The Cost of Waiting for Access

I have watched this happen more than once, in more than one organization. The details here are blended. The pattern is not.

A contractor starts on Monday. They show up ready to work.

Someone put in a request for network access, so they can get on the network. That is as far as they get.

The work lives in three systems, and each one needs its own request. And a few days in, someone discovers a fifth: the virtual desktop that is the only way into those systems.

Who submits them is its own problem. Sometimes it is the manager. Often it is whoever is closest: a teammate, someone from the consulting firm, another person, or the contractor themselves. The access has one name on the team and a different one in the request catalog. And when a request stalls, who do you even ask?

Then the waiting starts. Approvals rarely come back the same day, and each approved request then lands in an admin queue, where a three-business-day turnaround is common unless provisioning is automated. Five requests finish at five different times. Specialized access, with extra approvals, security reviews, or a license someone has to buy, takes longer still.

When the last one finally clears, the contractor asks the question nobody planned for.

"How do I actually log in?"

In between, they shadowed a teammate, sat in on meetings, and read whatever they could reach. And they billed every hour, because they were there and ready.

At $100 an hour, two weeks of that is $8,000. Three weeks is $12,000.

And the invoice is only the part you can see. It does not count the hours spent by the requestor figuring out forms, the approvers reviewing each one, the admin teams working each ticket, and everyone escalating along the way. The project planned around their start date slips just as far, and everything behind it moves too.

Nobody did anything wrong. The process had been built one system at a time, and nobody had ever walked through it as the person starting on Monday.

Most of what this contractor needed could have been known before they started. People doing the same work tend to need the same access. When that is defined ahead of time, many of these requests never need to exist. That is what access roles are supposed to do. Why they often don't is Series 3 Post 7, Why RBAC Fails.

Leading identity means walking it that way. Count the requests, the people who touched them, the days, and the hours someone spent waiting to do the job you hired them for.

Five requests is not the highest number I have seen. I suspect someone reading this has a bigger one.

Related

• Series 1 Post 10: LinkedIn post