Chapter 11 — Group hygiene lab
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 The check"]
N2["Lab — Group hygiene"]
N3["11.2 Reading the results"]
N4["11.3 Deciding actions"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 The check"]
N2["Lab — Group hygiene"]
N3["11.2 Reading the results"]
N4["11.3 Deciding actions"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 The check]
|
v
[Lab — Group hygiene]
|
v
[11.2 Reading the results]
|
v
[11.3 Deciding actions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) run a group hygiene check on synthetic data; (2) interpret ownerless, empty and powerful groups; (3) decide actions.
11.1 The check
Kai writes a small standard-library script that reads a synthetic list of groups with their owners, members and whether they grant powerful permissions such as clinical write, finance or administration. It reports groups with no owner, groups with no members and groups that grant powerful access, so he can review them each quarter. The script checks only Fernhill's own synthetic directory data and changes nothing; it produces a list for a person to review and decide on. Kai checks the output by hand against the synthetic file the first time.
Lab — Group hygiene
"""Inventory synthetic directory groups: members, owner and what each group grants (stdlib only)."""
groups = [("clinic-north-staff", 18, "J. Reid", "north rota, shared drive"), ("clinic-south-staff", 16, "", "south rota, shared drive"),
("vets-all", 22, "Dr A. Cole", "clinical records write"), ("reception-all", 20, "M. Shah", "booking system"),
("finance", 4, "P. Lowe", "accounts, payroll"), ("old-project-2021", 7, "", "shared drive folder"),
("it-admins", 3, "K. Thompson", "directory admin"), ("locum-vets", 0, "Dr A. Cole", "clinical records write")]
print(f"groups={len(groups)}")
print("no owner:", [g[0] for g in groups if not g[2]])
print("empty:", [g[0] for g in groups if g[1] == 0])
print("powerful:", [g[0] for g in groups if "admin" in g[3] or "write" in g[3] or "payroll" in g[3]])
Run with python3 lab_groups.py. Verified output:
groups=8
no owner: ['clinic-south-staff', 'old-project-2021']
empty: ['locum-vets']
powerful: ['vets-all', 'finance', 'it-admins', 'locum-vets']
11.2 Reading the results
The run reads 8 groups. Two have no owner: clinic-south-staff and old-project-2021. One, locum-vets, is empty. Four grant powerful access: vets-all, finance, it-admins and locum-vets. Kai notes that an empty but powerful group is a risk, because anyone added to it later receives powerful access without a deliberate decision. He also notes that old-project-2021 sounds unused, which needs confirmation from the people who might know before it is deleted. He shares the list with Ruth before contacting any group owners, so the findings are checked first. The figures go into the quarterly report with a short note.
11.3 Deciding actions
Kai proposes actions: the south clinic manager owns clinic-south-staff; old-project-2021 is disabled for 30 days and then deleted if nobody objects; locum-vets is kept but adding members requires the senior vet's approval and an end date; and the four powerful groups are reviewed monthly rather than quarterly. Ruth agrees, adding that each action should be recorded with a date so the next run can confirm the change took effect and that nothing new appeared. The outcome of each proposed action is checked at the next quarterly run of the script.
Worked example
The lab reports 8 groups, 2 without owners, 1 empty and 4 powerful; Kai assigns owners, retires one group and tightens locum-vets.
Synthetic case. Groups and the script are synthetic.
Errors and limits
Deleting a group immediately because its name looks old risks breaking something still in use.
Exercises
- EX031 — Ownerless groups. Which groups had no owner? Rubric: 3 = clinic-south-staff and old-project-2021;; 2 = two;; 1 = finance;; 0 = none.
- EX032 — Empty powerful risk. Why is an empty powerful group risky? Rubric: 3 = anyone added later gets powerful access without a deliberate decision;; 2 = later;; 1 = vague;; 0 = none.
- EX033 — Retirement. How is old-project-2021 retired? Rubric: 3 = disabled 30 days, deleted if no objection;; 2 = disabled;; 1 = deleted now;; 0 = none.
Synthesis
A simple, read-only group check gives a repeatable list for owners to act on.
Continue studying — chapter 11 of 30
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →