Access management

Access management is usually modelled as an identity lifecycle: joiner, mover, leaver (JML). An authoritative source, typically the HR system, emits events that an identity governance and administration (IGA) platform turns into provisioning actions in directories and applications, today often over SCIM 2.0 (RFC 7643 for the schema, RFC 7644 for the protocol) or through connectors to Active Directory and Entra ID. The mover case is where most programmes fail: new rights are added promptly because someone needs them to work, but old rights are rarely removed, so accumulated privilege ("privilege creep") grows with tenure. Leaver processing has its own traps - disabling the directory account does not revoke local application accounts, API keys, OAuth refresh tokens or already-issued session cookies.

The authorisation model sits underneath. Role-based access control (RBAC, standardised as ANSI/INCITS 359) bundles permissions into roles derived from job functions; attribute-based access control (ABAC, NIST SP 800-162) evaluates policies over attributes of subject, object, action and environment at request time. Real estates are hybrids: coarse RBAC for birthright access, ABAC or fine-grained entitlements for sensitive data, and just-in-time elevation through privileged access management (PAM) for administrator rights. Segregation of duties (SoD) rules - for instance that nobody may both create a supplier and approve payments to it - are expressed as toxic role combinations that the IGA tool blocks or flags.

Assurance comes from periodic access reviews (recertification), in which data or system owners confirm or revoke each entitlement. Reviews degrade into rubber-stamping when owners are shown thousands of cryptic group names; effective programmes review by business role, highlight deviations from peer groups and track revocation rates. Orphaned accounts (no living owner), shared accounts and service accounts with non-expiring secrets are standard audit findings.

In control frameworks the topic is split across several controls: ISO/IEC 27002:2022 5.15 (access control), 5.16 (identity management), 5.17 (authentication information), 5.18 (access rights) and 8.2 (privileged access rights); CIS Controls v8 Control 5 (Account Management) and Control 6 (Access Control Management), where Safeguards 6.1 and 6.2 require documented processes for granting and revoking access. NIS2 Art. 21(2)(i) names access control policies explicitly. Access management should be distinguished from authentication (proving who someone is) and from access control as an enforcement mechanism: it is the governance process that decides what the enforcement point should enforce.