Worked Example: Identity & Access Management

Every organisation runs identity and access management, which is exactly why it is the clearest place to see the Security Services Domain Model made concrete. A workforce access programme starts with a blunt business driver — secure workforce access — and has to survive contact with ISO 27001 and NIST 800-63, the everyday threat of credential theft and misuse, and a board that wants to know the access footprint is both correct and provable. This example walks the full SABSA chain for that programme: from the access attributes that normalise the requirement, through an access control policy enforcing least privilege, down to the MFA workflow, the identity provider, and the actual product — Entra ID or Okta — that delivers it in production.