New job, old access: Put identity governance to work

Building off my previous blog, Sarah starts her new job in operations on Monday. Her manager has arranged training, introduced her to the team, and requested access for her new role. Everything looks ready.

Except for one detail: Sarah can still approve supplier payments in the finance application she used in her previous role. As I discussed earlier, we used Sarah’s transfer to show why better access decisions need reliable follow-through. Now let’s take that scenario into OpenText™ NetIQ™ Identity Governance. How do you spot access that no longer fits, involve the right reviewer, and confirm that the change actually happens?

Identity Governance helps answer those questions by connecting access information to targeted reviews, role-based policies, and fulfillment. Here’s what that process could look like as Sarah moves from finance to operations.

Central point of administration

Before her new manager can decide what Sarah should keep, someone needs to see what she still has. Her directory record may show the move to operations, but it doesn’t necessarily show every permission she holds in the finance application and other connected systems.

Identity Governance collectors bring identity, account, and permission information together in a governance catalog. That gives reviewers a clearer view of Sarah’s access across connected applications instead of forcing them to piece together separate spreadsheets. The value depends on collecting the right data and keeping it current.

The details also need to make sense. Referring back to my previous example, a permission named “FIN_AP_03” tells Sarah’s manager very little. A description such as “Approve supplier payments up to $25,000” makes the business impact clear. Application owners can maintain those descriptions and identify who is responsible for reviewing the access.

Now the question is straightforward: does someone in Sarah’s new operations role still need that payment-approval permission? If not, why wait until the next quarterly review to act?

Maintaining governance through change

A scheduled access review might not happen for weeks or months. Sarah’s transfer gives the business a reason to look sooner, while the change is still fresh.

When updated identity information is collected and published, Identity Governance data policies can identify changes to fields such as department, title, or supervisor. A configured policy can start a micro-certification—a focused review of relevant access—or initiate another defined action.

For Sarah, a department change could send her finance access to the appropriate reviewer. But an HR update alone doesn’t trigger a review. Collection, publication, policy rules, routing, and review workflows all need to be in place. That distinction matters when you want a repeatable process rather than an assumption that the software will handle everything.

Similar policies can draw attention to other conditions: an account without an identified owner, an account unused beyond an agreed period when last-login information is available, or a permission that meets a defined risk condition. The goal isn’t to generate more reviews. It’s to put the right issue in front of the right person.

Broad, periodic certifications still matter. Focused reviews complement them by addressing specific changes between campaigns.

Making identity governance easier to stay on top of

Removing old access is only half of Sarah’s transition. She also needs the right applications and permissions to start her new job without a string of one-off requests.

Business roles can define who qualifies for access associated with a particular job or function. Technical roles group related permissions into manageable sets. With appropriate policies and fulfillment configured, those roles help make routine access decisions more consistent and reduce repetitive work.

Transitions can still call for exceptions. Maybe Sarah needs limited finance access for two weeks to finish a handoff. That should be a deliberate decision, with an owner, a clear reason, and an agreed end date—not old access that quietly becomes permanent.

As your role model matures, reviews can focus on permissions outside approved role authorizations. Instead of repeatedly examining familiar access patterns, reviewers can give more attention to the cases that need judgment.

Confirm that the change really happened

Sarah’s reviewer decides to revoke her supplier-payment approval. Does that mean she has lost the permission? Not yet.

Identity Governance can create a change request and track it through the configured fulfillment process. Depending on the application and integration, the change might be handled by an automated fulfiller, a connected system such as NetIQ Identity Manager, or a person assigned to complete it. The fulfillment path has to be configured for the environment.

Afterward, another collection and publication cycle can confirm whether the permission is actually gone. If Sarah still has it, the team has a specific issue to investigate. An approved removal and a verified removal are two different things.

That difference also matters to auditors. Review history and fulfillment records help explain who made the decision and what action followed. Updated application data helps establish whether the change took effect. A completed review alone isn’t proof that access was removed.

Turn one transfer into a repeatable process

Sarah’s move gives you a practical place to start. Check that the catalog is current, make permissions understandable, agree on the policy triggers and reviewers, test fulfillment, and collect access data again to confirm the result. Then apply what you’ve learned to the next transfer, promotion, or departure. For configuration details, see the current product documentation.

The previous blog focused on getting business value from the decisions people make. Sarah’s transfer shows how product capabilities and clear ownership can help put those decisions into practice. The white paper, “Getting the most out of OpenText NetIQ Identity Governance,” goes deeper into catalog quality, roles, reviews, data policies, fulfillment, and reporting. Read the white paper for practical ways to strengthen each step and turn identity governance capabilities into results you can verify.