Identity & Access Management · Lesson 3 of 8
Designing roles and permissions
A role groups access around a job need. Good role design reduces unnecessary access without making ordinary work impossible.
Start with the work, then grant access
Fictional support-agent role.
| Permission | Decision | Reason |
|---|---|---|
| View support tickets | Allow | Required for assigned support work |
| Update assigned cases | Allow | Within the approved role |
| Export all customer records | Deny | Not justified by the stated job |
| Approve payments | Deny | Outside this role |
Read the visualWhy not copy every permission from an experienced colleague?
Their account may include old roles or exceptions that the new employee does not need.
Start with tasks
Identify the actions and resources required for a role. Copying another employee can copy outdated exceptions.
Check sensitive combinations
Some combinations of permissions need separation or extra oversight, such as creating and approving payments.
Review exceptions
Record additional access with an owner, justification, and time limit when appropriate.
Put it in context
A support agent needs to view tickets and update assigned cases. Exporting every customer record is not automatically part of that role.
Grant access for a justified task, not because someone else has it.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.