Part II · Chapter 2 · The Boundary · lesson 5
The people are inside the line, and they did not agree to it
10 min
Builds on Count what is inside the line before you draw it
Part II · Chapter 2 · The Boundary · lesson 5
10 min
Builds on Count what is inside the line before you draw it
Twenty-four people can reach production. Twenty-eight contractors are on the access lists. Not one of them was in the meeting where the boundary was drawn.
By the end of the period, most of them will have been asked for something: a training record, an acknowledgement of a policy, a screenshot of their device settings, a second approval on somebody else's change at four in the afternoon. A few of them will be the subject of a control rather than the performer of one, which is a stranger experience — somebody they have never met will review their access and decide whether they still need it.
Predict
Who is inside the line decides whose week this becomes.
Two different relationships, and the register rarely distinguishes them.
Performers. People who do a control on a cadence. A performer's cost is hours, recurring, forever, and the hours land on whoever was nearest when the register was written.
Subjects. People a control is about. Their cost is not hours; it is being reviewed, checked and occasionally removed by somebody who does not know what they do all day.
A boundary that includes a team includes both relationships for everybody in it. Nobody asks them, because the boundary is drawn in a document and the consequences arrive as calendar invites months later.
The people count in a boundary is a number. Three specific humans inside it behave nothing like the average, and all three are worth finding before the period starts.
The one person who performs six controls. In almost every first register there is one engineer or one operations lead who ended up owning the access review, the restore test, the log review, the vulnerability triage, the supplier re-review and the onboarding checklist, because at the time each one was assigned she was the obvious choice. Her second job is now larger than some people's first. Nobody decided this; it is the residue of six separate sensible decisions.
The person who is both performer and subject. The administrator who reviews privileged access and holds privileged access. The control is described honestly, runs on a cadence, produces an artefact, and cannot detect the one failure that matters, because the person who would notice is the person who would have caused it.
The contractor with production access and no onboarding record. Four of the twenty-eight. They were set up quickly because the work was urgent, through a path that bypassed the joiner process, and they are inside the access boundary and outside the people boundary at the same time. That is not a gap in a control; it is two inventories disagreeing, which is the shape most real findings have.
Something people say
“Contractors are not employees, so they sit outside the people boundary and the controls about people do not reach them.”
Four contractors have production access and no onboarding record. Which description of that situation is the one you would write down?
Three things, none of which require a framework.
List the people inside the line from the access systems rather than from the headcount. The two lists differ, and the difference is the interesting part.
Against each control a human performs, write a name — a person, not a team. Then count the names. If one name appears more than three times, you have found the person whose week this became, and you found it before the period rather than in month seven.
Then tell them. That sentence is doing more work than it looks like: the most common reason a control stops happening in year two is that its owner never agreed to own it, and the cheapest moment to discover that is now.
Check