Access Control Drift: The Access You Forgot You Granted
Nobody decides to lose track of who can access what. It happens the slow way. Someone gets permission for a project and it’s never removed. An employee changes roles, or leaves, and their access stays behind. A shared drive that started tidy becomes something everyone can reach. Add up years of small, reasonable decisions and you get a firm where no one can say who can see what. That’s access control drift, and it’s how a small problem becomes a big one.
How Drift Happens
It isn’t carelessness. It’s the normal life of a growing business:
- Access granted for a task and never taken back once the task is done.
- People change roles, but their old permissions come along for the ride.
- Employees leave, and their accounts or access linger for weeks or months.
- Folders and systems open up over time, because it is always easier to grant access than to review it.
None of it looks dangerous on any single day. That is exactly why it accumulates.
Why It Matters More Than It Looks
Access drift does not announce itself. It matters for three reasons:
- Blast radius. When an account is compromised, whatever it can reach is what an attacker can reach. The more access has drifted, the more one bad login can touch.
- Former-employee risk. A person who left but still has access is a risk you are carrying for no reason. Most firms do not find out until something goes wrong.
- Compliance and audits. You cannot prove control you do not have. When a client, an insurer, or a regulator asks who can access sensitive data, “we are not sure” is not an answer that holds up.
The Hard Part Is Seeing It
You cannot fix access you cannot see, and most firms have never had a clear picture of it. Access lives across email, files, cloud apps, and systems, and no one has looked at the whole thing at once. Getting that picture, who can reach what, right now, is the first step, and usually where we start.
What to Do About It
- See it. Map who can actually reach what, across your files and systems.
- Tighten it. Cut access to what each person needs, and no more, so one compromised account cannot reach everything.
- Keep it current. Remove access the moment someone changes roles or leaves, not months later.
- Prove it. Keep the records, so who can see what is documented, not assumed.
Done once, it closes real risk. Done as a habit, it keeps drift from creeping back in.
Access control is one of the simplest, highest-value things a firm can get right, and one of the most commonly neglected. It is part of doing security correctly, and part of being able to prove it. See Document Control & Confidentiality and Cybersecurity.
Common questions
The slow accumulation of access that no one is tracking: permissions granted and never removed, former employees who still have access, systems that open up over time. Over years, it leaves a firm unable to say who can reach what.
It expands what a single compromised account can reach, leaves former employees with access they should not have, and makes it impossible to prove control to a client, insurer, or regulator.
.
See who can access what, tighten it to what each person needs, remove access promptly when people change roles or leave, and keep records. The hardest part is getting the first clear picture.
It should be ongoing, not a one-time cleanup. Access drifts back the moment reviews stop, so the goal is a habit tied to role changes and departures, plus a periodic full review.
See who can reach your data.
The Cybersecurity Assessment includes a look at access and where yours has drifted. A few minutes, and no obligation.
Where This Goes
- Want provable control over documents? See Document Control & Confidentiality.
- Want the full security picture? See Cybersecurity.
- Need to prove it to a regulator or insurer? See Compliance.
- More straight answers? Back to Insights.