1 min lesson
Name tools, justify with trade-offs
Match each case in "Name tools, justify with trade-offs" to the signal and response that fit it.
Step 1 of 4
Every job is safe to re-run.
Reconcile to desired state, act only on the delta - never blind create/delete.
IdP and apps disagree over time.
A scheduled reconciler diffs source-of-truth vs. reality and reports or fixes gaps.
API tokens never in code.
Vault or cloud secret manager, scoped tokens, rotation, least-privilege service accounts.
You can't fix what you can't see.
Structured logs, alerts on failed provisioning, an audit trail per identity event.
Learn more
Advanced table
Saying the trade-off out loud is the point
- Choice
- SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. vs. custom API sync
- When you'd pick it
- SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. when the app supports it
- Trade-off you'd name
- SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. is standard and low-maintenance; custom API gives control but you own the breakage
- Choice
- RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. vs. ABAC / dynamic groups
- When you'd pick it
- RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. for stable roles, ABAC as you scale
- Trade-off you'd name
- RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. is simple but explodes into group sprawl; ABAC is flexible but harder to audit
- Choice
- IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition. (Terraform) for IT config
- When you'd pick it
- Okta/Workspace config you want versioned
- Trade-off you'd name
- Policy-as-code gives review + rollback; the cost is upfront setup and discipline
- Choice
- Identity-aware proxy vs. VPN
- When you'd pick it
- ZTNA for per-request device+identity checks
- Trade-off you'd name
- IAP is granular and auditable; VPN is familiar but trusts the network perimeter
| Choice | When you'd pick it | Trade-off you'd name |
|---|---|---|
| SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. vs. custom API sync | SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. when the app supports it | SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. is standard and low-maintenance; custom API gives control but you own the breakage |
| RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. vs. ABAC / dynamic groups | RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. for stable roles, ABAC as you scale | RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. is simple but explodes into group sprawl; ABAC is flexible but harder to audit |
| IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition. (Terraform) for IT config | Okta/Workspace config you want versioned | Policy-as-code gives review + rollback; the cost is upfront setup and discipline |
| Identity-aware proxy vs. VPN | ZTNA for per-request device+identity checks | IAP is granular and auditable; VPN is familiar but trusts the network perimeter |
Saying the trade-off out loud is the point - a tool name without a justification reads as cargo-culting.
Close every design by grounding it in Cursor's reality: a tiny team, fast headcount growth and a need for security without friction. "I'd lean on SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. and dynamic groups precisely because there isn't a team to do manual provisioning - the system has to scale without me touching it for each new hire or app."