Access had grown up informally,
one request at a time
UKG security access had evolved through email threads, Teams messages, and institutional knowledge. There was no standard request and approval workflow, no consistent ownership model, and no single place to see who asked for what, who approved it, and why.
Over time, broad and accumulated roles made it hard to tell baseline job access apart from specialized capabilities and approval authority. Each decision was defensible on its own, but taken together the decisions couldn't be explained, reproduced, or reviewed.
Separate what someone needs
from what someone can approve
The foundation was a hybrid role model. Larger persona-based roles cover predictable baseline access, and smaller add-on roles grant specialized capabilities or decision authority. This keeps least privilege practical: no one needs a custom role, and no one gets approval power just because it came bundled with their job access.
The design principle: balance least privilege with manageable administration. Too many tiny roles make governance hard to run, and too few broad roles leave it with nothing to govern.
One governed path from
request to audit record
I built a practical control layer around security assignment using tools the organization already owned: Microsoft Forms for intake, Power Automate for routing, SharePoint as the governance repository, and UKG as the system of record. Every request now follows the same six steps.
- Business authorization. Role owners decide whether the business need is valid.
- Independent control review. HRIS reviews every request before technical implementation.
- No self-approval. The requester never approves their own access.
- Separation of duties. Transaction entry and approval are separated where control risk warrants it.
- Evidence retention. Justification, decisions, and implementation status are kept centrally.
From individual admin decisions
to a repeatable capability
- Email and Teams requests
- No standard approval path
- No single audit record
- Ownership depended on individual knowledge
- Access reviews hard to interpret
- One governed request path
- Role owner and HRIS review
- Centralized evidence trail
- Defined ownership and decision rights
- Governance-ready role catalog
A framework, a process,
and the tooling to run it
Governance first,
automation second
Standardized roles and documented decisions are what make safe automation possible. With the foundation in place, the roadmap shifts toward scaling the controls:
Security is a prerequisite,
not a cleanup project
This started as an access cleanup and became the foundation for everything that follows. Every later enhancement, including lifecycle automation, self-service, and new modules, depends on knowing who should have access to what and who is accountable for that decision.
The most useful shift was moving the question from "can HRIS give this person access?" to "who owns this decision, and where is the evidence?" Once ownership is explicit, HRIS stops being the bottleneck for every judgment call and becomes the control point it should be.