Before
IAM staff manually checked the requester’s profile and group memberships, reviewed separation-of-duties conflicts, and looked up the application’s criticality for each request. They then updated the request status, documented the rationale, and notified the appropriate approvers or security team.
How it works
- Collect the requester’s profile and current groups, then retrieve the application’s criticality.
- Check for existing membership and policy conditions, including conflicting duties, contractor status, and application risk.
- Update the request with the selected outcome and notify the appropriate approval or IAM channel when human review or security visibility is required.
Workflow details
- Request intake: A submitted access request provides the requester, requested group, application, justification, and request record reference. The workflow retrieves the requester’s profile and current group memberships before evaluating the request.
- Application context: The workflow looks up the application’s business criticality and uses that information alongside the requester’s profile and existing memberships to determine the appropriate handling path.
- Automated decisioning: Existing membership returns an already-member outcome, conflicting duties or a contractor requesting a criticality 1 application returns a separation-of-duties rejection, and criticality 3 or 4 requests are auto-approved. Criticality 2 requests are routed to a manager, while criticality 1 requests are routed to a manager, application owner, and security.
- Request updates: The selected outcome is written back to the access request, including approval or rejection status and work notes explaining the route. Duplicate access is closed rather than processed again.
- Operational handoff: Requests requiring human review are posted to the access-approvals channel, while conflicting-duty rejections are posted to the IAM separation-of-duties channel, giving the relevant team a clear, context-rich handoff.
What changed
Every submitted request now receives a consistent routing decision from the available identity, membership, conflict, and criticality data before a human handoff. The request record and relevant team channel are updated automatically, while approvers retain the human decision for requests that require approval.
Work removed
Manually looking up requester profiles and group memberships, checking application criticality, reviewing duplicate access and separation-of-duties conditions, selecting the approval route, updating request status and notes, and notifying approvers or the IAM security team.
Expected outcome
A conservative expected result is three recurring verification lookups automated per request—requester profile, current groups, and application criticality—with more consistent routing across the access queue.
