The Future of Identity Governance is Employee-Centric. Here's Why.

Employee-Centricity and RBAC are NOT Mutually Exclusive

It’s easy to think of the “black and white” Role Based Access Controls  (RBAC) and Employee-Centric Access Controls (ECAC) as being mutually exclusive. 

Think of RBAC as a building’s default floor plan (who can go where) and employee-centric controls as personalized keycards that can be updated based on evolving needs without rebuilding the whole structure.

Here’s how to properly combine the two for the best possible outcomes (as we know it today):

1. Use RBAC as a Foundation and Keep IT in Ultimately Charge:

• Create well-defined roles that match your organizational structure (e.g., Sales Rep, Finance Lead).
• Assign permissions conservatively (principle of least privilege).
• Extra for your employees: It’s good for them too if there is a clear cut and everyone knows what team gets what access!

‍2. Allow Scoped Exceptions or Extensions to Serve Employee Needs:

• Layer attribute-based or task-based access on top of roles.
• Example: An SEO Analyst (within “Marketing” role) may get temporary or project-based access to a PPC dashboard if they're covering during PTO.

3. Enable Self-Service:

• Based on the birthright role-based access (again: which is a great start for new employees, see above), enable every employee to request additional access in an easy-to-follow and intuitive (!!!) manner.  

4. Monitor and Adapt:

• Use workflows that notify IT/security for review, logging everything for audit. Things need to be kept in order and tracked for audits such as ISO 27001 compliance—so central teams don’t have to chase people in order to find out who has access to what. 
• Use tools like dynamic access reviews to remove stale or excessive permissions.

In other words: Employee-centric access controls are an adaptive approach to identity governance in which access rights are granted, monitored, and revoked based on a holistic view of the employee—their current role, responsibilities, context, behavior patterns, and risk level at any given moment. And in a manner that makes it easy for people to contribute to identity governance as a shared responsibility. AI will massively help simplify these processes—and that’s almost a paradox: AI is making the problem worse (more access!), but it’s also helping to bring access under control.  

Speaking of distributed responsibility: One of the key underlying aspects of employee-centric access controls is the concept of decentralization. Recently, we spoke with Siebert Timmermans, an Information Security Officer & Advisor who works with startups and scaleups to help them implement better security practices. He told us:

"One of the worst things you can do from a risk and time perspective is having one or two super admins in every single tool; they have to manage all configuration and access controls for everyone in the company. If you do this, you're setting yourself up for failure. . .a better way is to decentralize it; having the people who actually work with these tools day in and day out treat them in a responsible manner. They are responsible for configuring and maintaining the tool, for giving access, changing access, managing privileges, etc. Clarify what the responsibilities and expectations are and hold them accountable." -Siebert Timmermans, Information Security Officer & Advisor

And he's completely right. So many other aspects of a business' operations are decentralized, so why should the full onus of identity governance fall solely on your IT team? The crux is, every owner needs to contribute to Identity Governance and Administration (IGA) and the process. Rather than one IT team owning all tools, issues, troubleshooting, and adoption processes, each power user or app "champion" in a department should be able to handle day-to-day issues while the IT department manages and oversees overall security infrastructure to mitigate risk and create a team-based model. We are saying it again: IGA is a shared responsibility. 

We see this model in a number of other business functions as well:

• Content production/social media: Rather than one team creating and approving all content across locations and departments, local teams should instead create their own content that's tailored to their specific audience, while adhering to pre-approved templates and branding guidelines. The marketing team comes in to ensure everything is compliant with overall principles and on-brand (just like: RBAC). This makes the content more authentic and aligns with local trends while ensuring company wide processes are adhered to.
• Budget management: If one finance department acts as the decisionmaker for each team, needs often get overlooked or improperly prioritized. But when department leads are empowered to manage their own budgets (with general oversight from the finance team), it allows for quicker and more effective decisionmaking based on deeper understanding of their teams' needs.
• Customer Relationship Management: Decentralized CRM teams facilitate stronger client relationships. It empowers each rep to manage their clients based on actual interactions, rather than theoretical guidance from the top. Again, a centralized team should be empowered to oversee and ensure processes are adhered to.

Implementation: What to Consider Before Rolling It Out