Our New Starters Inherited Everything Their Predecessors Had Collected

Описание и применение

Автоматизация приёма новых сотрудников копировала все группы предыдущего сотрудника, что приводило к несанкционированному доступу. Перейдя к ролям, компания теперь назначает доступ по ролям отдела, с отдельным одобрением дополнительных прав и автоматическим удалением временных прав.

Задача

Automated onboarding copied all predecessor access, leading to unauthorized permissions for new starters.

Результат

The new onboarding process eliminates unauthorized access, reduces manual effort, and introduces regular role reviews.

Рабочий процесс

• 1. Identify new starter’s job role.
• 2. Assign role definition owned by the relevant department.
• 3. Grant group memberships listed in the role.
• 4. Request and approve any additional access separately.
• 5. Set end dates for temporary permissions.
• 6. Remove old role access 30 days after job change unless overridden.
• 7. Review role definitions quarterly.

Доказательства

The automation took a shortcut our service desk had used by hand for years. The hiring manager names the person being replaced, or a colleague in the same job, and the new starter receives the same group memberships.

Источник

About a third of the people who had joined through the automation held access that nobody in their current team could explain.

Источник

New starters now receive access from a role definition owned by their department, around ninety roles written with the managers, each one a list of groups.

Источник