- Why quarterly access certification produces approval fatigue and stale entitlements
- Modelling segregation-of-duties rules across SAP and Salesforce in one policy set
- Joiner, mover, and leaver events handled as triggered workflows with evidence attached
- Continuous controls monitoring: what Anugal watches between review cycles
- Producing an audit evidence pack without a manual extraction exercise
Built for: Security leads, IT compliance owners, and SAP or Salesforce platform administrators responsible for access controls.
What the session covers
Access governance in most enterprises runs on a review calendar. Entitlements are certified once a quarter, reviewers approve in bulk under time pressure, and the period between reviews is unmonitored. Meanwhile the average time to identify a breach remains measured in months rather than days, according to the IBM Cost of a Data Breach Report, and dormant privilege is a recurring contributor.
This session shows how Anugal treats access as a continuously evaluated control. Rules for segregation of duties are modelled once across SAP and Salesforce, joiner, mover, and leaver events trigger provisioning workflows with the approval record attached, and drift between review cycles raises an exception instead of waiting for the next campaign.
From campaign to continuous control
The operating difference is where the work sits. A campaign concentrates effort into a review window and produces a snapshot. Continuous controls distribute the work across normal operations and produce a record that is always current.
The session covers the three mechanics behind that shift:
- Policy modelling. Conflict rules are expressed against roles and business activities, not against individual technical authorisations.
- Event-driven provisioning. Every access change is initiated by an HR or platform event, so entitlement follows the role rather than the request.
- Evidence on demand. Approvals, exceptions, and remediation actions are stored against the control they satisfy, which removes the pre-audit extraction exercise.
Who should attend
Security leads, IT compliance owners, and platform administrators responsible for access controls in SAP or Salesforce environments. The session is technical and includes the policy structures BCS uses on live governance engagements.