Your outsourced 24x7 desk has a 15-minute response SLA - which caller requests get an identity gate?

## The decision you are actually making The temptation is to answer this as a verification-design question. It is not; that part is settled. The question is **scope and who pays**, and it is a question with a budget, a contract and a politics attached. ## Gate the action, not the person Gating on the caller asks somebody working alone under a response clock to rank strangers by trustworthiness. They cannot, and the reason is structural: the identities used in a pretext are chosen precisely because the receiver has no basis to place them. "Verify anyone who seems suspicious" therefore never triggers, and where it does trigger it produces uneven treatment that a competent operator learns and routes around - they simply call a different person on a different shift. Gating on the action gives a rule that can be applied without judging anybody. The dividing line worth defending is **consequence that is not reversible inside the response window**: - changing where something is sent - payment details, a mail route, a data destination; - granting, restoring or widening access, including anything that re-establishes an authentication factor; - anything touching a credential, a key or a certificate; - destructive or irreversible operations on the fleet. Everything else runs at full speed. This is the point that gets lost: the scope should be small enough that the desk hits it rarely, because a gate applied to a quarter of the work will be worked around by the people it slows down. ## The three organisational conditions **1. The clock has to move.** If the SLA measures elapsed time and verification takes twenty minutes, the supplier is contractually punished for verifying. Nobody has to decide to stop; it just becomes the path of least resistance. Verification time must be excluded from the measured window, which is a contract amendment, not a process note. **2. The identity path is agreed in advance.** A check that uses a fact the caller did not supply, over a route you already held, cannot be invented at 03:00. It has to exist beforehand: named escalation contacts on both sides exchanged out of band, a mutual expectation that gated requests will be delayed, and an explicit statement that the supplier's staff will not treat a delay as an insult. This belongs in the contract or the runbook agreed at onboarding, when there is time to argue about it. **3. Somebody senior absorbs the delayed executive.** The most common death of this control is one exception granted to a person who found it insulting, after which the desk learns the rule does not apply upwards - and upwards is exactly where the borrowed identities point. The desk needs standing permission to delay anybody, and a named person who takes the complaint. Without that, the rule is decoration. ## Accept the residual explicitly Everything outside the gated classes is being actioned on a caller-asserted identity, and that is a decision, not an oversight. Write it down: these action classes may proceed on a caller's word, we accept the consequence, and here is the reasoning. An unstated residual gets rediscovered after the fact as negligence; a stated one is a position that can be revisited when the estate or the threat changes. ## Cheaper than gating: remove the ask Before designing a gate, ask whether the request needs to reach a human by telephone at all. Where the requester can perform the action themselves through a path that authenticates them directly, the phoned-in request stops existing and there is nothing to impersonate into. That removes a whole class rather than slowing it down, and it is usually cheaper than the friction of a gate applied forever. What remains after that pruning is the genuine set: things only a person on that desk can do, at hours when nobody else is awake. ## Measuring whether it is alive The honest measure is not how many impersonation attempts were stopped - you will rarely know. It is whether the gate is still being applied: how often gated actions were delayed for verification, how many exceptions were granted and to whom, and whether the supplier's own staff report the path as workable. A gate with zero recorded delays over a quarter has almost certainly been abandoned rather than perfected. ## What a strong answer sounds like Name the gating principle (consequence, not suspicion) and the small set of action classes. Then spend most of the answer on the parts that are not technical: the SLA carve-out, the pre-agreed path in the contract, the standing permission to delay a VP, the written residual acceptance, and the pruning step that removes phoned-in requests altogether. Finishing on "and here is how it dies in six months" is what separates this from a design answer.