Jamal Jones
All profiles

Scorecard profile

Enabler

Identity has started to speed the business up. What's left is the work nobody owns yet.

Take the scorecardAll four profiles

Where it sits

Identity is starting to speed the business up. The gaps that remain tend to be in the places nobody owns yet: machines, partners and the metrics leaders see.

On most of the scorecard's questions, a typical Enabler picks the second-best answer: new starters do real work on day one after a round of tickets, access requests route themselves for approval and finish within hours, and leavers lose the major systems the same day.

That's a program that works. The business has mostly stopped routing around identity, and identity has mostly stopped being the reason a project waits.

I'd argue it's also the riskiest place to settle, because Enabler is the band where the program looks finished. The flows people complained about have been fixed, so the complaints stop. The work that remains never generated complaints in the first place: machine credentials, partner accounts, and the metrics leadership never sees. Nobody files a ticket asking for their service account to be rotated.

A modern lobby's glass doors sliding open as a person walks straight through

How to recognize it

  • New hires can do real work on day one, though a few tickets still chase the access their role didn't predict.
  • Access requests go through self-service with approvals routed automatically, and most are done within hours.
  • Leavers lose access to the major systems the same day. The smaller apps that aren't connected take longer.
  • Access reviews run in a governance tool, and reviewers still approve more than they question.
  • You could list most of your service accounts, keys and certificates, and most of them have an owner. Certificates rotate automatically; most other credentials are rotated by hand.
  • Some partners sign in through their own identity provider. The rest use accounts you created for them.
  • Security leadership sees identity metrics. The rest of the leadership team rarely does.
  • Identity is brought in while a new product or partnership is being designed, after the decision to do it has been made.
  • The program has its own roadmap and is funded as a platform.

Strengths

What Enablers get right

  • Most of the hard work in identity is organizational. Automating joiners and leavers takes HR data clean enough to trigger on, roles defined well enough to grant from, and application owners willing to connect their systems. Enablers have done that work. In my view it's the part most programs never finish.
  • They have also earned trust. When the request process works, people use it instead of asking a colleague with admin rights, and every request that comes through the front door is one you can see and later remove.
  • And they're funded like a platform. A roadmap of its own lets identity plan work that no single project would pay for, which is exactly what the next band needs.

Costs

What it costs

  • The costs at this band don't show up in a queue, which is why they last.
  • Machine identity is the largest. Service accounts, API keys and AI agents get created faster than most inventories get updated, and the older ones often belong to people who have since moved on. Anything rotated by hand tends to be rotated late.
  • Partner access runs two models side by side. Federated partners leave cleanly, because their own directory removes them. Everyone else keeps an account you created, and their access to you ends when the partner remembers to tell you they've gone.
  • Access reviews produce evidence more than they reduce risk. A reviewer facing a long list of line items approves most of them, so the review proves a control ran without saying much about whether the access was right.
  • And the metrics stop at the security team. Identity's funding gets argued again every budget cycle, in security terms, to people who measure the business in other ones.

The usual shape of the result

Tends to lead

Time-to-yesGovernance that runs itself

Varies

Customer sign-in

Tends to lag

Machine identityPartner accessIdentity and the business

Workforce access improves first because it has an owner and a complaint. HR and IT both feel a slow start date, and a new hire waiting for access is visible to their manager on day one. Machines, partners and the numbers leadership sees have neither, so those gaps stay open with nobody waiting on them.

Customer sign-in varies the most, because it depends on who owns it. A product team that watches conversion has every reason to push for passkeys and a better recovery flow. A security team working on its own has fewer.

Getting to Accelerator

These are the moves I'd make first.

  1. 01

    Put an owner on every machine identity

    Start with the inventory, and make ownership a condition of creation: no owner, no service account. Then run the revocation drill. Pick one production service account and one AI agent, and time how long it takes to fully remove their access. That time is your baseline, and it says more about machine identity risk than a count does.

    Once owners exist, make credentials short-lived and rotated automatically by default. Owners are what make that possible, because someone can approve the change and fix whatever it breaks.

    Read The Silent Workforce
  2. 02

    Make federation the default for partners

    Every account you create for another company's employee is a copy of their directory that you now keep in sync by hand. Trust the partner's identity provider, scope the access to what the engagement needs, and give it an end date. Their leavers then lose access to you when they lose access to everything else.

    This also starts with an inventory. You can't move partners to federation until you can list them.

    Read The Collaboration Multiplier
  3. 03

    Let low-risk access certify itself

    Certify routine, low-risk access automatically and send reviewers only the access that carries real risk. A short list of decisions made properly removes more bad access than a long one approved in bulk.

    Read Two Jobs, One Acronym
  4. 04

    Report identity where the business is measured

    Pick one metric leadership already tracks and show identity's effect on it, such as how many days a new hire waits before being productive, or sign-in success next to conversion. Put it in the operational review, beside the numbers it moves.

    Read Revenue Runs on Identity
  5. 05

    Get into the business case

    Enablers are invited during design. By then the acquisition has been priced and the partnership agreed, and identity's job is to make someone else's decision work. Ask to be in the business case, where identity costs are cheapest to change and a fast, safe integration can count as part of the value.

Talking to leadership about it

Don't lead with the band. A maturity label invites the question of why you aren't further along, and the honest answer, that the remaining work has no owner, sounds like an excuse.

Lead with what the business already gets: people working on day one, and access requests done in hours. Leadership has already bought that speed, whether or not anyone called it identity.

Then name what that speed is exposed to. Something like: "We've made access fast for people. The next risks are in machine credentials and partner accounts, and neither shows up in the numbers we report today." That frames the budget as protecting speed the business already relies on.