Identity and access modernisation for multi-team systems

The challenge

Following multiple reorganisations, an enterprise had accumulated a tangled web of access permissions across its cloud estate, SaaS tooling and internal applications. Role definitions were stale — many mapped to team structures that no longer existed. Over 40% of accounts had permissions they no longer needed, and there was no reliable way to answer the question "who has access to what?" during an audit.

Previous attempts at IAM cleanup had stalled because revoking permissions risked breaking production workflows. Teams were reluctant to participate because the process was disruptive and the benefits were unclear to them.

What we did

Phase 1 — Access discovery. We deployed access analysis tooling across all identity providers and connected systems to build a complete picture of who had access to what, how that access was granted, and when it was last used. This produced a complete access inventory without requiring any changes to existing systems.

Phase 2 — Role model design. We designed a hierarchical role model based on job functions rather than team membership. Roles were composable — a base role for every employee, additive roles for specific capabilities, and time-limited elevated roles for break-glass scenarios. The model was designed to survive reorganisations without requiring bulk permission changes.

Phase 3 — Policy implementation. We implemented the role model as policy-as-code, with automated provisioning and deprovisioning tied to HR events. Access reviews were automated — instead of asking managers to review spreadsheets, the system flagged unused permissions and proposed revocations that managers could approve with a single click.

Phase 4 — Audit and compliance. We built real-time audit dashboards showing access posture, policy violations and remediation status. Compliance reports that previously took weeks to compile were generated automatically.

Measurable results

The organisation passed its next external audit with no access-related findings for the first time in three years. More importantly, subsequent reorganisations were completed without the access chaos that had previously accompanied structural changes.