Authorization Logic

Provisioning grants a user an entitlement. Authorization decides what they can do with it at the moment of access. Most identity programs govern the grant carefully and lose sight of the moment that follows. The operating model has to govern both.

The account is created, the entitlement is approved, the provisioning workflow completes, and the work stops. Even though access decisions are still being made inside the application.

That is where application-defined roles, fine-grained permissions, the rules the application itself enforces, and code-embedded authorization logic live. Same group, same provisioning, different experience inside the application. If that layer is not governed, the operating model is incomplete.

Just-in-time access and zero standing privileges make this more true, not less. They shorten the window between assignment and authorization, sometimes to minutes.

Implementing the operating model for authorization does not require a budget cycle or an organizational change initiative. It can be built in the cracks, one system at a time, in the firefighting. Most progress comes through documentation and ownership before any tooling. Inventory where authorization decisions are being made. The system catalog is where these answers belong. Name owners. Document what each application's authorization logic actually does. Pick the highest-value systems to invest your limited cycles in, and let the others be governed through honest acknowledgment and compensating controls. Modernization toward JIT and ZSP happens opportunistically, when systems are being replaced or when an audit forces a decision. The operating model meets the portfolio where it is.

Start by getting clear on:

• Which applications contain authorization logic outside central governance
• Where access is decided at runtime through policy engines, JIT workflows, or code
• Who owns each authorization layer from both a business and technical standpoint

Measure:

• Applications with documented authorization logic and owners
• Standing privileges that could be replaced with JIT or time-bound access
• Authorization changes with no approval trace

Identity governance does not end when provisioning completes. The access decision is moving from the approval queue to the moment of access. The operating model has to follow it there, on a schedule the organization can sustain.

❓ Where do you have cycles to govern authorization today, and where are you having to accept the gap?