Sign-in and invitations
Review how accounts are created, invited and activated. Repair confusing or failing flows and define what happens when an invitation expires or reaches the wrong address.
Services
Connect account controls to everyday work.
The right starting point depends on your applications, users and access responsibilities.
Single sign-on and authentication
Plan or repair supported identity-provider connections, including OIDC or SAML where appropriate. Review multi-factor authentication, passkey and recovery options against the actual platform and user needs.
Roles and permission checks
Map tasks to permitted actions and data. Review enforcement in the application and connected services, including actions a user must be unable to perform.
Staff and vendor access changes
Document who approves access, how role changes are applied and what must be removed when an engagement ends. Track exceptions and separate account ownership from day-to-day use.
Recovery and access review
Review lost-factor and account-recovery paths, administrative responsibilities and useful audit history. Define controlled tests and handoff instructions for the agreed scope.
AI tools and connected accounts
Where staff use an AI assistant with connected business systems, review which accounts and actions it can use. Keep access decisions tied to the real task and the permissions of the underlying system.
Discuss a focused access review. Any change to credentials, authentication policy or production permissions needs explicit project authorization.