Chapter 6 — Role drift lab

Chapter 6 — Role drift lab

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 The report"]
  N2["Lab — Role drift"]
  N3["6.2 Interpreting results"]
  N4["6.3 Agreeing actions"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 The report"]
  N2["Lab — Role drift"]
  N3["6.2 Interpreting results"]
  N4["6.3 Agreeing actions"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 The report]
    |
    v
[Lab — Role drift]
    |
    v
[6.2 Interpreting results]
    |
    v
[6.3 Agreeing actions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) run a role drift report on synthetic data; (2) interpret results; (3) agree removals and exceptions.

6.1 The report

Daniel writes a standard-library script that reads synthetic role baselines and each person's group memberships and lists any groups held beyond the baseline. It reads only synthetic data and prints a list for owners. Comparing sets, the groups a person has minus the groups their role needs, is simple and reliable, and the script can be rerun after every review to show whether drift is shrinking or returning. Daniel tests the script on a small file with known answers before using it, and he saves each output with its date so later runs can be compared.

Lab — Role drift

"""Role drift report on synthetic data (read-only): groups held beyond the role baseline."""
BASELINE = {
    "accountant": {"staff", "client-files", "tax-software"},
    "admin": {"staff", "client-contacts"},
    "partner": {"staff", "client-files", "tax-software", "billing"},
}
PEOPLE = [
    ("j.ross", "accountant", {"staff", "client-files", "tax-software"}),
    ("k.ng", "accountant", {"staff", "client-files", "tax-software", "billing"}),
    ("m.cole", "admin", {"staff", "client-contacts", "client-files"}),
    ("p.wade", "partner", {"staff", "client-files", "tax-software", "billing"}),
    ("s.ahmed", "admin", {"staff", "client-contacts"}),
    ("t.bell", "accountant", {"staff", "client-files", "tax-software", "payroll-admin"}),
]

def main():
    drift = 0
    for user, role, groups in PEOPLE:
        extra = sorted(groups - BASELINE[role])
        if extra:
            drift += 1
            print(f"{user} ({role}): extra {', '.join(extra)}")
    print(f"{drift} of {len(PEOPLE)} people hold access beyond their role baseline")

if __name__ == "__main__":
    main()

Run with python3 lab_drift.py. Verified output:

k.ng (accountant): extra billing
m.cole (admin): extra client-files
t.bell (accountant): extra payroll-admin
3 of 6 people hold access beyond their role baseline

6.2 Interpreting results

The run checks six people and finds three with access beyond their baseline: k.ng, an accountant, has billing; m.cole, an administrator, has client-files; t.bell, an accountant, has payroll-admin. j.ross, p.wade and s.ahmed match their baselines. Daniel ranks t.bell first, because payroll administration can change staff pay and bank details, a high-harm permission unrelated to accounting work, then m.cole, because client files are confidential, then k.ng. He checks each finding against the synthetic export before sharing it, and he records his ranking reasons so managers can see why the order was chosen.

6.3 Agreeing actions

Daniel takes the list to each manager. t.bell covered payroll during a colleague's leave last year; the access is removed. m.cole helps scan documents into client folders weekly; the managing partner approves a recorded exception with a six-month review. k.ng prepares invoices for her own clients; billing is added to a new accountant-billing role used by three staff. Each decision is recorded. Rerunning the script afterwards shows only the recorded exception remaining. The rerun output is kept as evidence for his portfolio.

Worked example

The lab finds 3 of 6 people beyond baseline; payroll-admin is removed, one exception is recorded and a new role absorbs the billing need.

Synthetic case. People, groups and the script are synthetic.

Errors and limits

Removing every extra group without asking can break legitimate work that should become a role or exception.

Exercises

• EX026 — Drift count. How many people held access beyond baseline? Rubric: 3 = 3 of 6;; 2 = three;; 1 = six;; 0 = none.
• EX027 — Top risk. Which finding was ranked first? Rubric: 3 = t.bell with payroll-admin;; 2 = payroll;; 1 = billing;; 0 = none.
• EX028 — Payroll reason. Why rank payroll-admin highest? Rubric: 3 = can change pay and bank details;; 2 = harm;; 1 = name;; 0 = none.
• EX029 — m.cole outcome. What happened to m.cole's access? Rubric: 3 = recorded exception with six-month review;; 2 = exception;; 1 = removed;; 0 = none.
• EX030 — k.ng outcome. How was k.ng's billing need handled? Rubric: 3 = new accountant-billing role;; 2 = new role;; 1 = removed;; 0 = none.

Synthesis

Set-based drift reports, reviewed with managers, lead to removals, exceptions or better roles.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →