Three roles needed different levels of context.
The shared model keeps identity, permission, decision, expiry, and evidence consistent while each role sees only the context required for its decision.
Back to Work
Enterprise access governance
AccessScope: Safer access reviews across employees, managers, and security
AccessScope helps employees understand their access, gives managers the context to approve or reject requests, and gives security teams a clear record of what changed and why.
AudienceInternal Enterprise
DomainEnterprise SaaS · Security
RoleSolo product designer
PlatformResponsive web
Year2026
ScopeCase study and prototype
Reading time6 min
View the product
The prototype shows three connected views: employees manage their own access, managers review requests, and security teams track risk and evidence.
30 Second Summary
OWNERSHIP
I defined the product strategy, role model, information architecture, visual system, and prototype logic.
CORE DECISION
Replace binary approval with constrained choices, explicit expiry, and evidence captured during the decision.
EVIDENCE
A complete prototype spanning employee self service, manager decisions, and security governance.
Overview
One access system for employees, managers, and security teams.
AccessScope uses one permission model across employee, manager, and security views. I owned the product strategy, role architecture, information design, visual system, and interactive prototype.
Problem
Access decisions were fragmented and difficult to review.
Requests, approvals, expiry, and evidence lived across tickets, consoles, spreadsheets, and audit work. People lacked the right context at the moment of decision, while security teams had to reconstruct intent later.
Decision
Constrained choices, explicit expiry, and attached rationale make each access review safer without slowing routine requests.
Employees needed plain language, managers needed decision support, and security needed ownership and evidence. A single dashboard hierarchy would have failed all three.
Control without approval fatigue.
I kept routine actions lightweight, then introduced stronger friction only when scope, duration, risk, or missing context justified it.
Evidence had to survive the decision.
Expiry, rationale, ownership, and source context stay attached to each choice so later review does not depend on reconstructing intent.
Clarify · Employee
Clarify access before asking people to govern it.
The employee experience replaces policy language with a personal queue and understandable permission records. It helps people renew needed access, remove stale access, and respond when a request needs more context.
- Attention items are written as tasks with a clear next step.
- Risk stays understandable without hiding urgency.
- Suggested cleanup makes removing stale access part of the normal workflow.
Decide · Manager
The manager experience is the center of the decision system.
Managers need to move quickly, but speed without context encourages rubber stamping. The overview combines immediate approvals, recurring reviews, team access health, unused permissions, and upcoming expirations.
- High risk and overdue items stand out without turning the screen into an alarm state.
- Team access health gives managers a quick view of where access needs attention.
- Review campaigns stay distinct from the approval inbox.
Govern · IT and Security
Security work follows one clear path.
Security teams need signals that lead to action. AccessScope connects findings to remediation and preserves the record for later review.
- Critical attention is separated from routine governance work.
- Contractor expiry and unused access make lifecycle risk visible.
- Evidence export and findings review are primary actions.
Governance stress test
Three moments where speed and safety pull in opposite directions.
These scenarios use the existing prototype states to show how the system handles duration, elevated risk, and recurring review. They are design stress tests, not observed usability results.
01 · Temporary access
A contractor needs a production tool for a fixed project window.
Conflict
The quickest approval can become permanent access when duration is left implicit.
My decision
Require an expiry date and treat renewal as a new accountable decision.
Audit consequence
The record preserves requester, approver, scope, duration, and the later renewal or removal action.
02 · High risk access
A manager receives an elevated request with incomplete justification.
Conflict
A binary Approve action hides the difference between routine access and a high consequence permission.
My decision
Expose risk, missing context, and constrained duration before the manager can commit.
Audit consequence
The audit trail captures the reason, selected scope, approver, and any follow up requirement.
03 · Quarterly review
A review campaign surfaces unused permissions across a team.
Conflict
Review fatigue encourages rubber stamping when every item looks equally urgent.
My decision
Separate critical findings from routine review and make removal the clearest path for stale access.
Audit consequence
Security can trace the finding from signal to owner, decision, and exported evidence.
Tradeoffs
Safer decisions require deliberate friction.
Extra context is justified only when it can change scope, duration, or outcome.
Renewal friction
Renewal adds follow up effort, but prevents temporary needs from becoming permanent access.
Role specific views
Separate views reduce cognitive load but demand a stronger shared system underneath.
Reflection
Approval is part of the control
In security products, the interface is part of the control. AccessScope pushed me to treat ownership, action hierarchy, expiry, and evidence capture as security decisions, not supporting UI details.
Next project
GlucoGuide
GlucoGuide explores clear, safety conscious glucose monitoring experiences.
