# Give every identity a defined boundary.

Identity & access management

Implement SSO, least privilege roles, service identities and auditable access changes.

## Access follows the person and the task

Illustrative workflow.

- Identity provider: Authentication and account lifecycle
- Application policy: Organisation, role and resource checks
- Audit trail: Privileged actions and access changes



## A hidden button is not access control

### Hide the button for the wrong role

A direct request can still reach the action if the server does not enforce the same permission.

### Authorise every protected operation

Check identity and resource context before reading or changing data, then retain an appropriate action record.

## Signing in is not the end of access control

Model who may act on which resources, including service accounts, delegated administration and support access. Enforce those decisions at the server boundary and test revocation.

Illustrative scenario, not a customer case study.

An integration worker requires access to a small subset of business data.

Give the workload its own identity and scope permissions to its operations. Keep human administration separate and review permissions when the worker’s responsibilities change.

Verification: Attempt prohibited reads and writes using the actual workload identity and retain the denied-operation evidence.

## Make permission explicit at every boundary.

### Identity lifecycle

Define how user and service identities are created, changed, reviewed and removed.

### Authorisation rules

Apply access checks to business actions and records, including background operations.

### Access evidence

Record administrative changes and review privileged access against current responsibilities.

## What needs attention in your system?

Select the areas you want to discuss. The HTML page can download your selections.

- [ ] Identity lifecycle: Define how user and service identities are created, changed, reviewed and removed.
- [ ] Authorisation rules: Apply access checks to business actions and records, including background operations.
- [ ] Access evidence: Record administrative changes and review privileged access against current responsibilities.

## Can we retain the existing identity provider?

Usually. Review the required protocols, account lifecycle and application permissions before introducing a second identity system.