Identity Governance and Administration
Identity governance and administration (IGA) addresses whether access remains appropriate. The video contrasts identity-provider sign-in with governance of access policies, requests, approvals, reviews, and compliance evidence. SailPoint and Saviynt are examples in the explanation, not product recommendations. Source: IAM Ecosystem Explained (19:15-20:53).
Approve Business Need
Access requests should explain the business need and receive approval from the manager and application owner. Temporary needs can use just-in-time access: a grant that expires automatically rather than becoming permanent access by default. Source: IAM Ecosystem Explained (16:36-17:58).
Segregation of duties separates conflicting powers. The video’s fraud example combines creating a restaurant with approving its payments. Prevent that combination or require an additional approval, rather than treating each permission as harmless in isolation. Source: IAM Ecosystem Explained (18:22-19:15).
Review Continued Need
Managers and application owners review whether people still need their access, with review frequency informed by risk. Reconcile accounts against human resources records to investigate orphan accounts. Do not label every account without an employee match as orphaned: contractors and nonhuman identities need appropriate ownership checks rather than automatic classification as abandoned accounts. Source: IAM Ecosystem Explained (19:15-20:53; 24:17-25:20).
The hypothetical Sarah role change shows why successful provisioning is not sufficient governance. Adding payments access while retaining support permissions creates privilege creep. Reviews and role-change decisions must examine existing grants, not just approve new ones. Source: IAM Ecosystem Explained (14:59-15:40; 19:15-20:53).