What to review
- Global and admin permissions
- Permission schemes and project roles
- Anonymous access and public links
- Issue security schemes
Move to role-based access
- Grant access to groups and roles, not individuals
- Tie groups to your identity provider
- Document the model
Keep it clean
- Schedule periodic access reviews
- Automate offboarding
- Track admin changes