Re: Implementing segregation of duties in an account management process

Andy,
I have implemented separation of duties through access control before - some 
time ago. I'll give you the 'cleaned-up' version of events (as I'm sure you're 
aware, nothing runs smoothly in such projects.)

First of all, we took a stance that it was the owners of data who have 
responsibility to define who should access their data. That meant providing, in 
the first instance, data owners with meaningful reports on who can access their 
data. In the second instance, we required data owners to respon to the reports 
by indicating which access was and was not appropriate. 

That response led us to changing quite a number of permissions - as you'll 
guess, that resulted in a lot of noise. In changing the permissions, we began 
to define a tighter role-based approach to granting permissions in the future.

That done (and it did take a significant amount of time) we then committed to 
regular review, by data owners, of access. However, due to the impact of the 
first exercise, we also were approached by managers to provide the 'other' 
reports - in other words, the hybrid approach you spoke of where we were 
providing two views of access (one by data for the owners and one by role for 
the managers). As I said though, this second view was requested as a result of 
the work we'd done with the first.

Hope this helps. Contact me directly if I can supply any more info.

John