RBAC, least privilege, and joiner-mover-leaver

Most breaches escalate through excess access: an account with more rights than its owner needs, or one that should have been disabled months ago. Identity governance is the discipline of making sure every principal has exactly the access its current job requires — and nothing else, for no longer than necessary.

Role-based access control, done right

RBAC assigns permissions to roles and roles to people, so access is managed at the role layer instead of thousands of individual grants. The failure mode is "role explosion" — a role per person — which recreates the mess RBAC was meant to remove.

• Model roles from **job functions**, not individuals; aim for a manageable catalog you can actually reason about.
• Separate **birthright access** (everyone in a department gets these) from **requestable entitlements** (approved on demand).
• Enforce **segregation of duties**: no single role should both create a payment and approve it.
• Keep an **entitlement owner** for every role who signs off on what it grants.

Least privilege as a default

Least privilege means each identity starts with nothing and gains only the specific access it needs. Standing broad access — permanent local admin, always-on cloud admin — is the thing attackers hunt for. Replace it with narrowly scoped, time-bound grants.

Privileged access management (PAM)

Privileged accounts — domain admins, root, cloud org owners, service accounts with broad scope — warrant dedicated controls beyond ordinary IAM.

• **Vault privileged credentials** in a PAM system; humans check them out rather than knowing them.
• **Rotate** privileged and service-account credentials automatically after use.
• **Broker sessions** so admin access goes through a proxy with **session recording** and keystroke logging.
• **Require MFA at elevation**, and enforce approval workflows for the most sensitive roles.
• Inventory and **govern non-human identities** (service accounts, tokens, API keys) with the same rigor as human ones.

Joiner-mover-leaver: access as a lifecycle

The single most common governance gap is the leaver whose access lingers. Drive the identity lifecycle from an authoritative source (HR / directory) so access changes are automatic, not ticket-driven.

• **Joiner** — provision birthright access automatically on hire date from the HR feed; nothing manual for standard roles.
• **Mover** — on a transfer, grant the new role's access and **remove the old role's access**. Accumulated leftover access from past roles ("privilege creep") is a top audit finding.
• **Leaver** — disable accounts and revoke tokens/sessions immediately on termination, ideally same-day and automated. Reclaim licenses and privileged memberships.
• **Recertification** — run periodic access reviews where managers and entitlement owners re-attest; auto-revoke anything not reaffirmed.