce audit evidence.
Revisit if low: Compliance module

Dimension: Behavioral
A 4–5 means you can…: Tell one quantified story per value theme in under two minutes.
Revisit if low: Behavioral & values mock (s4)

Dimension: AI-native
A 4–5 means you can…: Give a specific, recent example of using Cursor/AI with judgment over the output.
Revisit if low: Behavioral & values mock (s4)

Dimension	A 4–5 means you can…	Revisit if low
Identity protocols	Explain SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. vs OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition./OAuth flows (auth-code + PKCE, client credentials) and when each fits.	Identity protocols module + design prompt (s2)
SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. / lifecycle	Design SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. provisioning, schema mapping and drift reconciliation between IdP and apps.	JML / SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. module + design prompt (s2)
MDM / fleet	Run zero-touch enrollment (ABM/Autopilot) and posture baselines across mac/Win/Linux/ChromeOS.	MDM module
Automation / IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition.	Write idempotent Python/Bash against REST APIs and treat IT config as version-controlled code.	Scripting drill (s1) + IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition. module
Zero-trust	Combine identity + device posture + context into per-request access via an identity-aware proxy.	Zero-trust module + design prompt (s2)
Compliance	Map controls to SOC 2 / ISO 27001, run access reviews and produce audit evidence.	Compliance module
Behavioral	Tell one quantified story per value theme in under two minutes.	Behavioral & values mock (s4)
AI-native	Give a specific, recent example of using Cursor/AI with judgment over the output.	Behavioral & values mock (s4)

The loop screens the floor: a sub-3 on any axis is blocking and a 5 elsewhere can't buy it back.

Readiness scorecard & gap plan

Step 1 of 3

The loop screens the floor