Reading-path month: January 2026. Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.
Access control: who decides and who executes?
Clear responsibilities prevent ownerless permissions.
Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.
Reading context
A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.
Original source ↗The architecture decision
Access reviews often start with a user list. A more useful question is who can change the rule permitting an operation. When one person requests, approves and implements sensitive access, periodic review loses strength.
Practical application
In a hypothetical support workflow, separate the data owner from the administrator configuring access. Record the reason, expiry and revocation path. Exceptions must remain visible when their owner changes teams.
How to verify
Editorial proposal: trace one critical permission through its full lifecycle. Evidence should show approval, application and removal. Counting fulfilled requests rewards speed; tracking expired access exposes operational debt.