When we reviewed access at a payments company, 14 percent of active accounts belonged to people who had left. None of this was malicious. Each account was on a checklist that someone was going to get to.
The typical checklist lists the identity provider, email, the chat tool, source control, the cloud consoles, the ticketing system, the shared drives and whatever else grew over the years. Each line has a different owner. HR closes the record; IT disables the directory account; and the other nine lines wait for a Friday that never arrives. The shared drive line is the one that holds transaction records.
The structural fix is to make every grant depend on something that reliably ends. In Privr, every access grant references the identity record that justified it. When HR closes that record, the Evidence Engine walks the dependency graph and revokes every grant on it: SaaS seats, cloud roles, repository access, the drive shares nobody remembered. The whole process takes a few minutes and produces a receipt listing what was removed.
Two details make this work in practice. First, grants that do not reference an identity, such as shared service accounts, are flagged on creation and given an owner, so that they appear in someone's offboarding. Second, contractors and vendors are modelled the same way as staff, with the contract end date as the event; access through the Control Gateway ends when the contract does, without anyone remembering.
The receipt matters more than it sounds. Auditors for PCI DSS do not ask whether you have an offboarding process; they pick a leaver and ask what happened on the day. A receipt with timestamps, systems and the policy version that triggered each revocation answers the question in one document.
The side effect was unexpected: because every grant had to name an identity, the number of grants dropped by a third in the first quarter. Access that nobody could justify did not survive the question.
We publish the dependency model as part of the platform documentation; it is the part of Privr customers in financial services tell us about most.