Least Privilege Enforcement Audit

Detailed internal audit of role based access and permissions across critical applications, with threat modeling and remediation planning.

Documented RBAC state

Discovered key access control gaps

Threat Models commmunicated to stakeholders

Remediation plans for each app

Overview

I was tasked with making sure that the principle of least privilige (PoLP) is being enforced consistently and sufficiently throughout the many business-critical SaaS applications that the fully remote workforce uses. I broke down the task into three phases, following the CISO’s guidance:

Discovery and documentation- we had no clear picture of the state
Assessment and threat modeling
Remediation planning

Key Activities

Performed access and role structure reviews for business critical applications
Created individual threat models for each application, based on the most privileged role’s blast radius
Made individual remediation / improvement plans for each application
Documented everything- findings, process and methodology
After several manual runs, I automated a large part of the process:
- MCP connector for Okta to pull entitlements, group memberships and app SSO protocols
- Wiz Graph queries to create identity maps for AWS, GCP and Azure
- Confluence and M365 connectors to pull internal documentation for reference
- Headless browser for claude to fetch SaaS app public IAM docs
- Threat model generation based on the provided public and internal docs and context
- Script creates a single yaml file for each app -> Jira and Confluence documentation pushed in parallel
Combined the automation scripts into a claude skill so it can easily be reproduced on a periodic basis.