# Lily Wisecarver

> Identity for humans, applications, machines, and AI agents.

Technical product advocate and builder working where identity meets agentic AI. I advocate, and I also build: reference architectures, prototype integrations (OAuth 2.0, MCP, fine-grained authorization), and help developers draw safe session boundaries for autonomous AI workloads. These patterns apply to any identity provider, cloud, or agent framework. I turn real customer friction into secure, actionable product requirements.

## Contact

- Location: Greater Seattle Area
- Email: lilywisecarver@gmail.com
- Phone: (206) 992-6990
- LinkedIn: https://www.linkedin.com/in/lilianwisecarver
- GitHub: https://github.com/seattlily
- X (Twitter): https://x.com/lily_IAM_

## Professional experience (most recent first)

### Senior Product Advocate, Auth0, Okta

- Dates: May 2025 to Present
- Location: Bellevue, WA
- Flow metaphor: Lily → Okta (`urn:openid:params:grant-type:ciba`)
- Focus areas: mcp, token_vault, fga, ciba, delegated_authority

- Architected reference frameworks and security patterns for autonomous AI agents: MCP servers, token vaults (secure, brokered access to third party APIs on a user’s behalf), and fine-grained authorization for RAG and tool calls.
- Achieved a 57% activation rate (vs. 25% target) and 92% CSAT across high-growth AI startups.
- Built structured customer feedback pipelines, turning friction (connection limits, M2M quotas, agent auth flows) into roadmap inputs.
- Spoke at AI Engineer World’s Fair and hosts monthly workshops on identity for AI agents.

### Solutions Architect, Unqork

- Dates: Nov 2022 to Apr 2025
- Location: Remote, US
- Flow metaphor: Lily → Unqork (`urn:ietf:params:oauth:grant-type:token-exchange`)
- Focus areas: enterprise_sso, rbac, ci_cd, architecture_review

- Directed end-to-end architecture reviews: technical discovery, RBAC/SSO topologies, CI/CD automation, and production readiness.
- Authored the official Enterprise SSO integration guides and reference architectures for the Documentation Hub.
- Drove 90% support ticket deflection by standardizing client implementations.

### Solutions Architect, Auth0

- Dates: Jun 2021 to Nov 2022
- Location: Bellevue, WA
- Flow metaphor: Lily → Auth0 (`refresh_token`)
- Focus areas: ciam, b2b, b2c, custom_domains, user_migration

- Architected tailored identity solutions across complex CIAM, B2B, and B2C deployment models.
- Aligned identity governance, custom domains, and user migration strategies from inception to go-live.
- Co-developed tenant health-check tools and reference patterns with Product and Security Engineering.

### Developer Support Engineer, Auth0

- Dates: Sep 2019 to Jun 2021
- Location: Bellevue, WA
- Flow metaphor: Lily → Auth0 (`authorization_code`)
- Focus areas: oauth2, oidc, saml

- Resolved deep technical bottlenecks across OAuth 2.0, OIDC, and SAML implementations.
- Increased Auth0 Community forum resolution and reply rate by 60%.

## Education

- Bachelor of Science, Information Systems, [Bellevue College](https://www.bellevuecollege.edu), Bellevue, WA (2019)

## Concepts (vendor-neutral)

These are open standards and architecture patterns used across identity providers, cloud platforms, and AI agent frameworks. They are not features of a single product.

### Token Vault

*A safe for other apps’ keys.* Simplifies how applications access external APIs on a user’s behalf. Instead of every app (or AI agent) storing and refreshing OAuth tokens itself, a vault holds them server-side and hands out short-lived access only when needed. Built on OAuth 2.0 and token exchange (RFC 8693), it works with any provider that speaks the standard.

- Example: An agent drafts a reply in your inbox without ever seeing your password or refresh token.

### Model Context Protocol (MCP)

*A universal plug for AI tools.* An open standard for connecting AI models and agents to tools and data through a common interface. Any MCP compatible client can talk to any MCP server, and OAuth 2.1 decides who is allowed to call which tool.

- Example: One calendar MCP server works with every assistant that speaks the protocol.

### Fine-Grained Authorization

*Permissions per document, not per app.* Relationship-based access control (ReBAC), modeled as relationship tuples in the Zanzibar style and queried through open APIs like OpenID AuthZEN. It answers “can this user, or this agent, act on this specific resource?”

- Example: A RAG pipeline only retrieves documents the asking user could already open.

### Human-in-the-Loop (CIBA)

*The agent asks, you tap approve.* Client-Initiated Backchannel Authentication is an OpenID standard that lets a service request a user’s approval asynchronously, on a separate device. Ideal for agents that need consent before high-stakes actions.

- Example: Your travel agent pings your phone before it books the non-refundable flight.

### Token Exchange

*Trade a token for a narrower one.* Defined in RFC 8693: swap one token for another with a different audience or smaller scope, so services and agents can delegate access without over-sharing.

- Example: A front-end token becomes a read-only token for one downstream API.

### On-Behalf-Of Delegation

*Agents borrow your permissions, not superpowers.* The agent acts with the user’s identity and consent, captured in claims like “act”. It is scoped, auditable, and revocable. It is the core trust model for agentic AI across every platform.

- Example: Logs show “agent acting for Lily”, and Lily can revoke it anytime.

## Core competencies

- **AI & Agentic Architectures:** Model Context Protocol (MCP), Token Vault · Delegated API Access, On-Behalf-Of Delegation, Fine-Grained Authorization (ReBAC), Human-in-the-Loop Approval (CIBA), Secure RAG
- **Identity & API Standards:** OAuth 2.0, OpenID Connect, SAML 2.0, Enterprise SSO, Workload Identity, Token Exchange, Multi-Tenant Architecture, CIAM
- **Technical Leadership & Delivery:** Solutions Architecture, Developer Tooling & SDKs, Reference Implementations, Python · FastAPI, Node.js · TypeScript, Go

## Off the clock

- **The Pacific Northwest** (`pnw:explore`): Home base. Evergreens, mountain views, and rain that keeps everything green.
- **Nature** (`nature:read`): Trails, lakes, the ocean, and anywhere the cell signal gives up.
- **Traveling** (`travel:write`): Collecting new places, new food, and new perspectives.
- **Live music** (`live_music:subscribe`): Always down for a show. The closer to the stage, the better.
- **Art** (`art:create`): Galleries, studios, and anything with texture and color.