The White Space in Standards

Heya,

One of the things I’ve been doing lately is reading through standards and specifications we’re thinking about implementing at my day job. I do this partly just to stay aware, partly because customer demand is pushing us in the direction of standards implementation. But something that keeps jumping out at me is what the standards don’t do. And that white space (the stuff the standards leave open) is actually where a lot of the value comes from when you implement them.

Because it’s where your product gets to differentiate.

I’ve written before about the value of a standards-based CIAM solution, and I still believe it. The quick recap: when you buy a standards-based customer identity and access management solution, you buy yourself optionality.

You can get optionality in other ways too (data residency decisions for example) but the nice thing about standards is that as long as you abide by them, you can move back and forth between providers. And even if you never actually do switch (CIAM solutions are sticky), you still have the option to. You better believe your vendor knows that. This offers a little more leverage and a little more peace of mind to any buyer.

From a vendor perspective, though, who wants to be a commodity? Vendors don’t want to be interchangeable with everyone else. That’s a route to fungibility and a not-very-valuable business, unless you can achieve massive scale.

Think about selling books: the product is identical whether you buy it from Amazon, Barnes & Noble, or your local bookstore, so these vendors must compete on other dimensions, such as who has the best coffee/sells at the best price/offers curated selections/supports local community.

CIAM vendors are in the same boat. They compete on which standards they support, but they also can differentiate on how well they implement them or whether they’re driving the creation of new standards.

I’ve definitely seen standards that looked a lot like someone took what a vendor had already built successfully and then turned it into a spec. The Model Context Protocol is an example that is adjacent to CIAM (it’s a protocol that helps AI tooling and agents connect to other systems, and is built on top of OAuth). It started out as Anthropic’s project, though now it lives at the Linux foundation and is supported by many many vendors.

So what does this white space actually look like? Here are a few concrete examples.