Managing Permissions and Roles on Information Repositories

Managing permissions on information repositories goes beyond granting access when a person joins; it requires an ongoing process that includes periodic reviews of who has access to what, timely revocation when someone changes roles or leaves the organization, and a role-based model that avoids granting ad hoc individual permissions that are hard to track. Using RBAC, role-based access control, makes it possible to define standard profiles according to the job function, so granting or removing access is as simple as assigning or removing a role, instead of managing permissions one by one. The most common problem in practice is privilege accumulation: permissions granted for a one-off project and never revoked, so that over time many users end up with access to repositories they no longer need for their current role, unnecessarily widening the risk surface if an account is compromised.