Zero trust shipped, standing grants are reviewed quarterly and every owner approves everything - what do you tell the executive it buys?

## The conversation you are actually having The executive was sold a programme that ended lateral movement. It did not; it changed its shape. Under the old model an adversary's reach came from where a compromised host could route; under this one it comes from what a compromised identity is entitled to. So the residual after the rollout is the breadth of standing grants, and the organisation's only control on that breadth is a quarterly access recertification in which owners approve everything put in front of them. This is a principal-level question because the technical answer is easy and useless - 'grants should be narrower' - while the actual constraint is human capacity, an auditor, and a sponsor's belief. ## Step one: measure the review, not the estate The most useful thing you can bring is data about the control itself rather than about access: - approval rate (if it is 99%-plus, reviewers are not deciding) - median seconds per item (if it is under ten, they cannot be reading) - revocations produced per cycle, and how many of those were re-granted within a month - items per reviewer per cycle (a manager handed 400 lines has been given an impossible task, not a lax one) Those four numbers turn a vague complaint into a finding. They also protect the reviewers, which matters politically: the failure is a design failure, not laziness. Nobody can make a meaningful judgement about 400 grants with no evidence about whether each is used. ## Step two: say what attestation actually buys Be precise and unsentimental. A quarterly attestation buys: - **an artefact** that an auditor or a customer's contract can be shown - **an owner of record** for each grant, which is genuinely useful when something later goes wrong - occasionally, **a departure catch** - a name a manager notices should be gone It does not buy narrower grants, because approving is cheaper than investigating and the incentives all point at approving. Saying this is uncomfortable and it is the job: the person who has to state what the control does not stop is the same person who writes the residual-risk page. ## Step three: propose where the capacity should go The budget is human review hours and it is fixed. Spend it where it changes an outcome: **Rank by what a grant would give an adversary, not by who holds it.** Production write access, bulk customer or payroll data, cross-tenant or cross-directory reach, and anything that can grant further access. That top slice is usually a few percent of grants, which is what makes it staffable. **Attach evidence.** Reviewers need last-used data - this identity has not exercised this grant in 180 days - so the default answer can become removal rather than approval. Producing that evidence is engineering work someone must fund, and it is the highest-leverage spend in the whole proposal. **Expire the tail.** Everything outside the ranked slice should be time-boxed: it lapses unless renewed. Expiry does what review never will, because it does not require a human to say no - only to say nothing. **Stop the pool growing.** New grants default to time-bound or request-and-expire, so the standing set stops accumulating while you work the backlog. ## Step four: name the costs and who signs for them This is what makes it a principal answer rather than a plan. - **Breakage.** Auto-expiry will take out an overnight job and lock somebody out mid-shift. You buy that down with warning windows, a fast self-service renewal path, and by starting on the low-value tail. You do not promise it will not happen; you say some breakage is the point, since a grant nobody renews is a grant nobody needed. - **Engineering funding.** Last-used evidence and an expiry mechanism are real work with a real owner. - **The auditor.** If a contract or a regulator requires an attestation of all access, you keep it. Run it as cheaply as the commitment allows and stop describing it as a risk reduction, and fund the ranked review beside it. If you believe expiry plus evidence-backed review is stronger, propose the swap explicitly with your data - but you never quietly drop a committed control, and if the regulator refuses, that refusal is the answer and you carry both. - **The residual that remains.** Even after all of it, an adversary holding a real credential still gets what that identity legitimately needs. Write that on the one-page residual-risk note now, while it is a design statement, rather than after an incident when it reads as an excuse. ## What a strong answer avoids Do not propose more frequent reviews with the same reviewers and no evidence - that multiplies the cost of a control you just showed does nothing. Do not claim zero trust already solved over-broad access. And do not present a 100% approval rate as a clean estate; it is the finding, not the result.