Most people think Identity & Access Management is about who can log in. After eight years of doing it across banks, insurers, and government, I'd argue it's really about who is accountable when something goes wrong. Login is just the visible tip of that iceberg.
1. RBAC is a contract, not a config
When I was new, I treated role-based access as a tagging exercise: figure out the apps, figure out the roles, map them. It works for ten users. At a few thousand, with a 15-person team onboarding apps across Australia, New Zealand and Malaysia, it falls apart in under a quarter.
The fix isn't more roles. It's writing roles like API contracts: with owners, expiry, review cadence, and explicit business meaning. FIN_ANALYST_AU isn't just a SailPoint object — it's a promise about what someone with that label is allowed to do, who said so, and when that promise expires.
2. Lifecycle automation is where the real money is
The flashy part of IAM is access reviews and certifications. The valuable part is provisioning and deprovisioning. Every hour an employee waits to get system access on their first day is wasted onboarding cost. Every hour a leaver keeps their access is risk.
- Joiner: HR system fires a webhook, role assignment cascades through AD and downstream apps. Day one, ready to work.
- Mover: department change triggers a recompute of effective access; manager approves the diff, not the full set.
- Leaver: the moment HR marks them inactive, sessions are killed and tokens revoked — not "by end of day Friday."
3. The quiet politics
Nobody warns you that IAM is mostly a political job. Every access policy you tighten makes someone's life harder. Every exception you grant becomes precedent. The skill that took me longest to learn was how to say no in a way that left people feeling heard rather than blocked.
A great IAM engineer makes the right thing easy and the wrong thing impossible — without anyone realizing they're being steered.
4. The boring playbook that works
- Inventory first. You can't govern what you can't see. Get a single source of truth for apps, roles, and entitlements before automating anything.
- Automate joiner/leaver before mover. Mover is hard. Get the easy wins first.
- Certify quarterly, not annually. Annual reviews turn into rubber stamps.
- Log everything, alert on the diffs. The interesting signal is always in changes, not snapshots.
If you're starting in IAM today
Pick one platform — SailPoint, One Identity, Saviynt, doesn't matter — and go deep. Understand the connector model, the workflow engine, and how it talks to AD. The rest is variations on a theme. The market will pay you well for engineers who can reason about identity at the systems level, not just configure it.
Eight years in, I'm more convinced than ever that IAM is one of the highest-leverage areas in enterprise engineering — quietly preventing the disasters that everyone else takes for granted.