5.6. Identity and Access Management

💡 First Principle: Identity and Access Management (IAM) is the discipline of ensuring the right people have the right access to the right resources at the right time. Recall the AAA framework from Phase 2: IAM operationalizes it. Without IAM, you can't enforce least privilege, can't audit who accessed what, and can't revoke access when someone leaves the organization. IAM is the gatekeeper for everything.

What happens when IAM is poorly implemented? Former employees retain access. Contractors accumulate permissions over months without review. Shared accounts make forensics impossible. Password policies are inconsistent across systems. One compromised credential gives access to everything because single sign-on was deployed without MFA. Every IAM failure is a potential breach vector.

Consider a hospital again: doctors need access to patient records, nurses need access to medication orders, administrators need access to billing systems, and the cleaning staff needs access to supply closets. If any of these groups can access systems they shouldn't, patient privacy, financial integrity, or even patient safety is at risk. IAM enforces these boundaries systematically.