Chapter 43 — Industry or public-service practice | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 43 — Industry or public-service practice

Lesson map

Lesson 43 published. Map, example, EX127.

flowchart TD
  N0["Learning outcomes"]
  N1["43.1 Public-service context"]
  N2["43.2 Stakeholders"]
  N3["43.3 Procurement and suppliers"]
  N4["43.4 Reflection on practice"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX127"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["43.1 Public-service context"]
  N2["43.2 Stakeholders"]
  N3["43.3 Procurement and suppliers"]
  N4["43.4 Reflection on practice"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX127"]

[Learning outcomes]
    |
    v
[43.1 Public-service context]
    |
    v
[43.2 Stakeholders]
    |
    v
[43.3 Procurement and suppliers]
    |
    v
[43.4 Reflection on practice]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX127]

Learning outcomes

You will (1) work within a public-service organisation's governance; (2) manage stakeholders and procurement; (3) reflect on professional practice.

43.1 Public-service context

Working inside a council differs from a classroom exercise. Decisions pass through governance boards, budgets follow annual cycles, and services must keep running for residents throughout. Sana attends the council's digital board monthly, presenting progress against success measures and risks. She learns to frame proposals in terms of service outcomes, such as fewer locked-out care workers, and legal duties, such as protecting residents' personal data, rather than technical features, because those are the terms in which board members make decisions.

43.2 Stakeholders

Many people have a stake in identity changes: HR, service owners, unions, the service desk, auditors and staff themselves. Sana keeps a stakeholder map recording each group's interests and concerns. The union raised a worry that sign-in logs might be used to monitor productivity; Sana works with HR to write a clear statement limiting their use to security and operations, which the union accepts. Listening early to concerns avoids opposition later that could have stalled the whole programme. The map is updated as new concerns arise.

43.3 Procurement and suppliers

The identity provider and some connectors are bought services. Sana helps write requirements for procurement, focused on outcomes such as support for phishing-resistant authentication, standard protocols like OpenID Connect, SAML and SCIM, exportable logs and clear limits on the supplier's access to council data. She learns that procurement rules require fair comparison of bidders and documented scoring, much like her architecture evaluation. Contracts include security obligations, such as prompt notification of breaches, that the council can enforce. Scoring records are kept for audit.

43.4 Reflection on practice

Sana keeps a reflective log during her placement, noting situations where technical correctness was not enough: a well-designed policy delayed because a director was not briefed, a rollout smoothed by floor walkers more than by documentation. Professional practice combines technical skill with communication, patience and respect for the people affected. She also records ethical moments, such as declining to share an individual's sign-in history with a manager without proper authorisation, and how she handled them. The log becomes evidence of professional development in her thesis.

Worked example

Sana presents monthly to the digital board, resolves a union concern with a written statement on log use, and helps procurement score bidders on standards support and data access limits.

Synthetic case. Boards, stakeholders and suppliers are synthetic.

Errors and limits

Presenting identity work to boards as technical features rather than service outcomes makes approval harder.

Exercises

EX127 — Union concern. What concern did the union raise? Rubric: 3 = logs used to monitor productivity;; 2 = monitoring;; 1 = pay;; 0 = none.
EX128 — Procurement outcomes. Name two outcomes Sana's procurement requirements stress. Rubric: 3 = phishing-resistant auth, standard protocols, exportable logs, limited supplier data access (two);; 2 = one;; 1 = price;; 0 = none.
EX129 — Ethical refusal. What request did Sana decline? Rubric: 3 = sharing an individual's sign-in history without authorisation;; 2 = sharing logs;; 1 = vague;; 0 = none.

Synthesis

Public-service practice requires governance awareness, stakeholder care, sound procurement and reflective professionalism.

Continue studying — chapter 43 of 50

← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →