#452 - When Identity Becomes Critical Infrastructure with Shea McGrew

Shea McGrew, Chief Technology Officer at Maricopa County, returns to Identity at the Center one year after episode 376 to take on a question she first raised at our Identity After Dark session: when does digital identity become critical infrastructure? Jeff and Jim talk with Shea about how a county broadband and digital equity project led her to see digital trust as the thread running through every digital government service, and why that trust depends on identity. The conversation covers building an external identity portal for residents, designing for consent and privacy from the start, why residents extend trust to private platforms more readily than to government, the right to be forgotten, data governance across departments, and where decentralized identity and verifiable credentials might fit. Shea also shares her view on access reviews as a learning journey, what it would take to trust AI agents with certifications, and whether an agent could ever be considered a citizen. Plus, potatoes and the proper way to cut a sandwich.

Connect with Shea: https://www.linkedin.com/in/shea-mcgrew-6b82a36/

Connect with us on LinkedIn:

Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/

Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/

Visit the show on the web at http://idacpodcast.com

00:00 Welcome to Identity at the Center (or AI at the Center)

02:19 How Jim and Jeff met, and how the podcast started

04:09 Jeff's fall conference schedule

06:39 Do you want IDAC content over the holidays?

07:32 IDPro membership and introducing Shea McGrew

08:15 Looking back at Identity After Dark

10:44 Zero trust progress one year later

12:04 From device identity to external identity and broadband

16:04 What counts as critical infrastructure?

19:00 External identity requirements in government

21:04 The blast radius of identity failure

23:06 If identity is critical infrastructure, who owns it?

24:26 What other public sector leaders are saying

26:40 One person, many identities

28:40 How government earns resident trust

32:37 Why not just copy Amazon?

35:02 A right to be forgotten in the US?

36:22 Governing data across department boundaries

38:30 Decentralized identity and the ownership problem

41:30 Tokenization and existing blockchains

42:34 The digital trust umbrella

45:56 Park passes versus benefits and courts

49:19 Does an official designation unlock anything?

51:03 Access reviews: security theater or essential?

55:26 Would you trust AI agents with access reviews?

58:36 Can an AI agent be a citizen?

1:02:20 More questions than answers

1:04:24 Lighter note: If you were a potato

1:07:55 Bonus: How do you cut a sandwich?

IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Shea McGrew, Maricopa County, critical infrastructure, digital identity, digital trust, public sector identity, government identity, external identity, CIAM, citizen identity, resident identity, digital services, broadband, digital equity, zero trust, device identity, IGA, access reviews, access certifications, consent, privacy, right to be forgotten, data governance, decentralized identity, verifiable credentials, blockchain, tokenization, identity assurance, AI agents, agentic identity, non-human identity, NHI, human in the loop, Identity After Dark, IAM, identity and access management