Access and identity
Access accumulates. People change roles and keep the old permissions, services get broad credentials
because narrow ones were inconvenient, and contractors' accounts outlive their contracts. Left alone,
entitlement always grows and never shrinks.
Principles that actually hold
- Least privilege, and it must be practical. A model so restrictive that people share accounts
to get work done is worse than a looser one they follow.
- Role-based, not person-based. Grants attached to individuals are ungovernable at any scale.
- Time-bound elevation over standing privilege. Nobody should hold administrative access
continuously because they occasionally need it. Elevation on request, with a reason, expiring
automatically.
- Separate duties where the consequence is severe. The person who requests a payment does not
approve it; the person who writes the deploy does not solely authorize the production change.
Authentication
Single sign-on wherever possible — the value is not convenience, it is that offboarding becomes one
action rather than forty. Every system outside SSO is a system someone will still have access to
after they leave.
Multi-factor everywhere it is available, and phishing-resistant factors for administrative access.
SMS is better than nothing and is the weakest option worth deploying.
Joiner, mover, leaver
Mover is the one everyone gets wrong. Joining and leaving are events with a process; changing
role usually adds permissions and removes none, which is how a long-tenured employee ends up with
access to everything.
Make role change a revoke-and-regrant rather than an addition. It is the single highest-value change
most organizations can make to their access posture.
Offboarding needs to be same-day, cover everything including systems outside SSO, and be verified
rather than assumed. Keep a list of what exists to be revoked — the fastest way to find the shadow
systems is to try to offboard someone thoroughly.
Service and machine credentials
Usually more numerous and less governed than human ones. Each needs a named human owner, a scope
limited to its actual use, a rotation path, and an expiry.
Prefer short-lived, automatically issued credentials over long-lived keys. A key that never expires
will eventually appear in a repository, a log, or a support ticket.
Access reviews
Periodic, by system, with the reviewer being the person accountable for the data rather than IT.
Reviewers who cannot say why someone needs access should remove it — the burden belongs on
retention, not removal.
Review dormant accounts as a separate pass. An account nobody has used in six months is either
unnecessary or belongs to someone who left.
Diagnosing sprawl
Look for: permissions granted to individuals rather than roles, roles nobody can define, standing
administrative access, accounts whose owner has left, service credentials with no owner, and systems
outside SSO. Each is a specific fix, and the list is nearly always the same list.
Sources
references/sources.md in this skill lists the outside authorities that settle the questions
here — what each one is authoritative for, and what you may do with it. Check them before
answering on anything they cover, and cite what you used. Most are free to read and not free
to reproduce; the use note on each is binding.
Tooling
Identity providers: Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and similar.
Privileged access and secrets: CyberArk, HashiCorp Vault, 1Password, Doppler, and similar.
Access reviews and provisioning: Okta Identity Governance, Entra ID Governance, Lumos,
ConductorOne, and similar. Worth buying at the point a manual quarterly review stops
finishing rather than the point it gets tedious.
Never
- Grant standing access where time-bound access would do the same job.
- Leave an account active while an offboarding ticket works its way through. Cut access first, reconcile after.
- Share a credential between people. If two people can use it, no log tells you which one did.
- Approve your own access request, or review a group you belong to.