Access accumulated permanently. The annual recertification asked managers to review 400 grants in a week, so they approved all of them, and the institution's audit findings repeated year after year.
STUDY 18 / 30 · ANONYMISED · NDA · ENTERPRISE INTERNAL · NETHERLANDS · 9,000 EMPLOYEES
ENTERPRISE INTERNAL · NETHERLANDS Access requests that expire by default.
RoleLead designer + systems
Timeline13 weeks
Team2 designers, 1 PM, 2 frontend, 1 security architect
VerticalIdentity governance · financial institution
Made every grant expire by default with a duration chosen at request time, turning recertification from an annual bulk event into a continuous, small, contextual decision.
Standing privilege fell dramatically. The recurring audit finding closed for the first time in six years.
-68%STANDING PRIVILEGED GRANTSvs baseline
4%RECERTIFICATION BULK-APPROVEfrom 94%
closedREPEAT AUDIT FINDINGafter 6 years
THE ARGUMENT
Why the obvious solution was wrong.
The study matters because the product problem was reframed before the interface was polished.
Recertification fails for an arithmetic reason. A manager asked to review four hundred access grants in a week will spend under three seconds per grant, and the only rational strategy at that rate is bulk approval. Every institution knows this and continues to run the campaign, because the control is defined as the campaign rather than as the outcome. The interface was faithfully implementing a process that could not work.
We moved the decision to request time, where it is one decision with full context, and made expiry the default. The requester chooses a duration from options tuned to real use - this sprint, this quarter, this project, permanent-with-justification - and permanent requires a written reason that a named person approves. Expiring grants prompt the holder before lapse, so the person with the actual context decides whether they still need it. Recertification did not get better. It largely stopped being necessary, which is the only way that control has ever been made to work.
THE INTERFACE CRAFT
The interaction, rendered as a working product surface.
The specimen below is code-native and uses the study's own design logic. The client interface remains protected.
ENTERPRISE INTERNAL
SHIFT / SATURDAY
08:00Coverage 92%
16:002 open
00:00Covered
DESIGN DECISIONS
Positions we would defend.
Each decision names the principle and the product consequence, not a stylistic preference.
Move the decision to where the context is
A decision made at request time with full context beats four hundred decisions made in a week with none.
Expiry as the default
Permanent access should be an argued exception, not the shape of the system.
Ask the holder, not only the manager
The person using the access knows whether they still need it. Recertification has always asked the wrong person.
PRODUCT LEADER READOUT
What transfers, and what should remain specific to this product.
A case study is useful when its operating principle travels without turning the original interface into a template.
Read the operating condition
For Identity governance · financial institution, the transferable lesson is not a copied screen. It is the condition the interface had to make legible: Every request carries an expiry chosen from real-work durations. Permanent is available, costs a written justification, and is rare. Rebuild that visibility for your own roles, risk, terminology, and operating cadence.
Protect the design rule
A decision made at request time with full context beats four hundred decisions made in a week with none. Keep that rule in the acceptance criteria, component states, and production QA record so later visual cleanup cannot erase why the interaction exists.
Measure behaviour after ship
The evidence record is -68% for standing privileged grants, vs baseline. Recreate the baseline and outcome window before rollout, segment the result by role and context, and state clearly what the measure cannot prove.
RESEARCH RECORD
The work behind the interface.
These artefacts connect the final interaction back to the evidence and product model that produced it.
Recertification behaviour analysis
Instrumented the prior campaign; median review time per grant was 2.4 seconds and 94% were bulk-approved.
Duration taxonomy
Derived four real-work durations from actual access usage patterns rather than from calendar convention.
Audit finding trace
Worked with internal audit to map exactly which interface behaviour produced the repeating finding.
Renewal prompt test
Tested prompt timing and copy for renewal decisions; 38% of prompted holders released access voluntarily.
“Six years of the same finding. It closed because access started expiring on its own.”
CISO, European financial institution · under NDA
NEXT STUDY · 19 / 30 · NBFC & LENDING