Client data, matter boundaries, guest sprawl
Consultancies, law firms and agencies hold other organizations’ most sensitive material under contractual and sometimes ethical walls. Those walls are implemented as access controls, and access controls erode as people move between engagements.
“Can access still cross the boundary between two client engagements?”
How the risk takes shape.
Ethical walls are access controls
A conflict wall is a statement about who can reach what. Verifying it holds requires resolving group nesting and inherited scope, not reading the policy that describes it.
Engagements end; access lingers
Staff rotate across matters continuously. Removal from a team is not the same as removal from every scope that team’s resources sit beneath.
Clients audit you
Client security requirements increasingly include evidence of segregation. Producing it from configuration is faster and more credible than producing it from process documentation.
What we look for first.
These are structural patterns this operating model tends to produce — not findings from any particular organization. They are where an assessment starts, because the architecture makes them likely.
Whether they are present in your estate is an empirical question. That is the point of looking.
- Guest and contractor identities retained across engagement boundaries
- Collaboration workspaces inheriting access from a parent scope that spans clients
- Shared delivery-team identities used across concurrent engagements
- Departed staff whose group memberships were removed but whose direct assignments were not
Evidence, in your framework's language.
The reach set
Every identity that can reach your client confidential data, with the path each one takes — direct, inherited, nested, eligible or federated.
Control-mapped findings
Findings tied to the control families you evidence against — ISO 27001 and SOC 2 — with the underlying facts attached.
One ranked decision
Not a backlog. The single highest-consequence move, with its projected outcome labeled as projected and its evidence trail intact.
Test these patterns against your own estate.
A scoped, read-only assessment on a subscription you choose. We answer the question above with your numbers, and tell you plainly where we could not determine something.
Free forever on a bounded estate · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available