Chapter 5 — Reviewing roles and authorisation
Lesson map
Lesson 05 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["5.1 Role baselines"]
N2["5.2 Measuring drift"]
N3["5.3 Explaining drift"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 Role baselines"]
N2["5.2 Measuring drift"]
N3["5.3 Explaining drift"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]
[Learning outcomes]
|
v
[5.1 Role baselines]
|
v
[5.2 Measuring drift]
|
v
[5.3 Explaining drift]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) define role baselines; (2) compare actual access to baselines; (3) explain drift.
5.1 Role baselines
Daniel works with the managing partner to define what each role needs. Accountants need staff resources, client files and tax software; administrators need staff resources and client contacts; partners also need billing. He writes these as baselines, each a list of groups. Baselines turn least privilege from a principle into something measurable: any group a person holds beyond their role's baseline is either a recorded exception with a reason or drift that should be removed. Managers confirm each baseline in writing before it is used.
5.2 Measuring drift
Using exports, Daniel compares each person's groups with their role baseline. In a sample across the firm he finds people with extra groups: an accountant with billing, an administrator with client files, and an accountant with payroll administration. Each is a question, not an accusation. Drift usually comes from covering for absent colleagues, past projects or role changes, and nobody removing the extra access afterwards. Measuring makes the scale visible and lets owners decide case by case. He records each case for the owner's decision.
5.3 Explaining drift
When Daniel presents drift, he explains causes and fixes: covering arrangements should have end dates; mover processes should remove old groups; reviews should catch the rest. He avoids naming individuals in the summary to partners, sharing names only with each person's manager. Explaining drift as a process issue keeps the conversation constructive, and fixing the processes prevents the same drift from returning after a one-off clean-up. The managing partner agrees that covering arrangements will now carry an end date set at the time they begin. Daniel adds this to the request form and checks it at the next review.
Worked example
Baselines are agreed for three roles; a drift comparison finds extra groups including billing, client files and payroll administration.
Synthetic case. Roles and findings are synthetic.
Errors and limits
Presenting drift as individual wrongdoing makes staff defensive and hides process causes.
Exercises
- EX021 — Admin baseline. What is the administrator baseline? Rubric: 3 = staff and client contacts;; 2 = two groups;; 1 = everything;; 0 = none.
- EX022 — Partner extra. What extra group do partners have? Rubric: 3 = billing;; 2 = billing plus a group partners do not have;; 1 = payroll;; 0 = none.
- EX023 — Drift meaning. What is a group beyond baseline? Rubric: 3 = exception with reason or drift;; 2 = drift;; 1 = normal;; 0 = none.
- EX024 — Drift cause. Name one cause of drift. Rubric: 3 = covering for absent colleagues;; 2 = role change;; 1 = attack;; 0 = none.
- EX025 — Naming approach. How are individuals handled in the partner summary? Rubric: 3 = not named; names to managers only;; 2 = anonymous;; 1 = named;; 0 = none.
Synthesis
Role baselines make least privilege measurable and drift fixable through process changes.
Continue studying — chapter 05 of 12
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →