1. Manifold-Geometric Anomaly Detection
Learns the structure of normal identity behavior and identifies anomalous access, privilege, or session patterns that deviate from safe manifold structure.
Technical overview
Identity assurance as a measurable engineering discipline.
GIFTS treats identity security as both an engineering problem and an evaluation problem. Organizations need ways to measure whether identity behavior stays within safe patterns and whether controls continue to perform as intended over time.
Why identity assurance needs more than one-time review
Identity systems govern access to cloud-hosted services, data paths, and administrative control surfaces. Many modern attacks rely on valid credentials, privilege misuse, policy gaps, and configuration drift rather than obviously malicious code alone. That means defensive value depends not only on static rules, but on continuous checks for risky behavioral patterns and degrading control integrity.
GIFTS is meant to help close that gap with portable methods that can be reviewed publicly and adapted across organizations.
Four technical elements shape the current framework
2. Continuous Identity Assurance Controls
Applies automated checks to policy consistency, least privilege, configuration integrity, and identity hygiene so assurance can happen continuously rather than only during audits.
3. Generative Defensive Stress Testing
Uses controlled adversarial simulation logic to test whether identity controls, workflows, and policies respond safely under pressure.
4. Workflow Findings and Review Outputs
Converts validated identity sessions into JSONL, CSV, and markdown findings that can support SOC triage, identity-control review, incident reconstruction, and red-team or tabletop evaluation.
5. Reusable Reference Architectures and Playbooks
Packages the work into technical patterns and evaluation guidance that can be reused in cloud-hosted environments without depending on a single employer's internal implementation.
Deployment mindset
The framework is intended for environments where latency, reliability, and operational clarity matter. The goal is not only to flag risky activity, but to make identity assurance more measurable, repeatable, and usable in day-to-day engineering practice.
What is available publicly on this site
Included in the public site
- framework summary and design overview
- publication details and article links
- prototype report and code entry point
- supporting public artifacts for technical review
Not part of the public release
- proprietary employer systems
- customer data
- restricted operational workflows
- confidential source code or internal implementation details
Next, review the publications or inspect the prototype package.
The publications page anchors the research record. The prototype page shows what is available for direct technical review.