Jamal Jones
All profiles

Scorecard profile

Operator

The basics run, and they run on people. That works until the volume grows or someone leaves.

Take the scorecardAll four profiles

Where it sits

The basics run, largely by hand. Identity is dependable but reactive, and its cost shows up as tickets and delays rather than as a line anyone reports.

On most of the scorecard's questions, a typical Operator picks the answer one step up from the bottom. Access requests follow a defined workflow and take a day or two, new starters are working by the end of their first week, and leavers lose access within a few days.

That's a dependable program. Requests don't get lost, the process is written down, and the team knows every system it touches.

I'd argue its biggest cost is the one nobody reports: the team is the automation. Every joiner, mover and leaver passes through someone's hands, so the program's speed is capped by headcount and its accuracy depends on how busy that week was. The cost shows up as tickets and delays, spread across the business in amounts too small for anyone to add up.

A back office at dusk, people carrying stacks of folders between desks under a wall of pinned tickets

How to recognize it

  • New hires have the access they need by the end of their first week.
  • Access requests go through a ticket with a defined workflow and are usually done in a day or two. You could estimate the time if someone asked, but nobody tracks it.
  • When someone changes roles, the access from their old job is removed at the next access review.
  • Access reviews run on spreadsheets, and most lines are approved in bulk.
  • Leavers lose access within a few days.
  • You know roughly how many service accounts and certificates you have, for some types. Some have owners, and credentials get rotated when someone remembers or something breaks.
  • Fully revoking a production service account's access would take days.
  • Partners use accounts you created, protected by your MFA. Listing all of them would take weeks, and their access ends at the next periodic review.
  • Customers sign in with a password plus a code sent by text or email, and sign-in problems show up only as failure counts in security logs.
  • The IAM team sees its own metrics, identity joins projects during implementation, and the program is paid for out of security project budgets.

Strengths

What Operators get right

  • The process exists and people follow it. Most of the work of automation is deciding what the process should be, and Operators have already worked that out by running it by hand.
  • The ticket trail is an asset. Every request, approval and removal is recorded, which gives auditors their evidence and gives the program the data to decide what to automate first.
  • And the team knows the estate. People who grant access by hand learn which systems are fragile and which roles really need what, and automation projects need exactly that knowledge.

Costs

What it costs

  • The costs at this band are spread thin enough that nobody adds them up.
  • New starters lose most of their first week. Requesters and approvers lose time to every ticket. None of it appears as a line anyone reports, so none of it gets funded.
  • Access builds up between reviews. Movers keep their old access until the next cycle, and spreadsheet reviews approved in bulk seldom take it away, so people tend to hold more access the longer they stay.
  • Machine credentials get rotated when they break, which means the ones that never break never get rotated.
  • And project funding ends when the project does. Identity work that doesn't belong to a project, like cleaning up old accounts, waits for a project that never comes.

The usual shape of the result

Tends to lead

Time-to-yesGovernance that runs itself

Varies

Customer sign-inPartner access

Tends to lag

Machine identityIdentity and the business

Operators do best where there's a process to follow. Requests and lifecycle changes have a workflow, so they're slow but reliable. Machine identity and the link to the business have no workflow at all, which is why they trail.

Partner access and customer sign-in vary more from one Operator to the next. A business with a handful of partners and no customer accounts can look strong on both without trying, while one that sells online feels every gap.

Getting to Enabler

These are the moves I'd make first.

  1. 01

    Connect HR to identity

    Make the HR record the trigger. When HR records a hire, a move or a departure, access should follow without a ticket: the role's access on day one, the old job's access removed on a move, and everything removed on the way out.

    I'd make this change before any other, because it takes the team's hands out of the highest-volume work and frees them for everything below.

    Read Two Jobs, One Acronym
  2. 02

    Put requests on self-service

    Replace the ticket with a request people make themselves, routed automatically to the right approver. Then start measuring the time from request to access, and report it.

    Read The Hidden Cost of "No"
  3. 03

    Give machine identities owners

    Before automating anything for machines, find the service accounts, keys and certificates that matter and put a person's name on each. Automate certificate rotation first. It's the easiest to do, and an expired certificate is one of the most visible ways for identity to take something down.

    Read The Silent Workforce
  4. 04

    Move reviews out of spreadsheets

    A spreadsheet review asks people to approve a list they can't judge. A governance tool can show what each entitlement grants and whether it's being used, which gives reviewers a reason to remove something.

  5. 05

    Fund identity as a platform

    Ask for a standing budget and a roadmap in place of project money. The work that gets an Operator to Enabler, like connecting HR and building self-service, spans many projects and belongs to none of them.

    Read Revenue Runs on Identity

Talking to leadership about it

Lead with time, in the business's own terms: how long new starters wait, and how long an ordinary request takes. Leadership rarely sees these figures, because the delay is spread across every department.

Then describe the team as the automation. Every joiner and leaver passes through a person, so growth adds tickets instead of speed, and the program depends on the few people who know how it all fits together.

The ask is a platform with a roadmap, framed as removing waiting the business already pays for. Security is the second argument, and at this band it's a strong one, because faster leaver removal and fewer leftover permissions come with the same work.