Entitlement reviews need business context
Asking a manager to certify a list of permission names produces a rubber stamp.
They cannot tell whether a role called finance-reporting-writer is appropriate, so everything gets approved. Reviews only work when the question is in business terms: this person can approve payments up to this amount, is that correct. That takes effort to produce and is the difference between assurance and a signature.
More on Authorisation and privilege
- Least privilege decays over timeNobody hands the old one back
- Break-glass access should be exceptional and noisyLoud on purpose
- Privilege boundaries matter more than job titlesRead the account, not the business card
- Permission inheritance can hide excessive accessGranted upstairs, arrives downstairs
- Wildcard permissions widen blast radiusOne character, a much bigger circle
- Deny rules can create hard guardrailsOne no ends it