Thirty-Eight Roles and a 22% Gap
A 1,400-employee logistics firm is replacing 200+ hand-assigned permission sets with a governed access model built from 38 roles mapped to HR job codes. Analysis shows 22% of staff hold at least one permission no role covers - mostly temporary project access that managers granted over email and never revoked. The migration window is 14 weeks and overlaps peak shipping season; headcount is frozen. Roughly 300 contractors turn over every 90 days and currently share local accounts because the vendor onboarding feed never reaches the identity provider. Auditors flagged both the shared accounts and the informal grants, and fieldwork for the next audit begins in six months.
1. Three problems compete for the first six weeks: the role gaps, the contractor accounts, and the audit clock. Which one should drive sequencing, and what makes the others wait?
Read the worked answer
Drive the sequence with the contractor accounts.
The selection rule is severity multiplied by how bounded the fix is, not by which problem feels most urgent.
- Contractor accounts are the only item that is both high severity and low dependency. Shared local accounts destroy attribution: when something goes wrong you cannot say which of the 300 people did it, and that same blindness makes the other two workstreams harder to evidence. The fix is also mechanical - extend the vendor feed into the IdP, federate, kill local accounts - and it closes an audit finding with a demonstrable artefact.
- Role gaps wait because they are unbounded. Every one of the 22% is a negotiation with a manager, and starting there consumes the 14-week window without producing a shippable result.
- The audit clock is a constraint, not a workstream. It tells you the order in which things must be evidenced; it does not tell you what to build.
Exception to the rule: if any shared account touches financial disbursement or can approve payments, it jumps ahead of everything, including peak season.
2. How would you handle the 22% of non-role permissions at cutover - and what would you refuse to do?
Read the worked answer
Time-box the gap instead of designing it away.
Treat each uncovered permission as an exception grant with four mandatory fields: a named individual, a named business owner, a ticket reference, and an expiry of 90 days or less. Re-justification is required to extend, and the exception register is reported monthly with its age distribution visible to the auditors.
What I would refuse:
- Baking the grants into new roles. Moving from 38 to 90 roles ratifies the drift and makes the model unmaintainable - you would be cementing the very pattern you were brought in to remove.
- Silent carry-over. A bulk grandfather loses the audit evidence and removes the only forcing function you have.
- Manager self-attestation without a date. An attestation with no expiry is an indefinite grant with extra paperwork.
- Blocking cutover on 100% coverage. That is unachievable and it converts a managed risk into a stalled project.
The decision rule: a grant survives only if it has both an owner and a date. Everything else expires by default - expiry is the safe failure mode.
3. At week 14 you must present to the audit committee. What do you show, and what number would you refuse to put on the slide?
Read the worked answer
Show leading indicators that are resistant to gaming, plus the distribution, not the average.
- Percentage of staff whose access derives entirely from a role (trend, not target).
- Contractor accounts federated versus still local - an absolute count, not a percentage.
- Mean and 90th-percentile exception age; count of exceptions past expiry.
- Exceptions broken out by department. A safe average hiding one team with 60 open exceptions is a false assurance.
- Audit findings closed, with the specific finding ID referenced.
What I would refuse to present:
- Role coverage as a percentage success metric. The moment coverage becomes the goal, someone adds roles to move the number - the metric manufactures the problem it is meant to solve.
- Raw access-removals counts. They measure activity, not posture, and they punish the team that carefully preserves legitimate access.
- A single blended average for time-to-revoke. The tail is the whole story.