Toolkit, Templates
The book’s templates
The fillable artifacts from Appendix B, the Artifact Pack, plus the templates the chapters introduce and a few added on the site, grouped by pillar. Most are free to download. Each comes with field definitions and a worked example.
Templates by pillar
The artifacts turn the ideas in the book into tools you can adapt immediately, grouped by pillar. A few are new on the site, and each of those is marked. Most are free to download. Where a tool is paid, it is marked, and new templates are still arriving.
Practitioner Kit: all four paid workbooks
- Identity Risk Register and POA&M Tracker
- Identity System Catalog, Guided Edition
- Workforce Identity Attribute Mapping Workbook
- AI Governance Suite
Each one pairs with the free templates on this page and does the work the free versions leave to you. Buy once and share it with your team.
Where to start
Do not try to deploy every artifact at once. Start with the few that make your environment easier to see, then work in waves: make one area visible, then make one area stronger. Here is where most identity leaders begin, depending on what is pressing.
Most environments: start with visibility
Under nonhuman or AI pressure
Under audit or operational strain
Not sure which fits? The Where-to-Start Worksheet turns your situation into one first move.
01 Foundational
See the environment before you try to change it.
If you are firefighting: make one thing visible before you change anything. Pick the corner of your environment you understand least, and get a clear enough picture to see it.
Identity System Catalog
Understand how identity behaves inside each system across all five pillars.
Identity System Catalog, Guided Edition
The same field set with a guided intake and a register that builds itself as you answer. Mark which regulations a system is in scope for, and the workbook decides which evidence fields become required, then shows you which are still missing. The free workbook has every field; this one does the work with them. Available separately.
Drift Visibility Inventory
A one-page snapshot of where drift is already visible.
Drift Diagnosis Guide
Name the signal, locate the pillar it began in, and choose the intervention.
Identity Data Model and Attribute Mapping Template
Map the identity attributes that drive workforce behavior from their authoritative source to the systems that consume them, with the owner and meaning of each. Free, with a generic source and target you fill in.
Workforce Identity Attribute Mapping Workbook
The prepopulated extension of the template, with fourteen systems mapped field by field against each vendor’s published documentation. Available separately.
Nonhuman and AI Identity Register and Model
Inventory the identities that are not people: service accounts, workloads, API clients, bots, certificates, and AI agents, one row each with owner, purpose, authentication, rotation, and provenance. The Model defines every field so the Register stays consistent. New on the site, not in the book.
02 Governance
Make ownership and decisions explicit.
If you are firefighting: find one thing that grants access and has no clear owner, decide who should own it, and tell them.
Ownership Map
Show which identity objects have real owners and where ownership is unclear.
Decision-Rights Matrix (RACI)
Clarify who decides what: a RACI, DACI, or decision matrix built for identity decisions specifically.
Governance Exception Record
Track exceptions so they create evidence, not quiet drift.
Identity Risk Register and POA&M Tracker
The portfolio above the exception record: every known gap with a treatment (reduce, transfer, avoid, accept), remediation plans with milestones, time-bound risk acceptances, and a summary that calculates overdue reviews and expired acceptances for you. Available separately.
AI Governance Checklist
Ensure AI systems and agents are governed structurally.
03 Lifecycle
Make identities begin, change, and end the way they should.
If you are firefighting: start with the leaver path. Pick the systems where lingering access after departure would hurt most, and make sure it reliably comes off.
Lifecycle Map
Visualize how identities begin, change, and end across identity types.
Identity-Type Lifecycle Matrix
Compare lifecycle expectations across identity types.
Nonhuman Lifecycle Template
Define how a nonhuman identity is created, changed, reviewed, and retired.
Agent Lifecycle Intake Form
Bring AI and agentic identities into the lifecycle with explicit ownership.
AI Identity Intake Form
Create a visible intake path for AI identities.
04 Access
Make access mean what you think it means.
If you are firefighting: start with the access that would do the most damage if misused, the standing admin rights and the few entitlements reaching your most sensitive systems, before the long tail.
Privilege Chain Map
Visualize direct and indirect paths to sensitive capability.
Access Model Template
Structure capability, roles, and entitlements before access accumulates.
AI Access Boundary Template
Define what an AI identity may do, and what stays out of bounds.
AI Governance Suite
The three AI forms above, unified into one register for an estate rather than a single agent. Enter each fact once; intake, boundary, attribution, and review pull it through. The authority overlap is computed at capability grain, so an agent granted more than the person it acts for is flagged, not left to be caught by eye. Available separately.
05 Technology
Track the credentials underneath.
If you are firefighting: do not buy something. Pick the system where you are least sure what identity is doing, and get a clear enough picture to see it.
Certificate Inventory Starter
Track machine credentials before they become outages or hidden privilege.
06 People & Change
Bring people with the change and make adoption stick.
If you are firefighting: start with the people one decision depends on most. Find the approvers making identity calls without enough to go on, and give them the context and plain language to decide well.
Stakeholder and Sponsor Map
Identify who shapes identity truth, who carries the change, and who sponsors it.
Communication Plan Template
Plan the audiences, threads, and timing that carry an identity change.
Role-Based Training Matrix
What managers, owners, engineers and operators, and executives each need to know, role by role. New on the site, not in the book.
Resistance Log
Treat pushback as a reading of the design, and tell healthy discomfort from real friction. New on the site, not in the book.
Adoption Metrics Tracker
Measure whether the model is being used, not just whether the technology is live. New on the site, built on the book's adoption metrics.
Selling Identity to Executives
One page per pillar for the boardroom: the case, the measures to bring, and the one-sentence version. Built to win the sponsor and working group the model needs. New on the site, not in the book.
07 Implementation & Measurement
Move from reading to visible progress.
If you are firefighting: pick one area, make the model real there, and close it out before spreading. One finished wave beats a broad plan with no closeout.
Ninety-Day Starter Plan
Move from reading to visible structural progress.
Identity Metrics Starter
Tie metrics to the pillars and to predictability, each with an owner. See it staged into reporting dashboards for every altitude.
Identity Operating Calendar
Put the reviews, expiries, forums, and reports that keep the model running on one shared rhythm, each with an owner and the evidence it leaves behind. New on the site, not in the book.
More templates arrive as they are built. Each fillable artifact comes with field definitions and a worked example.
For firms
Using these with clients
The free templates cost nothing to use inside your own organization, and the paid workbooks are licensed the same way: buy once, share with your team. If you are a consultancy, MSP, or integrator using any of them in client work, that needs a firm license.
Up to 5 consultants
Every free template and all four paid workbooks, licensed for client delivery. Use them in engagements, rebrand them as your own, and train your consultants on the model. Non-exclusive, renewed yearly.
Up to 25 consultants
Every free template and all four paid workbooks, licensed for client delivery. Use them in engagements, rebrand them as your own, and train your consultants on the model. Non-exclusive, renewed yearly.
More than 25 consultants? Email for a quote.
Not sure which side of the line you are on? The terms are one page, and they turn on a single question.
Updates
New templates and guides, when they are ready
A short email when something new is published, a template is updated, or the book is out. No more than once a month.
Kit, the email service I use, stores only your email address. You will get one email to confirm, and every email has an unsubscribe link.
Go deeper in the book
Appendix B and Chapter 24 cover each template in full, with the reasoning behind it.
Coming soon: get notified