Principal PM · Zuora · Identity & authorization
I design authorization for a world where AI agents act on your behalf.
I'm the product lead behind Zuora OneID, the identity and access layer for Zuora's product suite. More broadly: how enterprise products should be built for an agentic world.
- 80K+
- monthly active users
- 10+
- products and services authorized across the Zuora suite
- $6–10M
- annual licensing avoided
Estimate, list-price basis
Featured work
Zuora OneID: built for change
How an enterprise identity layer keeps customers operating through acquisitions, splits and expansion, and gets new products live in days. Created and led as product leader.
Observability for AI agents: streaming Zuora activity to your security stack
Product-managed the connector that captures changes made to Zuora through MCP clients, whether AI agents or people in tools like Claude, and streams them to the monitoring stack security teams already run.
In production today
Authorization for AI agents
OneID authorizes access to remote MCP servers in production. It supports statically registered clients and Client ID Metadata Documents (CIMD), so both known integrations and self-describing clients can be authorized through the same identity layer that already governs the rest of the suite.
The same design bet that made OneID absorb customer reorganizations, treating change as a first-class case, is what lets it extend to agents without a rebuild.
Where I go deep
OAuth & MCP authorization
Who an agent is and what it may do on a remote MCP server.
Non-human identity
Treating agents and workloads as first-class principals.
AuthZEN
Standards-based authorization decisions across systems.
IAM & RBAC
The foundation everything above is built on.
How I Build Products
My product approach is shaped by years building identity and authorization systems—domains where poor abstractions create long-term technical debt and migration nightmares. I focus on system boundaries, migration paths, and treating internal platforms as products with real users.
Start with system boundaries, not features
Before defining what to build, I map where the system starts and ends. Identity lives at the edge of every service—poor boundaries compound across every integration. Define contracts first, features second.
Design for migration paths
Enterprises don't "switch"—they migrate. I build coexistence layers, backward-compatible APIs, and gradual rollout mechanisms. Migration-first architecture is the difference between 6-month adoption and 3-year stalls.
Treat permissions as products
Authorization isn't infrastructure—it's a product with users (developers), interfaces (policy languages), and UX (debugging tools). I apply product thinking to RBAC/ABAC: usability, debuggability, and clear mental models matter as much as technical correctness.
Balance enterprise needs with developer experience
Enterprise customers demand SAML, SCIM, and fine-grained RBAC. Developers want simple APIs and fast iteration. I bridge this gap by building abstractions that hide enterprise complexity without limiting power users.
Measure outcomes, not output
I don't track "features shipped." I measure adoption rates, time-to-onboard, support ticket reduction, and cost savings. Security and platform products succeed when they're invisible—metrics must reflect that.
Build through cross-functional ownership
As a former engineer, I work directly in system diagrams, API specs, and database schemas. I don't "throw specs over the wall"—I pair with engineers on architecture, write ADRs, and stay close to implementation tradeoffs.
Get in Touch
Open to discussing application security, product strategy, or potential opportunities.