Architecture and transformation
Identity and access architecture (IAM, OIDC, e-ID)
Identity and access architecture decides who can log in, what they may see and do, and how you prove it to an auditor. We assess your current identity and access management, design the target architecture with Keycloak, Microsoft Entra ID, OpenID Connect and the Swiss state e-ID, and plan the migration, including identities for AI agents. For authorities, portals and regulated companies. An assessment takes 3 weeks and starts at CHF 12,000.
You need this if
- Every application has its own login and its own role model.
- You will have to accept the Swiss state e-ID and do not know where it fits in your architecture.
- Your identity mapping was built years ago, and nobody wants to touch it.
- Auditors ask who had access to what, and the answer takes weeks.
- AI agents are about to act on behalf of users, and nobody has defined what they may do.
- You are moving from a home-grown identity provider to Keycloak or Entra ID.
What you get
-
IAM assessment
Identity sources, protocols, roles, flows and risks, documented as they are today.
-
Target architecture
Identity providers, federation, token and claims design, authorisation model and levels of assurance.
-
Migration plan
Steps, coexistence of old and new, and fallback options, without locking users out.
-
Agent identity concept
How AI agents authenticate, act for users with delegated rights and leave an audit trail.
How it works
-
Inventory
Week 1
Applications, identity stores, protocols and role models.
-
Assessment
Weeks 2–3
Gaps against security, usability and audit requirements.
-
Target design
4–8 weeks
Architecture, token and claims design and the authorisation model.
-
Migration
per plan
Step-by-step migration, with quality assurance of the implementation.
Packages and prices
-
IAM assessment
Analysis of the current state and its risks, with a recommended target direction.
- Duration
- 3 weeks
- Price
- from CHF 12,000
-
Target architecture and migration plan
Detailed target architecture, token and authorisation design, and a migration roadmap.
- Duration
- 4–8 weeks
- Price
- fixed price after the assessment
-
Agent identity concept
Authentication, delegation and audit design for AI agents that act on behalf of users.
- Duration
- 2–4 weeks
- Price
- on request
Prices are indicative, in Swiss francs and excluding VAT. Your proposal confirms scope and price.
Why Bit2Board
- Designs the access management of an inter-cantonal e-government platform: Keycloak and OpenID Connect, with tokens validated at every hop from the API gateway to the back-end services.
- Knows the legacy side too: identity mapping between cantonal systems and external service providers.
- Writes architecture that public-sector security experts review, and writes it for that audience.
How we use AI
- AI agents are a new kind of user: we design their identities, rights and audit trails like those of any privileged account.
- AI helps analyse role models and access data at scale; access decisions stay with the business owners.
Questions
Keycloak or Microsoft Entra ID?
It depends on who your users are, where data must reside, licence costs and your team's skills. Many organisations use both: Entra ID for employees and Keycloak for citizens or customers. The assessment compares the options for your case.
How do we prepare for the Swiss e-ID?
By deciding where the e-ID is verified, which level of assurance each service needs, and how a verified identity maps to accounts and roles in your systems. The state e-ID is a verifiable credential held in the swiyu wallet, so verification works differently from a classic federated login.
What is agent identity?
An AI agent acting for a user needs its own identity, limited rights delegated by that user and a record of what it did. Without that, an agent either borrows the user's credentials or cannot work at all.
Can you review an implementation by our supplier?
Yes. We review configuration, token design and code for security and for conformity with the target architecture.