We Chose the Actions by What Was Easy to Build
A manager came back from three weeks' leave in February and found that a colleague had been reading her mailbox. Nobody had told her before, during or after. The access had been granted in about four minutes by a first line analyst using a self service tool my team built in 2022, which exists because that request used to take two days of emails and everybody hated it. Our policy is clear enough.…
In February, a manager returned from a three-week leave to find that a colleague had accessed her mailbox. The colleague had gained access to the mailbox in just four minutes using a self-service tool my team developed in 2022. This tool was created to streamline a process that used to take two days via email. According to our company policy, delegated access to a mailbox requires the agreement of the employee or their manager, along with a note to human resources.
However, the self-service tool did not account for this policy, as it had been built without considering the type of actions it could perform. Over the course of eighteen months, the tool logged 1,900 actions, 310 of which were mailbox delegations. The tool could also reset the password on privileged accounts, change membership of various groups, and assign licenses costing the company money monthly.
Despite this, no misuse of the tool was reported. The issue lay in the tool's design, which prioritized the technical ease of building the tool over the decisions that needed senior approval. While building the tool, I focused on actions that were technically straightforward and filled the queue quickly, as speed was how we measured performance.
The tool's permission model gradually became the company's approval policy, a decision made by an engineer reading interface documentation on a Tuesday. To address this, we now classify every action in the tool by the decision it embodies, rather than the ease of performance. Of the 310 mailbox delegation actions, three were moved behind an approval process, and six were removed entirely, returning to being regular requests that require human intervention.
Twice a year, we review the catalogue of actions against the policies they touch, with human resources and legal advisors present for actions that involve people rather than machines. Automating a request always determines who is allowed to say yes to it. While we prioritized speed, we neglected to examine the decisions behind the actions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
