Role
Access management
How many times a week do you grant access "the same as Smith has"? Every such request copies permissions nobody has reviewed in years.
Intro call
Four questions we would start with
How many times a week do you grant access modelled on another employee?
If it is often, permissions grow by copying rather than by decision.
Who notices first that a leaver's account still works?
If nobody does until somebody logs in, you have accounts with no owner in every system.
How long does an access request take?
If it is two days, a new employee does not work for two days - and their manager asks for wider permissions than needed, to avoid a second request.
What happens when somebody changes role within the company?
Whether the old permissions are removed, or stay just in case.
We take over handling the requests, you keep the decision about permissions
Taking in requests, granting access from templates, permission reviews and handling leavers can be taken off the desk. The decision about who should see what stays with the manager and the system owner.
- A request goes to the person who is to decide. - Not to an administrator as the first link, but to the manager and the system owner, and only then to be carried out.
- A role has a permission template. - A new employee gets the set assigned to their role, instead of a copy of the permissions of the colleague at the next desk.
- Leaving and changing role are events. - Access expires with the end of employment, not when somebody remembers.
Scope
What can be taken off access management
Nineteen example tasks. Each one has a human approval point. Below is a selection, and the scope we fit to the number and kind of your systems.
Access requests
- One request route with the reasoning required
- Routing to the manager and the system owner (decision: the manager)
- Pointing out permissions going beyond the role template
- Request status visible to whoever raised it
- A register of grants with the date, the person and the basis
Accounts and permissions
- Permission templates assigned to roles
- Pointing out accounts with permissions outside the template
- A signal about an account unused for longer than agreed
- Detecting accounts with no owner assigned
Workstations and equipment
- A register of equipment assigned to people
- A workstation preparation list for a new person
- A signal about equipment not returned after a leaver
Permission reviews
- A review schedule by system
- Permissions set out for the manager to confirm (confirmation: the manager)
- Pointing out permissions not confirmed in the last review
- A register of the changes arising from a review
Leavers
- Linking the end of employment to the removal of access
- The list of systems the person had an account in
- Confirmation that the access is closed (confirmation: the administrator)
A day's work
Today
- Requests arrive by email and by chat, with no reasoning
- You grant access modelled on another employee, because it is faster
- You do not know who has permissions wider than their role implies
- You close leavers' accounts when somebody mentions it
- You put off permission reviews, because they would mean phoning round the managers
- At an access audit you assemble the summary over a week
With AI assistance
- A request has one route, a reasoning and reaches the decision maker
- A new employee gets the permission template for their role
- Permissions outside the template are pointed out
- The end of employment brings the removal of access with it
- The permission review sends managers ready summaries
- The summary for an audit comes from the permission register rather than from a round of the systems
- Time to fulfil a request
a new employee works from day one
the request goes straight to the decision maker, not through a queue
- Order in the permissions
fewer accesses granted by copying
a role has a permission template
- The risk of leavers' accounts
fewer working accounts with no owner
leaving brings the removal of access
- Ready for an access audit
the summary is available rather than assembled
the register of grants is built as you go
We start with the requests, because that is the largest volume and the most copying.
- Step 1
One request route with a decision maker
The reasoning, routing to the manager and the system owner, a register of grants.
- Step 2
Permission templates for roles
A set assigned to a role instead of a copy from a colleague.
- Step 3
Leavers and role changes
Linking to HR events and the list of systems to close.
- Step 4
Permission reviews
Summaries for the managers to confirm. Last, because it needs the templates in order.
Common questions
Questions that come up at the first meeting
How is this different from a systems administrator?
The administrator keeps things running: servers, backups, updates, performance. Here the subject is solely who has access to what. In smaller companies the same person does both and that is where the confusion comes from - but they are two different kinds of work and two different kinds of risk.
How is this different from IT security?
There the subject is vulnerabilities, incidents and threats from outside. Here it is access, accounts and workstations. The areas meet at excessive permissions, but the daily work looks completely different.
Will handling access need fewer people?
Access requests are work that does not need an administrator - it needs a manager's decision and execution. Taking it over does not remove a post, it stops consuming somebody who should be doing something else. The permission reviews nobody does today become feasible at all, and that is usually the main gain.
Does this fall under the AI Act?
Access management is not a high-risk use. The line runs at login and account activity data: it serves security and order in the permissions, and using it to assess working time or productivity would be employee monitoring requiring a separate legal basis.
Still have a question that is not here? Book a call
Next step
How many working accounts belong to people who no longer work for you?
We will show you what access management looks like when a request goes to the decision maker and an employee leaving closes the accounts itself.