Policy-driven workforce access
How I created a source of truth for personas and access policy, then connected it to the employee lifecycle and downstream enforcement.
The opportunity
Access decisions needed a consistent, lifecycle-aware model that could operate across systems and owners. I identified the opportunity to centralize policy and connect workforce changes directly to access updates.
What made it hard
The organization was growing, every system had different owners and integration paths, and the control had to improve least privilege and auditability without slowing down engineers.
What I built
I built an API and source of truth for persona definitions and access policies. Standardized workforce context and system-owner policy flowed into the API; downstream authorization and provisioning services consumed that policy to calculate and enforce access.
How I rolled it out
I treated persona and entitlement policy as code. GitOps and mandatory Security code-owner review made changes visible and accountable, while lifecycle events connected role changes to access updates.
What changed
The model governed access for the whole workforce, across a large multi-account AWS estate and the core engineering systems. Downstream services used the same policy through role changes, reducing stale-access risk and manual cleanup.
What I took away
Access intent, authorization, provisioning, and evidence are separate problems. Keeping those boundaries explicit made the model easier to review, extend, and operate.