Access and identity

Access accumulates. People change roles and keep the old permissions, services get broad credentials because narrow ones were inconvenient, and contractors' accounts outlive their contracts. Left alone, entitlement always grows and never shrinks.

Principles that actually hold

• Least privilege, and it must be practical. A model so restrictive that people share accounts to get work done is worse than a looser one they follow.
• Role-based, not person-based. Grants attached to individuals are ungovernable at any scale.
• Time-bound elevation over standing privilege. Nobody should hold administrative access continuously because they occasionally need it. Elevation on request, with a reason, expiring automatically.
• Separate duties where the consequence is severe. The person who requests a payment does not approve it; the person who writes the deploy does not solely authorize the production change.

Authentication

Single sign-on wherever possible — the value is not convenience, it is that offboarding becomes one action rather than forty. Every system outside SSO is a system someone will still have access to after they leave.

Multi-factor everywhere it is available, and phishing-resistant factors for administrative access. SMS is better than nothing and is the weakest option worth deploying.

Joiner, mover, leaver

Mover is the one everyone gets wrong. Joining and leaving are events with a process; changing role usually adds permissions and removes none, which is how a long-tenured employee ends up with access to everything.

Make role change a revoke-and-regrant rather than an addition. It is the single highest-value change most organizations can make to their access posture.

Offboarding needs to be same-day, cover everything including systems outside SSO, and be verified rather than assumed. Keep a list of what exists to be revoked — the fastest way to find the shadow systems is to try to offboard someone thoroughly.

Service and machine credentials

Usually more numerous and less governed than human ones. Each needs a named human owner, a scope limited to its actual use, a rotation path, and an expiry.

Prefer short-lived, automatically issued credentials over long-lived keys. A key that never expires will eventually appear in a repository, a log, or a support ticket.

Access reviews

Periodic, by system, with the reviewer being the person accountable for the data rather than IT. Reviewers who cannot say why someone needs access should remove it — the burden belongs on retention, not removal.

Review dormant accounts as a separate pass. An account nobody has used in six months is either unnecessary or belongs to someone who left.

Diagnosing sprawl

Look for: permissions granted to individuals rather than roles, roles nobody can define, standing administrative access, accounts whose owner has left, service credentials with no owner, and systems outside SSO. Each is a specific fix, and the list is nearly always the same list.

Tooling

Identity providers: Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and similar.

Privileged access and secrets: CyberArk, HashiCorp Vault, 1Password, Doppler, and similar.

Access reviews and provisioning: Okta Identity Governance, Entra ID Governance, Lumos, ConductorOne, and similar. Worth buying at the point a manual quarterly review stops finishing rather than the point it gets tedious.

Never

• Grant standing access where time-bound access would do the same job.
• Leave an account active while an offboarding ticket works its way through. Cut access first, reconcile after.
• Share a credential between people. If two people can use it, no log tells you which one did.
• Approve your own access request, or review a group you belong to.