Expertise

Access Governance

Who may do what, why, and who decided that? Those three questions determine the outcome of every audit. SempreAI brings entitlements across systems into a traceable structure: from data-driven analysis of the existing estate through durable role models and a maintained SoD matrix to recertification campaigns that genuinely reduce risk.

Consulting team reviewing entitlement documentation and approvals at a meeting table — Structured authorisation management is the basis of every secure IT environment and the fastest route to fewer audit findings.

Overview

Why access governance?

In grown landscapes entitlements accumulate rather than clear themselves. Role changes leave rights behind, project access outlives projects, and composite roles obscure what is actually assigned. The result is access risk nobody can survey any more, and recertification in which managers approve wholesale because a considered individual decision is simply not possible in the time given.

Access governance starts where tools alone do not help: at data quality, accountability and decision processes. Transparency about the actual estate comes first, complexity then drops through clean role models, and finally we anchor maintenance processes that keep working after the project ends.

What we deliver

Services in this area

Entitlement analysis & transparency

It begins with a complete picture: which entitlements exist, who uses them, which have been dormant for months, and which breach policy? We consolidate data from all relevant target systems and make it analysable.

Cross-system collection of the entitlement estate
Usage analysis and detection of dormant rights
Identification of orphan and shared accounts
Assessment of data quality per target system
Risk heat map by criticality and concentration
Prioritised list of immediate actions

Role modelling & role mining

Our roles do not emerge at a whiteboard but from real assignment data that is then sharpened with the business. The outcome is business roles the business understands and system roles that stay technically manageable.

Data-driven role mining with cluster analysis
Two-tier model of business and system roles
Derivation from organisational and job structures
Handling of exceptions and special rights
Role ownership and approval process
Metrics for coverage and role quality

SoD analysis & segregation of duties

Segregation of duties is not a form but a maintained conflict catalogue with clear rules for exceptions. SoD conflicts are modelled in business terms, checked across systems and moved into a procedure for documented, time-limited exceptions with compensating controls.

Building a business-level SoD conflict catalogue
Cross-system conflict checking
Preventive checks already in the request process
Exception procedure with expiry and justification
Compensating controls and their evidence
Regular reporting of open conflicts

Recertification campaigns

Good recertification relieves decision-makers and raises the value of the outcome. Campaigns follow the risk, the uncritical is pre-filtered, and a rejection leads to an actual, traceably logged removal of rights.

Risk-based campaign scoping instead of blanket reviews
Pre-filtering and bundling for managers
Clear decision context for each entitlement
Automated removal after rejection
Escalation paths where reviews stall
Analysis of cycle time, approval rate and findings

Governance operating model

So that structure does not decay again, we anchor accountability and maintenance organisationally: with clear roles, defined cadences and metrics that reveal early when quality slips.

RACI for request, approval, maintenance and control
Policies and work instructions in usable form
Onboarding process for new target systems
Regular quality review of the role model
Training for role owners and approvers
KPI set for steering and reporting

Frequently asked questions

Access Governance – Frequently asked questions

How do RBAC, ABAC and PBAC differ?

RBAC grants rights through defined roles. That is structurally clear, easy to audit and well suited to stable organisations. ABAC decides dynamically on attributes such as department, location, time or risk class and is more flexible for context-dependent access. PBAC lifts control to the level of centrally managed, declarative policies. In practice we combine them: RBAC as the load-bearing foundation, extended by attribute- or policy-based decisions for fine-grained exceptions.

How long does role modelling take?

For a bounded scope with reasonable data quality, six to ten weeks to an agreed target model is realistic. The constraint is rarely the analysis but the business alignment: how many organisational units need to be involved, how clear are job structures, and how quickly are decisions made? We therefore work iteratively and deliver usable interim results after the first weeks.

What happens to exceptions that cannot be resolved?

Exceptions are normal, uncontrolled exceptions are not. For that we establish a procedure in which every exception carries a business justification, a named owner, an expiry date and a compensating control. All open exceptions feed into regular reporting so that they are deliberately extended or removed rather than quietly persisting.

Do we necessarily need a dedicated tool for access governance?

Not necessarily. Analysis, role design and first campaigns can achieve a great deal with existing means, provided the data basis is sound. A specialised tool pays off once campaigns run regularly across many systems, SoD checks need to work preventively and evidence has to be produced automatically. Your actual volumes decide that.

Let us talk about your initiative

Whether it is a target architecture, a recertification backlog, a legacy replacement or an operations handover: describe your starting position. We will come back within one working day with a concrete assessment.

Arrange a conversation