by Serguey Shinder
Our support tool had a screen that showed you everything about one customer. Their order history, their address, the partial card number, the internal notes we had written about them, and every message they had ever sent us, including ones meant for a department they would not have expected us all to share with. Opening it took one click and required no reason at all.
Seventy four people could do that. Support, sales, two contractor agencies who handled our overnight queue, and every engineer, because the permission that opened the debugging screens happened to be the same one that opened this. Nobody designed that. It arrived through four years of reasonable decisions, each of them a person who genuinely needed to see something once.
We found out we had a problem in February, when a customer asked why somebody here had referred, in a phone call about a delivery, to something she had only ever written in a message to our billing team. It was a fair question and nothing recorded who had opened what.
So we started recording it, intending only to have an answer ready the next time somebody asked. In the first month, seventy four people opened customer accounts forty one thousand times. About twenty six thousand of those were attached to a conversation that customer had open with us at that moment. Fifteen thousand were not attached to anything. Most of that remainder was defensible, people picking up a handover or preparing for a call. Some of it was not. One account was opened thirty times in a month by somebody who had never spoken to that customer and never would.
What we changed was not an access review. Opening an account now needs a reason. If there is an open conversation with that customer it attaches itself and nobody types anything, which covers roughly seven in ten. Otherwise you write a sentence. Access closes after two hours. The engineering role was split so debugging shows identifiers and states and no message bodies, and the agencies got a role scoped to their own queue. Views fell to about nineteen thousand a month and not one person's handling time got worse.
The thing I had never properly seen is that we govern writes and we do not govern reads. A change has a review, a deployment, a record and somebody who notices when it is wrong. A read alters nothing, breaks nothing and produces no incident, so nothing in the ordinary life of a company ever pushes back on it. The permission that quietly grows out of all proportion is always the one whose misuse is silent. When I look at a privilege now I ask what would happen if somebody used it a hundred times today for no reason, and if the honest answer is that nobody would ever know, that is the one to go and scope.
– Serguey Asael Shinder
Leave a Reply