This matrix is the artefact that replaces 'give them the same as Priya'. It makes onboarding a lookup instead of a judgement call, and gives access reviews a baseline to compare actual access against.
Build from the job, not from the incumbent. Define what the role needs to function. Deriving templates from what current holders have carries forward every accumulated extra permission, which is the problem templates exist to solve.
Split day one from week one. Day one is the systems the role cannot work without. Everything else can follow. Trying to provision everything before the start date is what makes the essentials late.
Attach licence cost to each role. Once each role carries a cost, a headcount plan becomes a software budget automatically, and the cost of a role with expensive tooling becomes visible during hiring.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
N = none, R = read, W = read and write, A = administer. Add a column per role you hire into.
| System | Timing | Finance Analyst | Sales Rep | Engineer | Service Desk | HR Partner | Monthly licence cost |
|---|---|---|---|---|---|---|---|
| Identity provider / SSO | Day one | W | W | W | W | W | Included |
| Email and calendar | Day one | W | W | W | W | W | £6 |
More free templates IT teams use alongside this one.
The measure of IT onboarding is whether someone can do actual work on day one without filing a ticket. That requires starting before they arrive and provisioning from a role template rather than by copying the permissions of whoever sits nearest.
Role templates are the single most effective control against permission creep, because they replace 'give them what Priya has' with a defined standard. The matrix is also what makes access reviews possible. You need a baseline to compare against.
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
A grid defining exactly which systems and access levels each job role receives, when, and what needs additional approval. It makes onboarding a lookup rather than a judgement call and gives access reviews a baseline.
Attaching licence cost to each role means a headcount plan converts directly into a software budget. It also makes the true cost of a role visible during hiring, including the tooling that comes with it.
Annually, and whenever a system is introduced or a role changes materially. Decide separately whether template changes apply retroactively to existing holders. Adding something to a template does not grant it automatically.
