Building an Access-Governance Programme on Okta OIG

Context

As the infrastructure architecture remit at Interactive Investor matured, a gap opened up between the identity platform (Okta) and how access was actually governed for a regulated business unit: entitlements were assigned individually rather than through a role model, there was no repeatable way to certify who held what and why, and revoking access on a disconnected application meant a manual Service Desk ticket with no verification loop. That combination is a recurring audit finding waiting to happen — and it's exactly the kind of problem an infrastructure architect is well placed to fix, because it sits at the intersection of identity platform, ITSM process and the underlying application estate.

Technologies: Okta Identity Governance (OIG) · Okta Workflows · Okta Privileged Access · ServiceNow (ITSM integration) · SCIM 2.0

Approach

I took architectural ownership of the programme, working from a simple operating model: HR/ADP is the source of identity, ServiceNow carries access intent, and Okta Identity Governance (OIG) does the enforcement — provisioning connected applications directly, and raising a Service Desk fulfilment ticket for disconnected ones.

• Role-based entitlement model — defined roles first, applications second, so certification reviews ask "does this person need this role" rather than forcing reviewers to reason about raw application permissions.
• Three-tier certification design — separating role content (does the role still contain the right entitlements), role membership (is the person's job role correct), and individual exceptions (access assigned outside the role model). Only the third category needed hard enforcement, which kept the certification workload proportionate to actual risk instead of drowning reviewers in noise.
• An interim role model ahead of a platform capability landing later in the year, so the governance programme didn't have to wait on the vendor roadmap to start delivering certifiable, auditable access reviews.
• Automated revoke-to-ServiceNow workflow — when a certification reviewer revokes an individually-assigned entitlement, an event-driven flow raises and tracks the Service Desk ticket automatically, with the next scheduled entitlement import acting as the verification that the revoke actually happened.
• Okta Workflows automation connecting HR, ServiceNow and Okta for joiner/mover/leaver processing, reducing manual provisioning steps and the lag between an HR change and the access change that should follow it.

Related work in the same architecture remit

Two further pieces of work grew out of the same identity architecture ownership:

• Privileged Access capability assessment — evaluated Okta's privileged access module against the organisation's incumbent PAM tooling, identifying the real capability gaps (rather than the ones commonly assumed) and using vendor roadmap timing to build a phased, evidence-based replacement recommendation instead of a date-driven one.
• Identity-assurance architecture paper — authored a paper and RFC for the Architecture Review Board identifying a gap in how Service Desk-assisted credential recovery (password reset, MFA re-enrolment) verifies a caller's identity, mapped against recognised assurance-level frameworks, with options for closing the gap presented for board decision.
• Okta ↔ IBM i SCIM connector review — carried out a first-principles review of a custom-built Spring Boot SCIM 2.0 connector bridging Okta to an IBM i platform, covering both its LDAP-based user profile lifecycle and its role-assignment logic into the underlying DB2 application. Produced an architecture summary and an improvement roadmap covering configuration hardening and operational risk areas identified during the review.

Outcome

The programme turned an ungoverned, individually-assigned access model into a certifiable, role-based one with a working enforcement loop back into ServiceNow — while producing two further architecture deliverables (the PAM assessment and the credential-recovery paper) that extended the same identity-governance thinking into adjacent risk areas.