Insights from the Gartner IAM Summit 2025 with David Brossard
Get an in-depth look on the conversations that happened surrounding IAM, authorization, AI, application programming interfaces (APIs), and more.
Last week, our team ventured out to Grapevine, Texas for Gartner’s identity and access management (IAM) conference. I sat down with our CTO, David Brossard, to get an in-depth look on the conversations that happened surrounding authorization, AI, application programming interfaces (APIs), and more.
You went to the conference last year, how did this year’s conference compare?
It felt like it was bigger, greater, busier. It’s Texas after all. The show floor was bigger with new vendors and bigger booths. There were more talks directly relevant to Axiomatics and fine-grained authorization, and of course OpenID AuthZEN, had its own interop event just like OpenID Shared Signals did a year ago. The talk we gave on applying fine-grained authorization and Zero Trust to AI agents, process, and model context protocol (MCP) gateways had a whopping 250 attendees. It shows the urgency of the challenge companies are facing. If you’re interested in viewing our slide deck from the session, it’s available on the Conference Navigator application or contact us and we can send it over to you.
On the standards front, OpenID AuthZEN was mentioned a dozen times in different talks. We received tremendous support from Gartner and their analysts including Homan Farahmand, Paul Mezzera, Nathan Harris, and Erik Wahlström.
What was the most surprising or insightful session?
Erik Wahlström, VP Analyst and Key Initiative Leader of the IAM team at Gartner, and incidentally, a fellow Swede — delivered a great session on “Technical Insights: Workload Access Management and API Access Control Architectures”. In it, he mentions 8 API access control requirements:
- Authenticate and authorize humans and workloads calling APIs.
- Be vendor-agnostic by using identity standards.
- Centralize policy management in a decentralized environment.
- Establish coarse and fine-grained policy enforcement.
- Issue and manage workload identities for services.
- Implement defense-in-depth and enforce TLS everywhere
- Maintain governance and control over secrets
- Ensure developer friendliness.
OpenID AuthZEN and Axiomatics abide by these requirements and use these as driving factors for our respective roadmaps.
What were the major authorization trends or issues highlighted at the event?
The conference’s key takeaways mention “Expand your authorization strategy” in the sixth position. Gartner recommends customers “Cover commercial applications, infrastructure, and data platforms for improved agility and security. Prioritize and implement authorization management platform (AMP) use cases incrementally, starting with those that are most feasible and impactful. Adopt standards like AuthZEN to reduce vendor lock-in and enhance interoperability. Focus on strong policy lifecycle management and data integration to support accurate and effective authorization policies. Amplify Your Security With Authorization Management Platforms“.
According to Paul Mezzera, who covers fine-grained access control, it is all about “increasing security, and reducing the risk of unauthorized access”. In the tenth position, Gartner recommends customers “Reduce the risk of IAM technical debt by choosing interoperable tools”. Standards are fundamental in achieving interoperability.
At Axiomatics, we have always been stalwart contributors to standards be it Organization for the Advancement of Structured Information Standards (OASIS) or eXtensible Access Control Markup Language (XACML), the strong foundation for enterprise access control widely adopted by governments and critical infrastructure worldwide to newer developer-friendly standards like Abbreviated Language for Authorization (ALFA) and OpenID AuthZEN. When customers choose vendors, they should strive to adopt a platform that embraces standards rather than ignore or shun them as we have seen some competitors do.
As co-chair of OpenID AuthZEN, I oversaw our seventh interoperability event. Axiomatics, alongside open-source frameworks such as Topaz, is the only vendor to have actively shaped and taken part in each one of those interoperability events. We’re in fact planning the next event to take place at Gartner IAM 2026 in London. The focus will be on AI.
How will these trends presented at the conference evolve within the next year?
I’m hoping we will see even more awareness for attribute-based access control (ABAC). My peers and I are getting involved in orthogonal working groups such as the MCP Working Group. There is work underway there to apply fine-grained access control via a gateway model.
The biggest challenge yet will be to convince commercial-off-the-self (COTS) and software-as-a-service (SaaS) vendors to adopt AuthZEN. For this, we require you — the end customer — to require these vendors to allow externalizing authorization via OpenID AuthZEN. Much like you require support for SAML or OpenID Connect, you should require AuthZEN.
We highlighted the roadmap for AuthZEN in 2026 during our Gartner session which highlights the direction we want to take: more comprehensive authorization APIs, more interoperability, and more integrations out-of-the-box. We also went over the roadmap in our recent webinar.
Is there a favorite memory from this year’s event or a favorite line from a session or conversation?
During the event, we took one of our marquee customers out for dinner. They’ve been using Axiomatics for nearly two decades now. Every day, they authorize access to export-controlled blueprints for their employees, contractors, and partners. This generates millions of authorization requests that are all processes in milliseconds. Seeing our customers’ success is our greatest accomplishment. Keeping enterprises agile and secure is our one and only mission.
Thank you to those who visited us at Gartner!
It was a pleasure getting to connect with both new and familiar faces at our booth. Along with everyone who attended our session on Zero Trust for AI. Want to read more about what we talked about at the conference?
Here are three great resources for you to look into:
Have 30 minutes? Let's show you a demo!
See how our award-winning solution can help you meet today's access control and Zero Trust needs.
Request a demoJoin us on LinkedIn for more insights
Archived under:
About Axiomatics
The world’s largest enterprises and government agencies continually depend on Axiomatics’ award-winning authorization platform to share sensitive, valuable and regulated digital assets – but only to authorized users and in the right context.
