Policy-driven workforce access
How I created a source of truth for personas and access policy, then connected it to the employee lifecycle and downstream enforcement.
What I found
The company had no formal access-intent model. Decisions were fragmented across systems and owners, and role changes could leave stale access behind.
What made it hard
The organization was growing, every system had different owners and integration paths, and the control had to improve least privilege and auditability without slowing down engineers.
What I built
I built an API and source of truth for persona definitions and access policies. Standardized workforce context and system-owner policy flowed into the API; downstream authorization and provisioning services consumed that policy to calculate and enforce access.
How I rolled it out
I treated persona and entitlement policy as code. GitOps and mandatory Security code-owner review made changes visible and accountable, while lifecycle events connected role changes to access updates.
What changed
The model governed access for the whole workforce, across a large multi-account AWS estate and the core engineering systems. Downstream services used the same policy through role changes, reducing stale-access risk and manual cleanup.
What I took away
Access intent, authorization, provisioning, and evidence are separate problems. Keeping those boundaries explicit made the model easier to review, extend, and operate.