Chapter 38 — Identity and access management: validation
Lesson map
Lesson 38 published. Map, example, EX112.
flowchart TD
N0["Learning outcomes"]
N1["38.1 Verification versus validation"]
N2["38.2 User evidence"]
N3["38.3 Comparing with goals"]
N4["38.4 Acting on validation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX112"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["38.1 Verification versus validation"]
N2["38.2 User evidence"]
N3["38.3 Comparing with goals"]
N4["38.4 Acting on validation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX112"]
[Learning outcomes]
|
v
[38.1 Verification versus validation]
|
v
[38.2 User evidence]
|
v
[38.3 Comparing with goals]
|
v
[38.4 Acting on validation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX112]
Learning outcomes
You will (1) validate that the system meets stakeholders' real needs; (2) gather user evidence; (3) compare with original goals.
38.1 Verification versus validation
Verification asks whether the system meets its written requirements; validation asks whether it meets the real needs of the council and its staff. A system can pass every test and still fail people, for example if passkey enrolment works but depot staff find it impractical in their conditions. Sana plans validation separately: interviews with staff from different departments, observation of sign-in at a depot and in a social care office, and review of desk tickets for recurring frustrations that requirements did not anticipate.
38.2 User evidence
Sana interviews twenty staff across roles and observes sign-in in three locations. Most office staff find passkeys faster than passwords. Depot staff report that security keys work but are easily left in vans. Social care staff value single sign-on but dislike re-authentication before viewing sensitive records during visits. She records each finding with its source and frequency, distinguishing widespread issues from individual preferences, and treats interviews as evidence alongside numbers rather than as anecdotes to be dismissed. Findings are shared with participants for confirmation.
38.3 Comparing with goals
Returning to the problem statement in chapter 20, Sana checks each goal. One strong sign-in for all applications: met for 120 of 140 applications, with plans for the rest. Role-based access with governed exceptions: met, though exceptions need continued attention. Prompt removal of leavers: met for integrated applications. Evidence that these happen: met through measurement and the verification dossier. She states where goals are only partly met and why, which gives directors an accurate picture rather than a celebration. The comparison is repeated each year.
38.4 Acting on validation
Validation leads to changes. Depot staff receive key holders attached to their high-visibility jackets. Social care re-authentication is adjusted so a recent phishing-resistant sign-in on a managed device satisfies the sensitive-records check for a limited period, after a risk discussion with the service owner. Recurring desk tickets about enrolling new phones lead to a self-service guide. Each change goes through normal change control and is recorded, so validation produces improvements rather than just a report. Follow-up interviews check whether the changes helped.
Worked example
Validation with twenty interviews and three observations leads to key holders for depot staff, adjusted social care re-authentication on managed devices and a self-service phone guide; 120 of 140 applications meet the single sign-on goal.
Synthetic case. Interviews, findings and counts are synthetic.
Errors and limits
Treating a system that passes all tests as finished ignores whether it serves people in their real conditions.
Exercises
- EX112 — Validation definition. How does validation differ from verification? Rubric: 3 = validation checks real needs; verification checks written requirements;; 2 = needs vs requirements;; 1 = same;; 0 = none.
- EX113 — Depot finding. What did depot staff report about security keys? Rubric: 3 = they work but are left in vans;; 2 = forgotten;; 1 = broken;; 0 = none.
- EX114 — SSO coverage. How many applications meet the single sign-on goal? Rubric: 3 = 120 of 140;; 2 = 120;; 1 = 140;; 0 = none.
Synthesis
Validation with real user evidence checks the system against actual needs and drives practical improvements.
Continue studying — chapter 38 of 50
← Chapter 37 (draft) · Course chapter index · Chapter 39 (draft) →