Our New Starters Inherited Everything Their Predecessors Had Collected

说明与用途

自动化入职复制前任所有组，导致未经授权的访问。改为基于角色的访问，按部门角色分配，额外权限需单独批准，临时权限自动移除。

问题

Automated onboarding copied all predecessor access, leading to unauthorized permissions for new starters.

结果

The new onboarding process eliminates unauthorized access, reduces manual effort, and introduces regular role reviews.

工作流

• 1. Identify new starter’s job role.
• 2. Assign role definition owned by the relevant department.
• 3. Grant group memberships listed in the role.
• 4. Request and approve any additional access separately.
• 5. Set end dates for temporary permissions.
• 6. Remove old role access 30 days after job change unless overridden.
• 7. Review role definitions quarterly.

证据

The automation took a shortcut our service desk had used by hand for years. The hiring manager names the person being replaced, or a colleague in the same job, and the new starter receives the same group memberships.

来源

About a third of the people who had joined through the automation held access that nobody in their current team could explain.

来源

New starters now receive access from a role definition owned by their department, around ninety roles written with the managers, each one a list of groups.

来源