Model access the way
you actually run it.
Teams, systems, levels, signers, and time limits. Written down once. Followed by every request.
Four things to describe.
That is the whole setup.
Teams
Departments and their people, each with a role: lead, developer, QA, manager.
Workspaces
Groups of systems with an owner and a Slack channel.
Resources
Each system you hand out, with a link and instructions for whoever grants it.
Levels
Viewer, Developer, Admin. Each with its own sensitivity and rules.
Rules you can
read aloud.
- Sensitivity is declared. Admin is not privileged until you say so.
- Signers are named. A count, plus people or roles who must sign anyway.
- Nobody approves themselves. And one person cannot sign twice.
- Time is part of the grant. An end date, or a review date.
- Write
- Elevated
- Admin
- Privileged
- Approvals
- 2, Tech Lead required
- Granted by
- Mason, with written steps
- Time limit
- 30 days, or reviewed every 90
One request.
Five signatures of proof.
- Request
A form link per organization. The reason is required.
Requester - Approve
Signers from the rule, in their roles, with timestamps.
Approvers - Grant
Done in the real system, then recorded with a note.
Provisioner - Review
When the date passes, Slack is told.
Owner - Remove
Confirmed by a person, or opened as a finding.
Provisioner
Start with what people already have.
Import your current matrix. Each grant shows up as historical. When the person registers, it goes through approval like anything new.
Describe one system.
The rest follows.
$12 per person, per month. Every feature included.