The catalogue Information TechnologyIdentity & AccessTransactional

Service IT2C

Privileged Access Request

Runs transactional. Starts when a scheduled window opens. It runs 6,952 times a week across 7 stations. One of those stations stops for a person and 6 are done by an agent, 4 of them on the shared spine.

Runs a week

6,952

145 in flight right now.

Stations

1 person · 2 agent · 4 spine

Agent share of steps

86%

Autonomy on this service is set at 84% against a ceiling of 86%.

Decisions a person makes

Held by Director, Identity & Access Management.

Touchless

88%

Share of runs that complete without anybody opening them.

Timetable against actual

2.1h

Actual 1.6h, 0.5h under the timetable.

Operations

The lane diagram

Read it left to right. more

Person1 station and 24% of the dwellAgent2 stations and 20% of the dwellShared spine4 stations and 56% of the dwell3 crossings between lanes

Human

decides

Agent

does the work

GBS

shared spine

System

attributed by rule

Configuration Management Database

IT Service Management

Click any station to see who does it, what it costs in time, the rule that gates it and the system attributed to it.

Operations

Every station in order

The same stations as a list, with the dwell the estate records against each one and the system a station of that shape would touch.

#	Station	Lane	Who	Layer	Dwell	Target	In flight	System
1	Request	Agent	Joiner Provisioning Agent	workflow	2h 6m	3h 44m	40	Configuration Management Database
2	Justify	Agent	Mover Adjustment Agent	workflow	1h 50m	2h 18m	6	IT Service Management
3	Duty check	GBS	Joiner Provisioning Agent	gbs	2h 8m	4h 32m	19	IT Service Management
4	Owner approve Held for a named human when the unit exceeds the access request decision envelope, when confidence falls below the floor, or when a policy clause is engaged.	Human	Director, Identity & Access Management	policy	4h 32m	7h 18m	3	IT Service Management
5	Grant time-boxed	GBS	Joiner Provisioning Agent	gbs	2h 38m	5h 14m	25	IT Service Management
6	Auto-revoke	GBS	Joiner Provisioning Agent	gbs	3h	6h 29m	28	IT Service Management
7	Log	GBS	Joiner Provisioning Agent	gbs	3h 3m	4h 52m	24	IT Service Management

Operations

Run it

Change the volume, move the autonomy line, release a gate, and watch what happens to the hours in each lane and to the time it takes one run to get through. more

Move something

Demand100%

6,952 a week is what the estate records. more

Decisions handed to agents0 of 0

This service has at most one gate, so there is nothing to hand over without removing the last human decision.

People on the gates901 people

Each one is assumed to have 2,100 productive minutes a week, which is 35 hours.

Agent speed100%

100% is the dwell the estate records today. more

Person time a week

31,515.7h

6,952 items at 272 minutes of decision each.

Agent time a week

102,542h

885 minutes an item, which does not compete for a person.

Gate load

100%

Inside capacity, with 19.3h of headroom.

Stations without a person

86%

1 gate left on 7 stations.

Where an item spends its time

24% waiting on a person

76% in the agent lane

An item now takes 1,157 minutes of worked time end to end against 1,157 in the recorded estate, a change of +0%. This is worked time, not calendar time: nothing here models a queue or a weekend.

What this model is, on Privileged Access Request

The simulation is arithmetic on the estate, not a queueing model. more

How it runs

Run it again, going wrong

The same unit and the same stations, broken the way the estate already records breaking. more

7 stations, walked twice

Once clean, once with the categories the estate counts

This is the same unit on the same stations, breaking. more

No break below was chosen. more

One play head, two tracks, the same scale. The clean run stops when it runs out of stations; the other one keeps going.

As written

7 stations, nothing waiting, nothing sent back

0 min of 19 hrs

now Request · Joiner Provisioning Agent · 2.1 hrs

As the ledger has it

the same stations, plus 5 categories the estate already counts

0 min of 37 hrs

now Request · Joiner Provisioning Agent · 2.1 hrs

personagentshared spinework the break addsnobody working it

What breaks, and where it is counted

No break below was chosen. more

What the two runs say together

5 counted categories land on this procedure. more

What this run cannot claim

These breaks are shown together on one unit so the shape of a bad day fits on one screen. more

The separation register records a duty conflict against a sub-function and a named post, not against one procedure. more

Two clocks run. Worked time is the sum of the time the work is actually being done … more

Live observability

Systems this service would touch

Attributed by rule from the function's system list. more

2 systems attributed

0 of 2 returning records

The system register

IT Service Management

ServiceNow ITSM · itsm · bidirectional · high

modeled

6 of 7 stations attributed here · would write back

Configuration Management Database

ServiceNow CMDB · itsm · inbound · high

modeled

1 of 7 stations attributed here · read only

System attribution is a rule, not a reading. more

Who runs it

Orchestration and accountability

Orchestrated by: Identity Orchestrator
That orchestrator’s remit: Owns access request work end to end inside Information Technology. Runs 3 lines across 19 stations, drains the repeatable share into the IT tower, and holds 2 human gates.
Accountable person: Director, Identity & Access Management
Sub-function: Identity & Access
Shared spine tower: it
Hand-over points: None — this service stays inside its function

Other services in this sub-function

2 alongside this one

Joiner ProvisioningIT2A Leaver DeprovisioningIT2B

What this page is and is not

This is a catalogue of the modeled estate. more