The Control Nobody Wrote Down

In some systems, the most important control is a person who knows which account not to touch.

I once worked on bringing a legacy application into an identity governance platform. It ran as several separate instances, each with its own manual processes. Before anything could be connected, we had to find an owner for all of it, learn how identity actually worked in each instance, and write down where each one deviated from the standard and what that risked.

What stood out was how much of the safety lived in people. The admins knew which instance behaved differently, which shared account held something up, and who to call when a change looked wrong. None of that was in a procedure. It was in their heads.

That knowledge is a control. Because it is not written down, nobody counts it, funds it, or plans for losing it.

An agent does not have it. It works from what it can reach, not from what the team knows. It will use the account everyone knows not to touch, because nothing tells it not to. The same thing happens when the person who knows retires, or when an old service account gets picked up by a new integration.

I wrote a line for the book that fits here: if people are unsupported, AI will magnify the consequences of their uncertainty. Where people are the control, taking them out of the loop takes the control with them.

Before an agent works anywhere near a system like that, get what people know out of their heads.

Pick one application that matters and walk it through all five pillars with the people who run it.

Governance: who owns it, and every account in it?
Lifecycle: how do people, service accounts, and agents get in, change, and get out?
Access: does anyone know what each account can do?
Technology: can the systems show who or what acted?
People & Change: what do the people running it know that is not written down anywhere?

Every answer that starts with "only one person knows" becomes one of three things: a documented rule, a technical control, or a risk someone owns on purpose.

In a small team, most of this may live in one head, maybe yours. Start with the system you would least want to hand to someone else.

The admins on that application never thought of themselves as a control. I would want to know what they know before an agent starts working alongside them.

Related

• Series 1 Post 11: LinkedIn post
• Series 3 Post 4: LinkedIn post
• Series 3 Post 6: LinkedIn post