Access that nobody owns is access nobody controls
Identity has become the front door of most organisations. Governing it well is less about tools than about clear ownership.
As services move to the cloud and teams work from anywhere, the question "who can access what?" has become one of the most important a security programme can answer. It is also one of the hardest to answer confidently.
Start with the lifecycle, not the technology
Most access problems trace back to three moments: when someone joins, when they change role and when they leave. Movers are the most frequently overlooked. People accumulate access as they progress, and it is rarely removed.
Map how each of these moments actually works today — including the informal requests and exceptions — before deciding what to automate.
Make access reviews meaningful
Access reviews often become a box-ticking exercise because reviewers are asked to approve long lists they do not understand. Smaller, well-described reviews owned by the people who know the work tend to produce better decisions.
- Give each application and data set a business owner, not only a technical one.
- Describe entitlements in plain language reviewers can recognise.
- Prioritise privileged and sensitive access for more frequent review.
Questions for leaders
- How long does it take for a leaver's access to be removed everywhere?
- Who decides whether an exception to our access rules is acceptable?
- Do we know which accounts have administrative rights today?