Jamal Jones
All profiles

Scorecard profile

Gatekeeper

Identity mostly says no. The business pays for it in waiting, and in access nobody takes away.

Take the scorecardAll four profiles

Where it sits

Identity mostly says no, and slowly. The controls may be sound, but the business pays for them in waiting time, workarounds and access nobody removes.

On most of the scorecard's questions, a typical Gatekeeper picks the bottom answer or the one just above it. New starters wait into their second week for the access their job needs, requests arrive by email and are handled by hand, and nobody is sure that people who left have lost everything.

Gatekeeper describes how identity behaves in the business, which isn't the same as how good the people running it are. In most Gatekeeper organizations I'd expect to find a small team doing careful work with almost no tooling, asked to protect everything and funded as a compliance cost.

My view is that this is the band with the best return on effort. The fixes are well understood, and each one removes waiting and risk at the same time.

A long queue of people waiting at a row of closed turnstiles while one guard checks papers

How to recognize it

  • New hires spend their first week or more waiting for the access their role needs.
  • Access is requested by email or a ticket and granted by hand, often over several days, and nobody measures how long it takes.
  • When someone changes roles, the access from their old job usually stays with them.
  • Leavers keep some access for days or longer, and nobody could say for certain that all of it's gone.
  • There are no regular access reviews.
  • Nobody knows how many service accounts, API keys and certificates exist. Most have no owner, and their credentials are rarely rotated.
  • Partners sign in with accounts you created and passwords you sent them, and their access ends when somebody notices they've gone.
  • Customers sign in with a password, and account recovery is an emailed link that nobody has reviewed.
  • Identity hears about a new product or partnership after launch, usually because something broke.
  • The program is funded as a compliance cost, and nobody outside the team sees identity metrics.

Strengths

What Gatekeepers get right

  • Saying no is a defensible instinct. In my view a Gatekeeper team has usually been handed responsibility for access without the tools or the headcount to grant it quickly, and slowing down is the only control it has. Where approvals exist, a person is actually looking at them.
  • Starting late has an advantage too. A Gatekeeper has few automated processes to unwind and no governance platform to migrate off, so choices that are expensive for everyone else, like passkeys for customers or federation for partners, are still open.
  • And the problems are visible. Waiting new hires and slow requests are complaints the business already makes, which gives the program a case it doesn't have to invent.

Costs

What it costs

  • The business pays for this band in time and in exposure, and it rarely connects either one to identity.
  • Time is the easier cost to see. A new hire who waits a week for access is a week of salary with little work to show for it, and every request handled by hand takes someone's afternoon on both sides of the ticket.
  • Workarounds follow. People share accounts and hold on to old access so they never have to ask again, and every workaround is access the program can't see.
  • Exposure is the larger cost. Access that outlives a role or a job is the easiest kind to misuse, and at this band it builds up by default: movers keep what they had, leavers keep something, and machine credentials nobody owns never expire.
  • And because identity is funded as compliance, every improvement has to be justified as risk reduction to people who mostly see it as overhead.

The usual shape of the result

Tends to lead

None in particular

Varies

Customer sign-inPartner accessIdentity and the business

Tends to lag

Governance that runs itselfMachine identityTime-to-yes

Gatekeeper results tend to be low across the board, so the useful question is which gaps to close first. Governance and machine identity usually trail furthest, because both depend on inventories that don't exist yet. Time-to-yes follows close behind, since access granted by hand is slow by definition.

The rest swing more. Customer sign-in and partner access depend on whether a product team or a partnership owner is pushing for something better, and a single leader who cares about identity can lift the business link on their own.

Getting to Operator

These are the moves I'd make first.

  1. 01

    Automate leaver removal

    Start where the risk is highest and the case is easiest to make. Connect your major systems to the HR record, so that when someone leaves, their access goes the same day without anyone filing a ticket. Nobody in leadership will argue against removing access from people who no longer work there.

    Then do the same for role changes, so the access from an old job ends when the move is recorded.

    Read Two Jobs, One Acronym
  2. 02

    Time the wait

    Pick a handful of recent access requests and time each one from the ask to working access. Put those times in front of the managers whose people waited. They're the business case for everything that follows.

    Then give requests a defined workflow in one place, so they stop living in inboxes.

    Read The Hidden Cost of "No"
  3. 03

    Find out what you have

    Build the first inventories: every external person with access, and every service account, key and certificate you can find. Put a name next to each one. A list with gaps is still far better than no list, because every other control assumes you can say who and what's inside.

    Read The Silent Workforce
  4. 04

    Get identity in before launch

    Ask to be involved while new systems and partnerships are being implemented. Connecting a system to single sign-on and the leaver process while it's being built is much easier than retrofitting it after something goes wrong.

Talking to leadership about it

Start with the waiting, because leadership already feels it. Time a few new starters and access requests, and show how long people sat without the access to do their jobs.

Then show the leftover access. A list of people who have left but still have accounts is hard for anyone to argue with.

Frame the ask as the tools that let the business stop waiting. The team has been doing careful work by hand, and a request that sounds like blame is harder to fund than one that sounds like speed.