Tens of Thousands of Entitlements and the Few Anyone Reviewed

I have watched a clean audit miss almost everything, cycle after cycle.

The directory had grown to tens of thousands of groups. Every one of them was an entitlement, a way of granting access to something. Most had no description and no owner anyone could name. For many of them, there was nobody left to ask.

A small set of those groups was in scope for audit, so those were the groups that got reviewed. Same list, every cycle. The reviews closed on time. The audit came back clean.

Everything outside that list still granted access, and nobody could say to whom or why. The same thing happens with application roles and permissions, anywhere only part of the access is ever reviewed. None of it was anyone's job to look at, because none of it was going to be tested. It drifted there, one reasonable decision at a time.

This is how attention works in a lot of identity programs. The audit scope draws a line, and the line becomes the program. A clean audit tells you the list was reviewed. Whether it was the right list is a different question.

AI does not see that line. An AI tool connected with broad access uses whatever it can reach, in scope or not.

Auditors test what is in scope. Deciding what deserves attention belongs to the person leading identity. You do not have to review everything at once.

Find the access outside audit scope that reaches your most sensitive systems, and give it an owner and a review of its own.

Let what access reaches set how often it gets reviewed, whether or not an auditor will ever ask about it.

Before you connect an AI tool, limit its access to what its job needs.

I would rather choose what gets reviewed than let the audit list choose for me.

Related

• Series 1 Post 8: LinkedIn post
• Series 3 Post 4, The Accounts Nobody Hired