Exploring twisted paths: Analyzing authorization processes in organizations

Problems in organizational authorization result in productivity impacts and in security risks, for example, from over-entitlements and non-compliance. Many of the problems originate from organizational dynamics in combination with problematic authorization procedures for permission changes. To mitigate these problems and to improve the processes or craft supporting tools, a solid understanding of the processes and interactions between stakeholders is required. However, little prior empirical research covers authorization procedures. This paper presents an exploratory study of the procedures in organizational contexts. To enable a systematic analysis, an authorization process model is introduced that focuses on the interrelation of stakeholders and activities. The study discusses process characteristics, including the degree of centralization and the formality of interactions. Beyond this study, the model should serve as a basis for further research and support process designers to identify potentials of improvements.