CIAM & identity resolution — multi-brand, multi-region CX
Identity resolution architecture for the systems that inherit your golden record: CDP, ESP, personalization. Eight years in SAP CX, vendor-agnostic since.
How it breaks
Ordered by how long each one hides — seconds, weeks, years. Every one of these passed testing.
01 · Seconds · The handoff
Three sessions, a wishlist, two abandoned carts — all attached to a cookie ID discarded the moment they authenticate. Personalization restarts from zero at the exact moment you finally know who they are.
Tell — you find out never. Nothing logs it.
02 · Weeks · The merge
Two profiles merge on a shared email. Six weeks later the customer changes it in one brand's account centre and the merge silently reverses, splitting order history across two records.
Tell — you find out when a customer is told two different things.
03 · Years · The drift
A field was renamed upstream last quarter and now arrives null. The pipeline doesn't error — it writes the null. The sync completes successfully every night, because the monitor checks that the job ran, not that what it wrote was true.
Tell — you find out when a campaign underperforms.
Identity across the lifecycle
Seven stages, one identity graph. Expand a stage for what identity does there, what breaks, and the systems that read it.
First-touch capture — an anonymous ID is assigned before any PII exists.
Ad platforms · tag managers · anonymous CDP profiles
Full page on Attract →The anonymous ID gets its first verified identifier — login, hashed email, loyalty number — and the profile stops being a guess.
SAP CDC · Adobe IMS · Keycloak · OIDC
Full page on Identify →Multiple identifiers from multiple source systems converge on one golden record, with merge rules that survive an email change.
SAP CDP · Adobe RT-CDP · BlueConic
Full page on Unify →Segmentation and personalization logic reads the unified profile, not a per-channel guess.
Adobe Target · Dynamic Yield · decisioning engines
Full page on Decide →The resolved profile pushes to the channels that act on it — email, ads, on-site — carrying consent state with it.
Iterable · Emarsys · ad platforms
Full page on Activate →Support and service tools resolve the same customer across every brand and channel they've touched.
CRM · contact centre · SAP C4C
Full page on Serve →Lifecycle and loyalty signals feed back into the golden record instead of living in a separate silo.
Loyalty platforms · CDP feedback loops
Full page on Retain →The band that runs through everything
Consent, data quality and observability aren't steps in the lifecycle. They cut across all seven, and they're where most identity programmes quietly fail.
Consent & privacy
Consent is a field on the identity graph, not a checkbox in a separate system. If it doesn't propagate through the merge, the merge is wrong.
Data quality
Golden records rot quietly. Duplicate rate, merge reversals and orphaned identifiers only surface if something is measuring them.
Observability
A green dashboard tells you the job ran — not that what it wrote was true. Observability means watching the identity layer at 3am, not just the pipeline that feeds it.
Stack coverage
The platforms your identity layer feeds — SAP's own suite, Adobe, independent CDX tools, and the open-source layer most SAP-only consultants never evaluate.
SAP
Adobe
Independent
Open source
Selected work
Details are generalised to protect client confidentiality. The systems and mechanisms are exactly as implemented — SAP CDC, SAP CDP, Datadog, OIDC.
01 · Identify
Was
Separate authentication per brand, per region. A customer known to one brand was a stranger to the next.
Now
A single OIDC-based hosted login layer across multiple brands and three regions, identifier-first from the first request.
02 · Unify
Was
CRM and CDP modelled relationships differently. Relationship fields sat flat on the CDP profile schema with nothing indicating which contact-to-account relationship they described.
Now
Schema redesigned so relationship attributes live on the relationship object, with identifying context attached — two relationships for the same person are no longer indistinguishable on arrival.
03 · Observe
Was
Issues found when customers complained. The login flow ran entirely inside a modal, so with no URL change every screen looked identical to standard monitoring. Actions were auto-identified by visible button text, so one sign-in button became ten actions across ten languages.
Now
Custom per-screen view tracking, locale-independent action names, funnels, a tiered alert model including a zero-successful-logins safety monitor, and a daily/weekly/on-call operating rhythm with runbooks. Principle: monitor first, alert second.
Two ways to work together
Book a scoped engagement directly, or bring in identity and CIAM capacity through your own delivery team.
Direct engagement
2 weeks
Merge rules, identifier hygiene, consent propagation and the failure modes hiding behind a green dashboard. Ends in a ranked remediation plan.
from $X,XXX
4–6 weeks
Golden record quality measured against real data, not the vendor's demo set. Duplicate rate, merge reversals, orphaned identifiers.
from $X,XXX
Partner / subcontract
Ongoing
Specialist identity and CIAM capacity under your brand, on your client's stack — scoped, billed and delivered as your team's work.
Non-solicitation
I do not approach your clients directly, and that is in the contract.
Day rate
Writing
Error codes, migration gotchas and undocumented behaviour — tagged to the lifecycle stage each one belongs to.
Not ready to book yet
For the reader who isn't ready for an audit yet.
Downloadable asset
The mechanism checks run before any engagement — merge rule sanity, consent propagation, orphaned identifier scan.
Download the checklistNewsletter — one field
Long-tail technical notes on identity resolution. No newsletter fluff.
Contact
Book a 30-minute architecture review directly, or send the details and hear back within one working day.
Booking
Cal.com booking embed goes here — wired up alongside the rest of the forms and integrations work.