A manager came back from three weeks' leave in February and found that a colleague had been reading her mailbox. Nobody had told her before, during or after. The access had been granted in about four minutes by a first line analyst using a self service tool my team built in 2022, which exists because that request used to take two days of emails and everybody hated it.
Our policy is clear enough. Delegated access to somebody's mailbox requires their agreement, or in their absence the agreement of their manager and a note to human resources. It was written in 2019 and it lives in a document. The tool knew nothing about it.
I went through eighteen months of the tool's log. Nineteen hundred actions, of which three hundred and ten were mailbox delegations. It could also reset the password on privileged accounts, change membership of any group including the one that controls who may approve payments, and assign a licence that costs the company money every month. Nobody had abused any of it. The analysts did what they were asked, quickly, because speed is what we measure them on and the option was there in front of them.
The design fault was mine. When I built it I chose the actions by what was technically straightforward and by which requests filled the queue. Nobody, me least of all, sat down and asked which of those actions carry a decision that somebody senior is supposed to make. The tool's permission model quietly became the company's approval policy, and it was written by an engineer reading interface documentation on a Tuesday.
Every action in it is now classified by the decision it embodies rather than by how hard it is to perform. Three moved behind an approval the requester cannot give themselves, and the tool records the name of the person who gave it. Six were removed entirely and went back to being a request with a human on the end. Twice a year we read the catalogue of actions against the policies they touch, with human resources and our legal adviser present for the ones that concern people rather than machines.
Automating a request always decides who is allowed to say yes to it. We spent a fortnight on the speed and no time at all on that.
– Serguey Shinder
