1 min lesson
Group-based access is the unit of provisioning
Explain your answer to "Why is group-based access the foundation that makes JML automation and access reviews actually work?" Add one concrete detail from the lesson.
Step 1 of 3
Group-based access is the unit of provisioningno manual one-offs
Access should derive from role and attributes, never from a manual "add Jordan to this app" request. When access is a property of who you are, JML automation can grant and revoke it deterministically. One-off grants are exactly the entries that survive offboarding and show up in an audit.
Learn more
Full explanation
Least privilege and just-in-time elevation
Least privilege and just-in-time elevationshrink standing access
- Standing access
- Always-on permission; the larger your attack surface and audit burden
- Just-in-time (JIT)
- Elevation requested and granted for a task, then auto-expires
- Time-boxed
- Sensitive access (prod, admin consoles) granted for hours, not forever
- Default posture
- Revoke by default - access has to be justified to persist
For sensitive systems - production, the IdP admin console, finance - the right pattern is request-and-expire rather than a permanent grant. The person asks for elevation, it's approved (or auto-approved by policy) and it evaporates on a timer. The audit log then shows exactly who had power and for how long.
Learn more
Optional practice
Practice: Group-based access is the unit of provisioning
QEngineers need occasional production access. A standing 'prod-admin' group is easy but risky. What do you propose instead?