---
title: "IAM"
description: "2 posts about IAM, summarised, each linking to the original."
---

# IAM
> 2 posts about IAM, summarised, each linking to the original.

## Articles

### [Staying Evergreen: How we automated secure access and repo hygiene in a shared org](https://yomu.fyi/post/staying-evergreen-how-we-automated-secure-access-and-repo-hygiene-in-a.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Greg Mohler
- Published: Oct 15, 2026
- Type: Problem & solution

Managing outside collaborator access and stale repositories in a shared GitHub organization becomes harder to keep up with as projects grow. Evergreen is a GitHub App built with native GitHub features—scheduled actions, webhooks, issues, and custom properties—that automates two workflows: quarterly outside collaborator access reviews and stale repository detection and archival. Its design principles are fail secure, revoking access if no one responds, and never destroy anything, keeping archived repos recoverable and every change tracked in issues. The app is a Go webhook server that stores state as JSON files in a controller repo, using git history as the audit trail, and interacts via checklist issues in each repository. Rollout included dry-run mode, overcommunication, Splunk observability, and proactive rate-limit pacing; the pattern is adaptable using native GitHub features.


### [ReadyOn’s Four Walls of tenant isolation on Amazon EKS](https://yomu.fyi/post/readyon-s-four-walls-of-tenant-isolation-on-amazon-eks.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Roshan Daneshvaran
- Published: Sep 18, 2026
- Type: Explainer

ReadyOn describes a four-layer tenant-isolation architecture for Harmony, its multi-tenant workforce-intelligence platform on Amazon EKS, which handles payroll data, organizational hierarchies, and operational analytics. The design combines dedicated Kubernetes namespaces, Karpenter-managed tenant node pools, per-tenant Amazon VPC security groups, and dedicated Amazon Aurora databases, with RBAC, admission control, default-deny network policies, IAM Roles for Service Accounts, and tenant-scoped secrets. GitOps through Argo CD ApplicationSets provisions identical controls and continuously reverts drift, while dual taints and admission validation prevent cross-tenant scheduling. ReadyOn says adversarial exercises have blocked all six tested cross-tenant paths to date, and reports defenses across 10 threat-model stages, though shared control-plane dependencies make the layers defense in depth rather than fully independent probabilities.