HR Provisioning: Employee Lifecycle (Part 3)

RBAC is like Communism: It sounds really great until you try to implement it,
David Griffeth, Vice President of Enterprise Identity Management, Citizens Bank at Catalyst Conference 2009.

In my previous post in this series, I covered the ROI for improvements in provisioning processes and I began to walk through the employment lifecycle to show how provisioning relates to specific employment lifecyle events. In this post, I finish my discussion of the employment lifecycle and talk a bit more about the limitation of role-based access controls.

RBAC and Communism

I didn't attend last week's Catalyst Conference 2009. However, when I saw David Griffeth's quote about role-based access control (RBAC) tweeted from the conference on Friday afternoon, I thought it captured quite nicely one of the points I'm trying to make in this series of posts. Managing access and entitlements by role gets complex quickly. It is not to say that roles aren't useful in managing provisioning, but starting with a table of events relevant to provisioning and de-provisioning is likely a better way to begin your planning. Increasingly, HR service delivery is distributed among multiple SaaS providers. Roles and sub-roles are likely to be tied to particular SaaS offerings. So lifecycle events - such as those covered in this post and the previous post - are a better starting point than roles. Build your table of lifecycle events, look at target systems, then perhaps look at whether and how roles fit into the provisioning and de-provisioning operations.

Termination Events

Employee termination is a choreography that decomposes into a number of component processes:

• De-Provisioning. While cycles of provisioning and de-provisioning occur for a variety of reasons within an employment lifecycle, it obviously is critical to remove access and privileges for individuals once their employment has terminated. In the case of involuntary terminations, it may be important to schedule de-provisioning in advance of when the notice is given and/or when the termination is effective for payroll, benefits, or other purposes. Some notion of "suspension pending termination" is necessary in many situations. Conversely, an employee's notice of voluntary termination (e.g., two weeks notice) may or may not invoke any immediate de-provisioning of systems. The point here is that both provisioning and de-provisioning are not always tied exactly to official hire and termination dates (see discussion of "pre-provisioning" in previous post). Fine-grain handling of lifecycle events is required.
• Termination Scheduling and Notification. This step refers to the actual setting of the official termination date whether the termination is voluntary or involuntary. As already pointed out above, the de-provisioning associated with termination and the actual termination event typically are separate events.
• Asset Management. Collecting and accounting for employer property also is part of the employee termination process. The previous post covered "badging" as part of the onboarding process. "De-badging" - the physical collection of badges or other devices used to gain access to systems and facilities -- would likely take place during the collection of physical assets.
• Manage Retain/Records. Termination also marks the beginning of certain record management and retention processes. Applicable law may impose certain records retention obligations. Conversely, legal considerations and fair information management practices may drive records destruction. The point here is that de-provisioning a terminating employee very seldom translates to wiping clean the data associated with the employee from systems, but it does trigger the beginning of record management processes.

This rounds out a simplified look at the employment lifecycle.

What's Next

In my next and last post in the series, I'll offer just a few ideas on architecture to support HR system provisioning.