S-06 · IT
Nobody can say who
can do what — and it
has to be proved.
Entitlements live in the directory, in application roles, in database logins and in VPN groups. Five exports with no shared identifier, and a recertification deadline set on somebody else’s clock.
01 · The problem
A recertification that certifies nothing still produces a full evidence pack.
A role code means nothing to the manager being asked to approve it, so it gets approved wholesale — three weeks late, by the half of the list who answered at all.
02 · The work
What the quarter is actually made of.
- Exporting entitlements from five systems that share no user identifier, then splitting them per manager by hand.
- Joiners, movers and leavers — and the orphaned accounts of people who changed role twice ago.
- Triaging the service desk, where routine password and access requests bury the two tickets that matter.
- Assembling audit evidence after the fact, from work that was done without capturing any.
- Answering the same security questionnaire for the tenth time, from answers scattered across the previous nine.
03 · What we build
What the work looks like here.
- A-001 Workflow automation Joiners, movers and leavers driven from the approved event, with the evidence captured as the work happens rather than reconstructed later. lead time 2–6 weeks
- B-002 Custom AI agents An internal assistant that resolves the routine half of the queue and hands the rest over with its context attached. lead time 3–8 weeks
- C-003 Bespoke integrations One view of identity across systems that share no user identifier — including the ones with no connector. lead time 1–4 weeks
04 · Where it stops
Where it stops.
- Granting privilege. The system prepares and evidences it; the approval has to be a human to be worth anything at all.
- Anything that touches production data as part of resolving a request.
- An access decision during an incident — exactly when the shortcut is most tempting and least safe.
05 · Governance
The automation needs exactly the privileges that would make it a target.
So its own access is scoped, logged and separable from the estate it manages. Ticket text is scrubbed before it reaches a model — connection strings and customer data routinely sit in it — and endpoint telemetry stays a security control rather than a productivity measure.
06 · Next
Start with one recertification cycle.
No delivered case is published for this department yet. The work we are cleared to name is on the homepage.