Access to nine internal systems, as a process

Joiners, movers and leavers across nine internal systems, turned from ad-hoc requests into an auditable process.

Problem: Access to internal systems was granted ad hoc; nobody could say who had what
My role: Owner of accounts and access across 9 internal systems
What I did: Role-based needs map; request → approval → provisioning → revocation, revocation tied to leaving
Result: Joiner and leaver changes became an auditable process, not ad-hoc requests

The situation

Access to internal systems was granted by request, case by case. Nobody could answer "who has access to what" without asking around.

What I designed

A map of which roles need which systems, and one flow for every change, from request to approval to provisioning to revocation. Revocation is tied to a person leaving, so it cannot be forgotten.

What it gave the company

Access changes became a process with a record, not a favour. The question "who has what" has an answer.