The Access That Follows You

Someone in finance moves to a new job and keeps their old access for a while to help their backfill. A year later, two people still have it.

It starts as a reasonable request. Nobody wants the new person stuck, and the one who knows the work best is right there.

The trouble is that "for a while" has no end date. Nobody circles back. The old access stops being used, but it does not stop working. A year later, two people hold the old job's access: the one doing the job and the one who left it.

In finance, that can matter. The person who moved may now be able to do two things that were deliberately kept apart. In my book I call this drift. An AI assistant working with that person's access would find it in an afternoon.

Moves tend to be the lifecycle event programs handle worst, because nothing forces the question. The new access gets done. The old access just stays.

Here is where I would start.

Grant transition access as its own request, with an end date and an owner.

Decide what counts as a move. It is often a combination, like a new job title in a different department. If access roles are granted from attributes, a change to those attributes is a move.

Make every move trigger a review of everything the person holds. Removing the old access role does not touch anything they requested on their own.

For people who have moved since their last review, a one-time certification campaign is often the easiest way to catch what was left behind.

It usually starts with someone trying to help.

Related

• Series 1 Post 6: LinkedIn post
• Series 3 Post 1: LinkedIn post