Access Requests: Getting from Four Days to Four Hours

The median time to grant a new employee access to the tools they needed was four working days, and 38 percent of requests were approved by someone who did not know what was being granted. Both numbers fell sharply after a small structural change.

The company had 70 employees and about 30 systems. Requests went by message to a manager, then to an administrator, then to a security review for anything with customer data.

Where the four days went

Of the four days, about 40 minutes was actual work. The rest was queueing: a manager reading messages twice a day, an administrator batching requests on Tuesdays and Thursdays, and a security review that met weekly.

Batching is efficient for the approver and expensive for the requester, which is a trade nobody had made deliberately.

The approval that meant nothing

Managers approved requests they did not understand. A request for read access to the billing replica and a request for write access to the same replica produce different risk and identical messages. Thirty-eight percent of approvals belonged to managers who later said they had assumed it was the lesser one.

An approval that carries no information is worse than no approval, because it creates a record that suggests someone checked.

The role bundles

The fix was to stop requesting systems and start requesting roles. Eight roles were defined, each a named bundle of permissions: support agent, support lead, engineer, engineer on call, analyst, finance, people operations, contractor.

Each role was reviewed once by security and by the team that owned the systems. After that, granting a role was an administrative action rather than a decision.

The request form

The form asked for three things: the person, the role, and the end date. The end date was mandatory, which was the contested part. Two managers argued that permanent roles do not need an end date and were told to put a review date twelve months out.

Requests without an end date were returned unread for the first three weeks, which trained the habit faster than any note.

The time it takes now

Requests for a defined role are granted within four hours, because the administrator processes them twice a day and there is nothing to decide. Requests outside the eight roles go through the old path and take about three days, which is the correct speed for a decision that has not been made before.

Median across all requests is now four hours, because 82 percent of them fit a role.

The removal problem

Roles made granting easy and removal easier, which was not the original goal. Before the change, access was removed when someone remembered. With an end date attached to every grant, 214 stale permissions were found in the first sweep, some belonging to people who had left.

The sweep took an administrator about a day, using the role list as the checklist rather than the system logs.

What the change did not fix

Contractors still sit outside the model, because their access needs are shaped by a specific project rather than a job. They are granted a role plus an exception, and the exceptions are where the remaining risk sits.

Nine exceptions were active at the last count, each with an end date and a named sponsor.

Four months on

Median grant time fell from four days to four hours. The share of approvals from managers who understood what was granted rose to 94 percent, measured by asking them a week later. Stale permissions fell from 214 to 23 after the first sweep.

Four days once bought forty minutes of work and an uninformative signature. Four hours now buys a defined role, an end date and a record that means something.