A new employee needs access that works. The organization also needs to know why that access is appropriate, who approved it, and when to review it.
That distinction makes IAM and identity governance easier to understand. Technical access and accountable access decisions are connected, but one doesn't prove the other.
Follow a fictional employee's first week to see how the questions appear before account creation, during onboarding, and when new access is requested.
Define the access need before creating the account
Imagine a fictional employee joining a reporting team.
The onboarding process needs several inputs:
| Input | Decision it supports |
|---|---|
| Work the employee will perform | Which resources and actions are necessary |
| Application roles available | How the business need maps to permissions |
| Identity information | Which person and account the request concerns |
| Authorized approval | Who may confirm the access is appropriate |
A manager, application owner, and onboarding team may contribute different information. The exact responsibilities depend on the organization.
Creating the account quickly doesn't answer the approval or role-design questions. The technical process needs an authorized, understandable target.
This is where governance becomes visible: it helps make the reason, owner, and applicable rules explicit before implementation is mistaken for a completed access decision.
On the first day, the access has to function
The employee needs to authenticate and reach the approved resources.
Identity operations may create or update the account, assign the relevant groups or application roles, and help verify the user experience. The exact implementation depends on the environment.
A successful login is part of the outcome. The employee also needs the correct permission to perform the intended task.
This is where IAM's technical mechanisms make the approved decision usable.
A request for extra access introduces a new decision
Suppose the employee asks for export rights after discovering that a standard role only permits viewing reports.
The technician may know how to grant the permission. That does not establish whether it is appropriate.
The request needs a business reason and the correct approval according to the organization's process. Any conflicting responsibilities or special conditions should be considered by the relevant owner.
Governance provides the decision structure; technical administration implements and verifies the authorized result.
Temporary needs require an end condition
Perhaps the employee receives additional access for a short handover project.
The workflow should identify when the need ends and who is responsible for checking or removing the assignment. Otherwise, a temporary decision can become an indefinite permission.
In a lab, you can model the approval and expiry as documented steps and implement the removal manually. Label those choices clearly.
You don't need a large governance product to understand the requirement, but a document alone does not prove that the technical removal occurred.
A review checks whether the current state still makes sense
Later, the organization may ask an appropriate reviewer to confirm that the access remains justified.
The reviewer needs context: the role, resource, owner, and reason for the assignment. A decision to remove access then needs follow-through and verification.
This is why governance is more than a reporting dashboard. It connects decisions to changes in the access state.
Use the purpose and follow-through of access reviews to explore that part of the lifecycle.
Build a first-week project that shows both sides
Your fictional lab can include the initial request, approval, account or assignment change, first-day test, and one additional-access request.
Keep the technical and decision records connected. Show which steps are implemented, which are simulated, and where the environment stops.
A reader should be able to trace why the employee received access and how you knew it worked. They should also see why the technician's ability to grant a permission wasn't enough to authorize it.
The Six-Figure IAM Career Playbook compares IAM lanes and includes identity lifecycle work among its three lab directions. The $9 guide helps you decide whether the operational, engineering, or governance side fits your next career move.
IAM makes access possible and manageable. Governance helps make the decisions behind that access accountable and reviewable. One employee's first week gives you a practical way to explain the relationship.