Time: 75 minutes Outcome: Students will evaluate an identity lifecycle design for least privilege, recovery, exceptions, evidence, and governance.
Materials
- Fictional role and account list
- Identity lifecycle worksheet
- Access-review decision table
- Whiteboard or collaborative document
Learning Objectives
- Explain how joiner, mover, and leaver events change access risk.
- Identify least-privilege and separation-of-duties concerns.
- Evaluate account-recovery controls and exception handling.
- Define evidence that would support an access decision.
Opening (10 minutes)
- Present the fictional organization and ask: “What can go wrong when access lasts longer than the job or role?”
Lifecycle Review (20 minutes)
- Teams trace four identity events from request through approval, provisioning, review, and removal.
- Mark where evidence is created and who is accountable.
Recovery and Exception Design (15 minutes)
- Evaluate a lost-device or account-recovery scenario.
- Discuss how convenience, identity proofing, accessibility, and fraud risk compete.
Access Review (20 minutes)
- Teams identify two excessive-access conditions and recommend a response.
- Require a documented rationale for any retained exception.
Debrief (10 minutes)
- Where did human judgment matter most?
- Which control could create operational harm if applied too rigidly?
- What would you automate and what would you keep reviewable?
Evidence and Assessment
- Students submit an identity lifecycle map and a short design-review memo. Assess traceability, least-privilege reasoning, exception handling, and quality of evidence.
Optional Companion
- Pair with “Identity and Account Recovery Design” from Labs & Activities for a longer practical session.