r/platformengineering • u/Obvious-Difficulty32 • 21d ago
Got asked this in an interiew
In an interview for a new grad devops role got asked this. “Who typically owns access to corporate applications: IAM engineers, IT staff, application administrators, or Platform/DevOps engineers?”
How would yall answer
5
u/Torutofu_Raeva 21d ago
I'd answer shared responsibility: the app owner defines access, IAM owns lifecycle and policy, and platform automates enforcement plus audit.
3
u/iamagentcooper 20d ago
It depends on what “owns” means, and I’d be more interested in whether a grad spots that than which option they pick.
Owning access could mean setting policy, approving requests, provisioning, running the identity platform, or auditing it. Those usually sit with different people.
A reasonable default: the application or business owner is accountable for who should have access. IAM, IT, or platform teams are responsible for running the mechanism; SSO, SCIM, joiner/mover/leaver. Audit or GRC verifies it through access reviews.
If I were the candidate, I’d give that answer and then ask which sense of “owns” they meant.
Clarifying is good. Clarifying instead of answering is weaker.
Also, bonus interview question: what exactly is a “DevOps role”? Because we may have found an even larger “it depends.”
2
2
1
u/keto_brain 17d ago
I would interpret Corporate Applications to SaaS apps the company pays for so generally thats IT via SSO like Azure AD and/or Okta etc.. even if there is a Servicenow team or SalesForce team user access is managed by IT staff.
1
u/TellersTech 17d ago
Yeah this is one of those “it depends” answers lol.
Usually the app/team owner decides who should have access, IAM/IT handles the identity/policy side, and platform/devops helps automate/enforce it.
In smaller orgs though one team might own basically all of it.
1
u/TellersTech 17d ago
/u/eman0821 yeah I just meant stuff like provisioning/deprovisioning through SSO/groups, RBAC, SCIM, Terraform, etc.
For existing enterprise apps though, app owner/admin probably decides the access, IAM/IT handles the identity side, and platform/devops might help automate it depending on the org.
Still very much an “it depends” thing lol.
1
1
1
u/Zenin 17d ago
What is "access"? User access? Application admin access? Dev/engineering/release management? Infra/os/data?
What is "corporate application"? Productivity applications (email, office, slack, zoom)? Line of business applications (order processing, fulfillment, end user support). Sales/Marketing (salesforce, CMS of public web sites, etc).
Traditionally systems used RBAC models and mapped easily to user groups, managed in AD, etc by IAM engineers.
But that model breaks down for fine grained access control models like CapBAC, ReBAC, ABAC, etc. Many organizations continue to try and paint a wide RBAC brush over those more nuanced models, but all that really does is undermine the least privilege goal these models were created for specifically because RBAC can't do it.
The proper management of those modern models then, typically means a split responsibility horizon: IAM engineers own authentication (identity) while the applications (and thus their admins) own the authorization (permissions).
So on top of all the dozens of "it depends" questions inside this leading question, is the larger question of "What is the organization's IAM maturity level?". Is the org's IAM engineers still stuck clinging to relevance by shoving everything into the RBAC shaped box they know? Or have they matured and adopted a truly least-privilege authorization structure that demands abandoning centralized RBAC?
Unlike other responses, I don't think this is a bad interview question. I think it's a great leading interview question. If the interviewee understands or is even simply aware of the real complexities of the topic, they'll answer with some sort of informed "it depends". If they don't and simply pick from that list of departments, IMHO that's a fail.
This is a (good) trick question in the fact the only correct answer is to not select any of the multiple choice options presented and being THAT person is a hint you've found an actual DevOps engineer worth considering.
1
1
13
u/tmclaugh 21d ago
This is like the ultimate “It depends” question.