All videos
Antvia Data · Episode 8 of 8

Who can see what

An access register is usually built to answer "does this person have permission?", and the answer is almost always yes. This episode uses the People, Roles and Groups tabs of Antvia Data to answer the questions people actually have: which live accounts have no second factor, which are dormant, which invitations never arrived, and what each role can do. Then it reads the audit trail, filtered to the events that changed a boundary or ran into one, and closes the gap on the one unprotected account live.

7:248 chapters861 wordsSilent, with captions

Also on YouTube, with the rest of the Antvia Data series. The whole episode is written out below, with the timing, if you would rather read it.

Chapters

What happens, in order.

0:00
Introduction
Title card.
0:07
The awkward questions
The People tab: the summary figures, the default order that puts risky accounts first, and the columns for role, last seen and second factor.
1:20
Five accounts, five stories
Panels for the area manager with no second factor, the dormant leadership account, the invitation with a role granted to nobody, the recent invitation, and the deactivated analyst.
2:40
What each role can do
The Roles tab: the five roles, the capability matrix, the risky capabilities, and how many people hold each role.
3:37
Groups and rows
The Groups tab: membership, row scopes by region, partner and plant, and people listed under each group.
4:39
The audit trail
Activity: why it opens filtered, the governance changes and the refusal, an event opened with its person, and the full trail with ordinary reads.
6:07
Close the gap, live
Requiring a second factor for the unprotected account, the People figures updating, the home page item clearing, and the change recorded in the audit trail.
7:01
Close
Closing card.
Transcript

The whole episode, in words.

The videos are silent, with the captions burned in. This is the same text, with the timing, so you can find the part you need without scrubbing for it.

Introduction

0:00
Antvia Data. Who can see what. The awkward access questions: who still has it, who never used it, and who was stopped at the boundary.

The awkward questions

0:07
The awkward questions. Everybody who can reach the data, sorted by risk.
0:12
AccessAccess lists everybody who can reach the data at Acme Home Appliances, a demo company, what they may do with it, and when they last did.
0:23
Not who has accessThe useful question is rarely who has access. It is who still has it and no longer needs it, and who has it with too little guarding it.
0:35
Password onlyOne live account has no second factor.
0:40
DormantOne active account has not been used in thirty days.
0:45
InvitationsTwo invitations are open, and one is over a week old.
0:51
AdminsAnd two of twelve active people are org admins.
0:56
Riskiest firstThe list opens with the risky accounts: no second factor, then dormant, then stale invitations, then everyone else.
1:05
Second factorSecond factor reads off for the one account without it. Everyone else reads on, in plain text.
1:13
Last seenLast seen is a day, not a minute, because a sign-in is a day-level fact.

Five accounts, five stories

1:20
Five accounts, five stories. Opened one at a time.
1:25
Password onlyImran Qureshi, area sales manager in Coimbatore. Live access and no second factor: one reused password is the whole distance between this account and everything it can read.
1:37
A small roleThe role is Data Consumer, the smallest there is. The risk is not what the account can do; it is who else could be using it.
1:50
DormantAjay Khanna, head of institutional sales. Not seen for thirty days, and the account still works. Nothing has gone wrong, and that is exactly why nobody would notice.
2:04
Invited, never arrivedTanvi Shah was invited as a marketing analyst on 24 July and never accepted. The Analyst role is granted, to nobody.
2:15
RecentAditya Joshi, a data engineer, was invited today. That is not a problem yet, so it does not read as one.
2:27
DeactivatedNikhil Arora left in June and is deactivated, kept for the audit trail. That is the healthy case, and it fades rather than raising a flag.

What each role can do

2:40
What each role can do. Five roles, counted against everything there is to do.
2:45
RolesFive roles, each counted against every capability in Antvia Data: connecting sources, publishing uploads, classifying columns, certifying tables, managing people and policies.
2:54
Comparable at a glanceAdmin, Data Engineer, Data Steward, Analyst and Data Consumer, each with its count. The counts are derived from the capability list, so adding a capability moves every one.
3:07
CertifyTwo roles can certify a table, which is what the rest of the company trusts.
3:15
The one in redTwo can read masked columns in the clear. It is the only capability drawn in red.
3:22
Change accessAnd one can change access at all.
3:29
Who holds themBelow the matrix, each role says what it is for and how many active people hold it.

Groups and rows

3:37
Groups and rows. Same role, different rows.
3:43
GroupsAn area manager and the chief executive hold the same role and see different rows. Groups are how.
3:53
MembershipsNine groups, with every membership counted, including the 36 service partners outside the company.
4:01
UnrestrictedLeadership sees all regions and all channels, and lists who is in it: the chief executive, the CFO, the head of supply chain and others.
4:13
Own region onlyRegional sales sees only its own region. The acting West head sees the West.
4:22
Own plant onlySupply chain is scoped by plant, so Pune and Hosur each see their own lines.
4:29
No group at allSome people belong to no group. The Coimbatore area manager is one, so that account sees only what its role grants directly.

The audit trail

4:39
The audit trail. Consequences first, ordinary reads behind a toggle.
4:46
ActivityEvery audit log fails the same way: ten thousand ordinary reads a day, and the four rows that changed who can see what are invisible.
4:57
GovernanceSo this one opens on consequences. Four governance changes: somebody changed who can see something, or vouched for a number.
5:06
RefusedAnd one refusal: somebody tried and was not allowed.
5:13
A refusalThe Coimbatore area manager tried to query receivables and was refused. The boundary held, and it is the third attempt this month.
5:22
Worth readingA refusal is often a request in disguise: somebody needs a number nobody has given them a way to get.
5:34
The exemptionTwo days ago, the head of data recorded the exemption that lets this account sign in without a second factor. Granted during onboarding in January as a temporary measure, and still in force.
5:51
Granted to nobodyA role granted to an invitation nobody accepted.
5:56
EverythingShow everything adds the ordinary reads back, faded. They are kept, because they are what makes the rest provable.

Close the gap, live

6:07
Close the gap, live. Require the second factor, and watch the register agree.
6:15
Close itThe temporary exemption has run for seven months. Require a second factor.
6:23
DoneThe exemption is withdrawn. The next sign-in on this account asks for a second factor before anything else.
6:33
None leftNo live account in the workspace is protected by a password alone.
6:43
Home followsThe home page no longer lists an account without a second factor among the things that need somebody.
6:54
On the recordAnd the audit trail has the change, as a governance event, at the top.

Close

7:01
Access you can answer for. Accounts with no second factor, dormant or never used, surfaced first. Roles made comparable by counting capabilities. Row scope and column masking kept separate. An audit trail that opens on what changed.
Antvia Data

The rest of the series.

Before thisProtecting sensitive data

All 18 episodes, the Antvia Data playlist on YouTube, or read what Antvia Data does. The other half is Antvia Intelligence.

Next step

See it on your own data.

Thirty minutes on the half you came for. Bring the report that breaks every month, or the decision you never settled.

Contact us for a demoOpen the live demo