Deploys the web app. Nothing else.
- Owner confirmed
- Unused rights removed
- Next review booked
Prioritise administrative roles, deployment credentials, payment access and identities that cross environments. Review shared credentials early: they make both attribution and revocation harder. Name an owner, define the task and grant only the access required. Record use, rotate credentials where needed and review exceptions. Revoke access, remove trust relationships and check for dependent workloads. Test narrower permissions against the legitimate workflow before deployment. Identify shared dependencies and define rollback. Removing a credential without understanding its users can interrupt a service. This is an inventory and review method, not a benchmark dataset. Choose review intervals and acceptance criteria around your systems, risk and operating constraints.In this note
Build a reviewable record.
Record Why it matters Owner and purpose Someone can explain why the identity exists. Workload and environment Access can be separated between development, testing and production. Effective permissions Inherited roles and delegated access are included. Credential lifetime Rotation, expiry and revocation can be tested. Last use and next review Stale identities and unresolved exceptions have a decision date. Start with the identities that can change things.
Use a repeatable lifecycle.
Make the change safe.
What to measure.
Scope and limits.
Illustrative identity record.
A fictional record. It is not client evidence or a measured result.
- Identity / purpose
- build-reader / fetch approved build inputs
- Owner / boundary
- Platform team / staging artifact store
- Finding
- The inherited role also permits deleting artifacts.
- Proposed change
- Use a separate read-only workload role; confirm dependent jobs before changing access.
- Acceptance
- Required reads succeed, deletion is denied, and revocation ends access.
Where this method comes from.
This is a Riftweld review worksheet, not a study of other companies' data. Base your decisions on your own identity settings, resource permissions and approved tests of real workflows.