05 · Architecture · Cross-system identity
Someone has left. Access stopped. Parking and the account are still live
The solution architect handles identity, privilege, and process joins across systems—for example access, parking, and the account all dying on the day someone leaves. How modules split inside a system goes to the senior architect. Over-privilege export goes to the security architect.
What this role fills in is the person between systems
The senior architect divides who owns data inside modules. The solution architect faces the ring of systems the customer already bought: access control, parking, domain accounts, the business system, finance. Each has its own user table. The job is to define “one person” as an identity across systems, instead of creating them once in each system. If identity has no master data, a leaving, a transfer, or a contractor end-date will miss a door or an account.
The deliverable is an identity lifecycle and a privilege map, not another feature list. On hire, who creates the master identity, which system gets the number first, and how the others reference it. On transfer, which privileges are pulled the same day, and which wait until open documents are finished. On leaving, which die immediately, and which stay read-only until the case is closed. Every line needs a trigger. Automatic sync with no trigger does nothing when HR misses a record. In security terms, that is the same as not doing it.
How this splits from security architecture and integration
The solution architect decides which systems must follow identity as a business rule. The security architect decides export, over-privilege, and audit. The integration engineer implements events and fields. If the solution architect only writes “integrate with access control,” integration will do a full compare once a day, and someone who left can still enter the park that afternoon. Frequency and failure are architecture: a leaving event at minute scale; a full reconcile only as a backstop; a backstop that finds a mismatch must alert, not silently overwrite from one side.
Privilege is not a job title equal to a set of menus. He requires it by duty: warehouse clerk, supervisor, finance—the document actions each may do, written down, then mapped to each system. If one person holds two duties, whether privileges are a union or they must switch identity has to be written. If it is not written, accounts pile up.
A park leaving: three systems, three afternoons
On a park project, HR marked a leaving in the business system. Access died that afternoon. The parking monthly pass waited until property stopped it the next day. The domain account waited for IT to disable it by hand. One person who had left still drove in the next day. The solution architect put the master identity on the HR event, not on any access-control vendor. After the leaving is confirmed, an event is produced: access is revoked at once, the parking system stops the monthly pass at once, the business account cannot log in at once, and unfinished documents transfer to the supervisor. If a vendor API can only take effect by the day, the gap is written in the design, property gets a same-day manual list, and the gap is treated as a risk—not pretended to be real-time.
After go-live he drills with a real leaving, not by tapping menus on a test account. The drill watches three doors and one login. If any door is still open, integration is not done. Contractor access also gets its own end date. The event must fire on the day the contractor leaves the site. It cannot wait for project acceptance to clean in a batch. If cleanup waits for a quarterly count, cards that still open doors stay in the park for months. If the card is still there, the identity rule has not landed. Supplier maintenance accounts must open from a work order and be taken back when the work order closes. A temporary month of access often becomes a year. The solution architect puts those accounts on the same lifecycle table, instead of a second list nobody reads.
People who cover two posts are written separately. An account that is warehouse clerk by day and acting supervisor at night must not keep supervisor privilege forever. The solution architect requires acting duty to use timed authorization that returns to the original duty when it expires. If the time limit lives only in a policy and the system does not take it back, the leaving drill fails the same way: the person is still there, and privilege is already larger than the post.