Before
Support had to check the requester account, identify the application, verify its assignment, determine the likely cause, and decide where to route the incident. For missing entitlements, an analyst also had to contact the application owner, update the ticket, track the response, and notify the requester.
How it works
- Analyze the access incident against account and application evidence, then validate the diagnosis and select the appropriate route.
- Ask for clarification, provide self-service guidance, escalate to second-line support, or request the application owner's approval for a missing entitlement.
- Apply approved access and verify it, or record the refusal or timeout in the incident and notify the requester.
Workflow details
- Diagnose: When a missing-access incident arrives, the workflow reviews the requester, application, ticket description, account state, application assignment, and available evidence. A guarded diagnosis classifies the issue as a missing assignment, locked or expired account, unknown or ambiguous application, policy or provisioning problem, or an indeterminate case.
- Route: The incident is updated with the diagnosis and sent down the appropriate path. Ambiguous applications trigger a clarification request, locked or expired accounts receive self-service instructions, and other unsupported or uncertain causes are escalated to second-line IAM support with the evidence attached.
- Request approval: For a confirmed missing entitlement, the workflow identifies the application owner and access group, places the incident on hold, informs the requester, and sends the owner an approval request. The owner remains responsible for the human approval decision, with a 72-hour response window.
- Complete or escalate: An approval adds the requester to the required access group, verifies the resulting application assignment, resolves the incident, and notifies the requester. A refusal closes the request with an explanation, while an unanswered request is escalated to IAM and the requester is informed.
What changed
Each incident now receives a structured diagnosis and routing decision before human intervention. Owner approval remains a human decision, while ticket updates, requester notifications, timeout escalation, access-group changes, and post-change verification occur automatically.
Work removed
Reviewing account status and application assignments separately, identifying the correct owner and escalation path, copying diagnostic evidence into the incident, sending approval and status messages, tracking the 72-hour owner response, and manually verifying approved access.
Expected outcome
At least three recurring manual checks—account state, application assignment, and ticket routing—can be consolidated per incident, with fewer handoffs that lack a documented diagnosis.
