jperezduerto.info
Security in depth · Unit 24 · Lesson 13 of 14
Moving roles should remove old access
Compare a role-change approval with surviving access, including temporary handover exceptions.
Helpful before thisActive Directory
After this lesson you can
- Separate a justified time-limited handover from obsolete write authority after a role change.
A new job should not quietly come with every permission from the previous one.
Compare authority with current purpose
Identity management covers joining, moving, temporary duties, and leaving. A department change in a directory record is not itself evidence that permissions changed. An organization may automate that relationship, but the automation and its result need verification.
Review direct and indirect grants against the new role. Business owners approve the need; technical owners translate it into permissions and verify the outcome. An exception needs a purpose, allowed operations, and an end condition.
Supplied record: the community museum
Emi moves from registration to exhibitions at the fictional museum.
New approval: edit exhibition descriptions.
Handover approval: read registration rosters for two days, through Friday at 17:00.
Current exhibition grant: edit, as approved.
Surviving registration grant: read and write, with no expiry.
Owner decision: registration writing is no longer required.
Assume these are the reviewed effective grants, including nested memberships, and Emi owns no service dependency requiring registration writes. The old grant exceeds both the permitted operation and the approved duration. Keeping it unchanged is not justified by the handover.
Write the transition, including its end
Keep the approved exhibition authority, replace obsolete roster writing with the approved temporary reading, and record who ends that reading on Friday. Include a named reviewer and confirmation evidence, not merely a calendar reminder.
The acceptance record should show registration writes denied and approved work preserved. Changing a directory membership does not prove every existing application session immediately refreshes its authorization; include the relevant session behavior in the verification scope.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Emi’s handover permits two days of roster reading, but her old grant still allows indefinite writing. What matches the approval?
Show the answer
Correct answer: Remove the obsolete write authority and provide only the approved temporary read access, with an owner and expiry. The documented handover justifies limited reading for two days, not indefinite writing. The new exhibition access can remain as approved.
Try it
- WriteWrite an access transition record for Emi: retain, replace, or remove each supplied grant. Name the approving owner, exception expiry, and evidence that roster writes are denied while approved work remains possible.