IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Cheat sheet & pop quiz
You have met the whole cast and the whole vocabulary. Here are twelve key ideas, a map to the deeper lessons, and five questions to test yourself.
Twelve ideas that unlock everything
| # | If you remember nothing else… |
|---|---|
| 1 | AuthN asks who you are. AuthZ asks what you may do. Keep them apart. |
| 2 | One person, many personas: link them for risk, separate them for access. |
| 3 | Trust is a number (assurance levels). You earn it step by step, and tokens carry it. |
| 4 | Tokens are wristbands: signed, scoped and expiring. You cannot cancel one without a deny-list. |
| 5 | Passkeys beat passwords because the private key never goes to the website. They resist phishing. |
| 6 | Risky moments need step-up: shown on your device and tied to that one transaction (WYSIWYS). |
| 7 | JML: access must follow real life. Leavers lose it the same day. No orphans. Machines are included. |
| 8 | Zero trust: check every access by context. The fabric supplies the facts (PIP) for every judge (PDP). |
| 9 | The kill switch = shared signals (SSF/CAEP) + revocation everywhere + a probe that proves it. |
| 10 | Every NHI needs its own identity, an owner, least privilege, a lifecycle and an audit trail. |
| 11 | AI agents act on behalf of people (never as them), through guarded doorways (MCP). A human approves big actions. |
| 12 | The fabric does not replace your IdPs. It connects them: one view, one policy voice, one audit trail, one red button. |
Keep going: from foundations to the deep dives
Each lesson here has a deeper lesson later. Read the idea here, then build it there.
Pop quiz: five questions
Q1 · Sam logs in with the right password from an unknown laptop at 2 a.m., abroad. He is denied. Which idea did that?
Context-based checking, which is zero trust (the zero-trust lesson). The password was right, but the context was wrong.
Q2 · Why can't a stolen JWT simply be "un-issued"? What is the fix?
Q3 · What is the difference between Bot A and Kai?
Q4 · An employee collected a customer's ID documents (KYC). Now the same employee tries to SIM-swap that customer. Which two things stop this?
Q5 · A team says, "we sent the session-revoked signal, job done." What is missing?
Proof that it worked. Sessions and refresh tokens must really be killed at every IdP. Tokens already issued must be refused at the APIs. A probe must check the refusal within 60 seconds (the ITDR lesson).
That is the whole vocabulary. To make it stick, use the "keep going" map above. Read an idea here, then build it in the deeper track. Next up: Modern Authentication, where sign-in gets real, starting at beyond the password.
Put the theory to work. Browse our free security micro-tools or explore our services. Talk to our team when you are ready to design the real thing.