Building Data Driven Access with the tools you have

Access reviews and deprovisioning get harder as zero trust principles demand more granular permissions. This talk asks how quickly access is removed after an employee leaves, how much of that work is manual, and what should change when someone is promoted. It describes a two-year effort at a regulated healthcare technology company growing from a small team to several hundred staff, with no single product solving the problem.

The core idea is to treat the HR system as the authoritative source and pull as many attributes from it as possible, such as location and whether someone actually manages people. Identity provider rules then assign group membership automatically, with exclusion groups that block access for people abroad or during an incident. The presenter warns against automating from easily changed fields like manager or job title. Offboarding moved from a roughly forty-step manual process to an HR-triggered workflow that calls other systems, including a tool for Google licenses and a service that ships equipment back from remote staff. Access requests now go to system owners through delegated approval, which reportedly cut IT tickets by about two thousand a year.

The talk also covers limits: single sign-on often sits behind costly plans, and apps lacking provisioning or group sync force manual steps. Involving procurement early and sorting systems into simple sensitivity tiers help. The takeaway is to push logic into the platform you already own and empower your team to build small custom integrations.