The Cost of Access That Never Leaves

Some of the most loyal users in a system are people who no longer work there.

I found that out while working with system administrators to understand how they provisioned and removed access. We were drafting an identity standard, and I wanted it to reflect how the work actually happened.

We walked through their processes one system at a time and found gaps along the way. Then I asked for access to the systems themselves, and for exports of their users.

The conversations told me how the process was supposed to work. The exports told me how it did.

We were paying for licenses for people who had left the company, some of them long gone. And people who had been terminated still had active access in those systems, months later.

Nobody was hiding anything. Removal depended on someone remembering to do it, in each system, every time someone left. When access is being granted, someone is waiting on the other end and asking where it is. When someone leaves, nobody is waiting, so nobody asks.

That gap has costs that do not show up anywhere obvious. Licenses renewing for people who are gone. Accounts that still work for someone who no longer works there. Audit findings when someone finally looks. Hours of cleanup, system by system, just to find out who is still in there. And an account that still works is an account something can still use, whether that is a person, a script, or an AI tool that finds it first.

It is the same problem as joining, running in reverse. Access arrives one request at a time, and it leaves the same way, if it leaves at all.

This is where leading identity gets practical. Do not stop at the process description. Ask for the export, and compare who is in the system with who still works here. The person leading identity is usually the one who has to ask, because nobody else will.

Related

• Series 2 Post 12: LinkedIn post
• Series 3 Post 1, The Cost of Waiting for Access
• Series 3 Post 2, The Access That Follows You