Adding an IAM dimension covering identity/access controls that aren't represented anywhere else in the model right now.
Includes the usual governance side (central IdP/SSO, account inventory, JML provisioning, access recertification, JIT privileged access) but also developer-owned stuff that's usually missing from these models: server-side authorization enforcement, automated authz tests, correct OAuth2/OIDC flow usage, and least-privilege scoping for service accounts and CI pipeline permissions.
Also trying to cover non-human identities properly (workload identity, service accounts) since those are growing faster than human accounts in most orgs and most maturity models still treat access as a human-only problem.
PR #82
Adding an IAM dimension covering identity/access controls that aren't represented anywhere else in the model right now.
Includes the usual governance side (central IdP/SSO, account inventory, JML provisioning, access recertification, JIT privileged access) but also developer-owned stuff that's usually missing from these models: server-side authorization enforcement, automated authz tests, correct OAuth2/OIDC flow usage, and least-privilege scoping for service accounts and CI pipeline permissions.
Also trying to cover non-human identities properly (workload identity, service accounts) since those are growing faster than human accounts in most orgs and most maturity models still treat access as a human-only problem.
PR #82