News Corp / Professional experience
Keep access aligned when people change roles
The problem
Joining, moving teams, and leaving trigger access decisions across multiple systems and owners.
My contribution
I mapped identity lifecycles, requirements, dependencies, exceptions, responsibilities, and control points with stakeholders.
Reviewed documentation made current-state gaps and proposed future-state changes traceable.
02 / See the thinking in practice.
Explore an example.
See it in practice
Follow one employee change.
Choose an event to see the handoff, the control, and the proof to keep.
Give the new hire the access their role needs.
Approve before grant- HR confirms the start
- Manager requests role access
- IT provisions approved access
What happens
A new hire’s active HR record supplies their role and start date.
The control
Tie access to an approved request. Check for conflicting permissions before granting it.
Proof to keep
HR trigger, manager approval, provisioned access, and a first access review.
Inspect the supporting detail
In this reconstructed flow, core access comes from the role; additional access comes from an approved catalog request. A 30-day certification checks that only the intended access is live. These are sample control timings, not measured service results.
A new role should not inherit every old permission.
Review old access- HR records the transfer
- Manager checks old and new access
- IT applies the approved changes
What happens
An employee changes department, role, or manager.
The control
Review what carries over, remove permissions no longer needed, and check conflicts against the new role.
Proof to keep
Role-change trigger, carryover decision, removal/grant records, and recertification.
Inspect the supporting detail
The model makes both sides of the transfer visible: new access to grant and old access to remove. An unconfirmed entitlement is routed for resolution instead of being silently retained.
Close access, then check that nothing remains.
Confirm removal- HR records the departure
- IT disables and revokes access
- Security checks the completion record
What happens
A termination or last-day event reaches the access process.
The control
Disable access at the approved effective time, revoke entitlements, and check for missed accounts.
Proof to keep
Effective date, disable/revoke confirmations, exception owner, and follow-up reconciliation.
Inspect the supporting detail
This illustrative flow includes shared credentials, tokens, and orphaned accounts. The sample follow-up sweep is seven days later; effective timing and exceptions would be agreed with HR, security, and application owners.
What a recurring access review should change
Unused administrator access: remove the elevated permission when the role only needs read access.
Active, time-bound contractor access: retain it when the need is confirmed and the expiry is controlled.
Powerful account with no owner: investigate, assign accountability, and resolve the risk before certification.
03 / Bring it back to the role.
What this demonstrates.
I translate cross-system access processes into clear responsibilities, requirements, and control dependencies.
Project scope and example context
The application count is program scope, not systems I implemented. Future-state changes were proposed rather than implemented. Timings and employee records in the example are fictional.