When we automated the setup of new starters, the step that took longest to design was access. Every job needs its own mix of shared folders, applications, distribution lists and system roles, and we had no clean definition of what each job should have. So the automation took a shortcut our service desk had used by hand for years. The hiring manager names the person being replaced, or a colleague in the same job, and the new starter receives the same group memberships.
For three years it worked smoothly. Accounts were ready on the first morning and managers stopped chasing us. Then an internal audit of our finance system found that a credit controller who had joined four months earlier could approve supplier payments up to fifty thousand pounds. Nobody had asked for that. Her predecessor had covered the accounts payable manager's leave in 2021, been given approval rights for those three weeks, and kept them. The automation had faithfully copied them to her.
We looked across the company. About a third of the people who had joined through the automation held access that nobody in their current team could explain. Most of it was harmless. Some was not: payroll reports, the shared mailbox of a closed department, administrator rights on a test server. Each new starter inherited everything their predecessor had collected and passed it on in turn. The automation was copying history and calling it a role.
The cloning step is gone. New starters now receive access from a role definition owned by their department, around ninety roles written with the managers, each one a list of groups. Anything beyond the role is requested separately and approved, and access granted for a temporary reason carries an end date on which it is removed automatically. People who move jobs lose their old role's access thirty days after the move, unless their new manager asks otherwise. The owners of the finance and payroll roles review them every quarter.
Writing the roles took most of a summer. That was exactly the work the shortcut had let us skip.
Copying a person is quicker than describing a job. It also copies everything that happened to that person along the way.
– Serguey Shinder
Top comments (0)