Birthright Access

What is birthright access?

Birthright access is the set of permissions every employee receives automatically on their first day, simply by being an employee, without anyone having to request them. Email, the intranet, the messaging platform, the HR portal, and the shared document space are typical birthright entitlements. Anything beyond that baseline should be requested and approved individually.

How birthright access is defined

• A baseline set of applications is agreed for every employee, regardless of role.
• Additional baselines can be layered by department, location, or job family.
• Entitlements are attached to attributes from the HR record, so provisioning happens without a ticket.
• Everything outside the baseline moves onto a request and approval path.
• The baseline itself is documented and reviewed, because it is a policy decision, not a technical one.

The problem with defaults nobody revisits

Birthright access is by definition the largest single block of entitlements in the company, because every employee holds it. It is also the block least likely to be reviewed, precisely because it was never requested and nobody feels responsible for it. Baselines written three years ago quietly keep granting access to tools that changed purpose, or to shared drives that now hold payroll data.

Examples and use cases

A company defines a birthright baseline of five applications for everyone, plus four more for the sales organization. New hires are productive on day one with no tickets. Two years later the shared sales drive contains commission data, and the birthright grant still gives every salesperson access to all of it. The baseline was correct when written and wrong afterward. Putting birthright entitlements into the same review cycle as requested access closes that gap, and Corma runs both through one cycle.

Related concepts

• Automated provisioning and onboarding
• Automated identity governance and administration
• Automated and compliant access reviews

FAQ

What is the difference between birthright access and role-based access?

Birthright access is granted automatically to everyone or to a broad population. Role-based access is granted according to a specific job role and its defined responsibilities.

Should birthright access include the CRM?

Only if every employee genuinely needs it. Broad baselines are convenient but they turn a business system into a company-wide entitlement, which is difficult to justify in an audit.

Who decides the birthright baseline?

It is a joint decision between IT, HR, and security, because it mixes productivity, cost, and risk. It should be documented and dated like any other policy.

Does birthright access need to be reviewed?

Yes. It is the largest entitlement block in the company and the one most likely to have drifted from the intent it was originally written with.

Request a demo