The Privilege That Grows With Every Role Change

A nurse starts in the intensive care unit, temporarily supports the surgical center, takes on a role in bed management and, years later, begins coordinating a team. Each transition demands speed in granting access to new systems, medical records and reports. What tends to get left behind is the access from previous roles, which remains active out of convenience, lack of visibility or fear of disrupting patient care.

The same mechanism shows up in any organization. An analyst who supported finance, procurement and operations may retain permissions to view sensitive data, register suppliers and change parameters in critical systems. That person's credential comes to represent far more power than their current role requires. When it is compromised, the incident stops being an individual problem and gains operational, financial and reputational reach.

Accumulated access turns normal changes into structural risk

Granting access usually has a clear owner, since someone needs to work in a system to deliver results. Revocation tends to cut across departments, managers, human resources and technology, with no explicit owner for closing it out. This asymmetry creates accumulated privilege, that is, permissions kept after the business need has ended.

NIST, the National Institute of Standards and Technology, addresses this risk in controls AC-2, account management, and AC-6, least privilege, of SP 800-53 Rev. 5. These controls guide companies to grant only the access needed, review accounts periodically and remove privileges when a role changes. The logic is operational: every excess permission widens the impact surface of a mistake, a fraud or a stolen credential.

Microsoft's State of Cloud Permissions Risks Report highlights that environments with excessive permissions make it harder to identify privilege escalation paths. Privilege escalation is the ability to use seemingly limited access to reach higher-impact data, systems or actions. In business terms, a single compromised password can open a sequence of doors that no one ever evaluated as a whole.

In healthcare, this effect can expose medical records, schedules, prescriptions, diagnostic images and billing data. In other industries, it can reach customer lists, bank accounts, intellectual property, pricing or contracts. The relevant risk is not just the number of accessible systems, but the combination of actions a person can carry out without a second validation.

This combination also produces segregation-of-duties conflicts, when the same identity can initiate and complete a material transaction. A person able to register a supplier and approve its payment bypasses a separation designed to detect fraud. In a clinical setting, permissions that combine prescribing, dispensing and adjusting controlled-substance inventory weaken the traceability that protects patients and the institution itself.

Audits reveal the hidden cost of this model. Auditors are not looking only for a list of users; they are looking for evidence that each access corresponds to a current need, was approved by the responsible manager and can be traced. According to Gartner, identity governance and administration, or IGA, has gained relevance because it connects access decisions to policy, risk and the evidence the business requires.

How to turn access reviews into management decisions

The starting point is to drop the generic question of who has access and adopt a more useful one: what business activity does this person need to perform in their current role? This criterion shifts the discussion from systems to responsibilities. A role-based profile, defined as a set of permissions tied to specific responsibilities, reduces improvised decisions and makes transfers between departments easier.

An efficient review starts with the highest-consequence access, such as personal and clinical data, payments, system administration, master data changes and information exports. The company can cross-reference three elements: permissions granted, actual usage and potential impact. Access left unused for a defined period deserves validation, as it may indicate residual privilege or an operational dependency not yet formalized.

Department managers should confirm access because they understand the work requirements and potential role incompatibilities. Internal IT provides technical context, logs and controlled execution. A specialized backup team can sustain the process with continuous monitoring, approval workflows, role-change alerts and consistent documentation, supporting the internal team without replacing it. Services for governance and compliance help turn this evidence into a defensible routine when facing audits.

Maturity shows when promotions, transfers, temporary projects and terminations all trigger the same discipline: review what changes, remove what is no longer needed and record the decision. This cycle preserves agility because departments work with pre-approved profiles, while exceptions remain visible, have a deadline and receive a business justification.

5 questions every manager should ask

1. Why do we grant access quickly and revoke so little, and how much risk has that accumulated?

Why do we grant access quickly and revoke so little, and how much risk has that accumulated?

Companies grant access under legitimate pressure for productivity, continuity, and customer service. Revocation rarely gets the same priority, because its benefit is preventive and getting it wrong can lock out someone who still needs to work. Without a formal trigger that ties a change in role to a review of permissions, the decision simply has no owner.

Managers should ask for a historical view of the access added after promotions, transfers, and temporary coverage assignments. A nurse who has rotated through the ICU, the operating room, and bed management illustrates a common problem: she may need a new set of access rights, while her previous sets need to be explicitly revalidated. Accumulated risk grows with every exception that is kept without an expiration date, an owner, or a justification.

How many permissions exist, how many are actually used, and what could a compromised credential reach?

Counting active users does not measure exposure. A useful measure combines the number of permissions, the sensitivity of the resources, how often they are used, and the paths that access opens to other actions. A compromised credential is most dangerous when it can change data, create new accounts, approve transactions, or reach valuable information without additional controls.

A privilege analysis should highlight administrative access, rarely used permissions, shared accounts, and exceptions that survived organizational changes. Companies can define simple metrics: the percentage of access reviewed, unused permissions, expired exceptions, and open role conflicts. These numbers let the board and leadership weigh the reduction in exposure against the financial and regulatory risk they aim to control.

Which role conflicts allow one person to start and complete critical transactions?

Segregation of duties is the deliberate division of critical steps among independent people or controls. Its purpose is to reduce the chance that errors, intentional or not, go undetected. The problem arises when permissions are granted project by project and no one evaluates the final combination of capabilities held by a single identity.

Managers should map high-impact workflows, such as vendor onboarding and payment, changes to bank account details, discount approvals, reimbursement releases, and the handling of controlled medications. For each workflow, the question is straightforward: can a single person create, modify, approve, and conceal the transaction? Wherever the answer is yes, the organization needs segregation, independent approval, or enhanced monitoring.

How can managers confirm necessary access without turning the review into a rubber stamp?

Reviews fail when managers receive a long list of technical names and approve everything just to close out the task. The solution is to present decisions in understandable terms: the person, their current role, the system, the data or action accessed, the last time it was used, and the consequence of keeping the privilege. This structure lets the business owner assess the real need without deep technical knowledge.

Reviews should be driven by risk and by events, not just by the calendar. Roles with access to regulated information, financial resources, or critical configurations need more frequent cycles. Transfers and changes in responsibility should trigger an immediate review. Exceptions need an expiration date, a business sponsor, and a record of approval, so that temporary access does not become permanent through inertia.

What responsibilities belong to the business unit, internal IT, and specialized back-office support?

The business unit defines who needs access to what, for what reason, and for how long. Internal IT maintains integrations, applies approved decisions, and keeps services running. This division makes authorization a matter of management accountability, backed by reliable technical controls.

Specialized back-office support adds capacity to structure role profiles, automate workflows tied to role changes, record evidence, and identify privilege drift. Managed cybersecurity capabilities also help correlate signs of anomalous use with high-privilege identities. The expected outcome is continuous visibility for internal IT and safer decisions for managers, with evidence ready for audits and requirements such as GDPR and LGPD.

Frequently asked questions

To structure a risk- and outcome-driven access review, request a no-obligation Strategic IT Assessment.