About

I’m Martin Besozzi, AI Security Architect, IAM Architect, CTO and Founder.

My work sits at the intersection of identity, security, and AI agents. I focus on building open, composable systems where authorization is a first-class concern rather than an afterthought. My approach is standards-first: OAuth 2.0, OpenID Connect, WebAuthn/FIDO2, and emerging frameworks like AuthZEN form as the security foundation.

At TwoGenIdentity I created the Agentic AI Identity Access Plus Platform for Identity and Access Governance, an AI/API Gateway based on OpenID AuthZEN, MCP Apps for the IAM space, and frameworks including Agent-Native Authorization and Passkeys 360. I’m currently focused on designing and publishing open security standards for agentic AI workflows, including the IETF Draft “OAuth 2.0 Agents Native Authorization” and MCP-Native Just-In-Time Authorization.

I’m an active contributor to open-source IAM ecosystems (Keycloak, MidPoint, OpenFGA, Apache APISIX) and a member of the OpenID Foundation and ID Pro. I’ve also built and published hands-on research on securing AI coding agents, including real-world implementations with Claude Code and real-time authorization enforcement via MCP.

What I build

• Passkeys 360
  Multi-surface passkey platform for apps and agents
• Agents Native Authorization
  Agent-native authorization workflows
• AuthZEN MCP Gateway AI/API Gateway implementing OpenID AuthZEN as a standardized Policy Enforcement Point for APIs and MCP servers
• Agentic AI Identity Access Plus Platform
  Identity and Access Governance platform with AI-native authorization for enterprise IAM
• Keycloak MCP App Server
  First MCP server that support MCP App extension for Keycloak management via LLMs
• MidPoint MCP Server
  First MCP server for IGA platform automation

I’ve been building on Keycloak and OpenFGA for years and am a Technical Reviewer of Keycloak: Identity and Access Management for Modern Applications, 2nd Edition.

Where I’ve spoken

• Authenticate 2025 (FIDO Alliance) Native authentication and passkeys for apps and agents
• KeyConf25 & KeyConf24 Keycloak access control and authentication workshops
• KeyDev25 & Cloudland 2025 Authorization standards and ReBAC patterns

Writing

I write about IAM, agentic AI security, passkeys, and open standards on my blog, Medium and LinkedIn. The posts on this blog extend that work, focused on the practical implementation side of the problems I care about.

If you’re working on secure AI agents, MCP infrastructure, Zero Trust architectures, or authorization frameworks, feel free to reach out.