Access and identity

Access accumulates. People change roles and keep the old permissions, services get broad credentials because narrow ones were inconvenient, and contractors' accounts outlive their contracts. Left alone, entitlement always grows and never shrinks.

Principles that actually hold

• Least privilege, and it must be practical. A model so restrictive that people share accounts to get work done is worse than a looser one they follow.
• Role-based, not person-based. Grants attached to individuals are ungovernable at any scale.
• Time-bound elevation over standing privilege. Nobody should hold administrative access continuously because they occasionally need it. Elevation on request, with a reason, expiring automatically.
• Separate duties where the consequence is severe. The person who requests a payment does not approve it; the person who writes the deploy does not solely authorize the production change.

Authentication