Notes
Practical observations from access control audits on finance platforms — written for security, platform, and compliance leads.
Shared admin accounts still show up in finance platforms
Why shared break-glass and admin logins keep surviving access reviews — and what evidence actually proves they are controlled.
Entitlement reviews fail when owners are missing
Periodic access reviews collapse into checkbox theatre when roles have no owners — how finance platforms fix the map first.
Leavers who still hold keys
Joiner–mover–leaver tickets look complete until you sample live access — patterns we see when exits fail on finance platforms.