Least-Privilege Access for Clients, Developers, and a Contractor
A digital agency runs 200 sites for 40 clients on one factory. Each client has two editors who should edit only their own site. The agency has 8 developers who deploy code, and 3 account managers who need to create sites for their clients. A client requests 'admin' access to its site group because it wants to manage users. A contractor will need access to 10 specific sites for 6 weeks to fix accessibility issues. The agency's security policy requires least privilege, quarterly access reviews, and immediate revocation when a contract ends.
1. Map each group to the least-privilege role model.
Read the worked answer
Reasoning: The factory has platform-level, site-group-level, and site-level concerns; mixing them creates unnecessary blast radius.
- Client editors: site-level content editing roles on their own site only. No site creation, code, or user administration outside their site.
- Developers: code deployment and environment access for the stacks they support, but not client user administration or site deletion.
- Account managers: permission to create sites within their assigned site group, not code deployment or platform configuration.
- Client 'admin' request: grant site-group user management or site-level user administration only if the client truly needs it; do not grant factory/platform administrator.
- Contractor: site-level roles on the 10 named sites, not site-group or platform roles.
2. How should the client's request for admin access to its site group be handled?
Read the worked answer
Reasoning: 'Admin' is ambiguous. The agency should translate it into the specific tasks the client needs to perform.
- Ask what the client wants to manage: users, content types, menus, or site settings.
- If the need is user management for its own site, offer a site-level user administrator role or a narrowly scoped site-group role.
- If the client needs to create additional sites, consider site-group administration with an explicit agreement and audit review.
- Do not grant platform administrator, code deployment, or cross-group access; those exceed the stated need.
- Document the decision and add the client to the quarterly access review.
3. What process controls should govern the contractor's access?
Read the worked answer
Reasoning: The contractor's access is temporary and scoped to 10 sites, so the control must combine technical scoping with an enforceable end date.
- Create or use a dedicated site group containing only the 10 sites, and assign site-level roles there.
- Manage access through the agency's identity provider so the account expires or is disabled at contract end.
- Record start date, end date, approver, and the exact sites in the access request.
- Require the contractor to use named accounts, not shared credentials, and review activity during the engagement.
- At week 6, revoke access immediately and verify removal in both the identity provider and Site Factory.