Chapter 10 — Ethics and authorized practice

Chapter 10 — Ethics and authorized practice

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Written permission"]
  N2["10.2 Respect for colleagues"]
  N3["10.3 Raising concerns"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Written permission"]
  N2["10.2 Respect for colleagues"]
  N3["10.3 Raising concerns"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Written permission]
    |
    v
[10.2 Respect for colleagues]
    |
    v
[10.3 Raising concerns]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) work only within written permission; (2) handle colleagues' data respectfully; (3) raise concerns appropriately.

10.1 Written permission

Before any identity work at Greenhill, Elena receives a written agreement from the chief executive and IT lead stating what she may do: receive exports, analyse them, interview staff and recommend changes. It excludes signing in to systems as an administrator, testing passwords or trying to get around any control. If a task seems to need more, she stops and asks. Working only within written permission protects Greenhill, protects Elena legally and keeps the trust that makes the placement possible.

10.2 Respect for colleagues

Identity data is about colleagues: when they work, what they can access and sometimes mistakes they made. Elena uses it only for agreed purposes. She does not comment on individuals' sign-in times or share findings about named people beyond those who need to act. When she finds a manager with excessive access, she reports it to the IT lead factually, without blame, because most excess access builds up through ordinary job changes rather than bad intent. She also avoids discussing findings about named people outside agreed meetings.

10.3 Raising concerns

Sometimes Elena finds something serious, such as a former employee's account that signed in after they left. Her agreement sets out what to do: report immediately to the IT lead and her supervisor, preserve the evidence and take no further action herself. She does not investigate on her own or confront anyone. Clear escalation routes mean serious issues reach the right people quickly, and students are protected from situations beyond their role and authority. Her supervisor reviews the escalation steps with her at the start of the placement.

Worked example

Elena finds a synthetic leaver account with a sign-in after the leaving date, reports it to the IT lead and supervisor the same day and preserves the export.

Synthetic case. The agreement, findings and people are synthetic.

Errors and limits

Investigating a suspicious sign-in alone, beyond the agreed role, can damage evidence and exceed authority.

Exercises

• EX028 — Excluded actions. Name two actions Elena's agreement excludes. Rubric: 3 = admin sign-in, password testing, bypass attempts (two);; 2 = one;; 1 = vague;; 0 = none.
• EX029 — Excess access tone. How does Elena report a manager's excess access? Rubric: 3 = factually, without blame;; 2 = neutral;; 1 = publicly;; 0 = none.
• EX030 — Suspicious sign-in steps. What should Elena do about a leaver's post-departure sign-in? Rubric: 3 = report to IT lead and supervisor, preserve evidence, act no further;; 2 = report;; 1 = investigate;; 0 = none.

Synthesis

Written permission, respect for colleagues and clear escalation keep identity work ethical and safe.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →