---

name: iam-specialist description: | Guides identity and access management—workforce and machine identity lifecycle, RBAC/ABAC/PBAC entitlement design, access reviews and recertification, SSO/SAML/OIDC federation, privileged access (PAM/JIT), cloud IAM least privilege (AWS/GCP/Azure concepts), service accounts and secrets hygiene, and separation of duties. Use for IAM, identity governance, access review, RBAC, least privilege, SSO federation, PAM, privileged access, cloud IAM policy, service account, or SoD—not full cloud landing zone architecture (enterprise-cloud-architect), broad cloud security controls (cloud-security-engineer), day-2 break-glass ticket execution only (cloud-system-administrator), pentest (penetration-tester), or legal/HR policy drafting only.

IAM Specialist

When to Use

• Design workforce and machine identity lifecycle — joiner/mover/leaver, contractors, service principals
• Model RBAC, ABAC, or PBAC entitlements, roles, and permission sets with least privilege
• Run access reviews and recertification — campaigns, risk-based sampling, manager attestation
• Architect SSO federation — SAML, OIDC, SCIM provisioning, app onboarding patterns
• Implement privileged access — PAM vaulting, JIT elevation, session recording, break-glass policy
• Author cloud IAM roles, policies, permission boundaries, trust relationships (AWS/GCP/Azure)
• Govern service accounts and secrets — naming, rotation, no human keys, workload identity
• Define separation of duties matrices and toxic-combination detection
• Align IAM controls to audit and risk narratives (with GRC partners)

When NOT to Use

• Multi-BU landing zone, CCoE, EA, or executive cloud governance → enterprise-cloud-architect
• Org SCPs, CSPM, network segmentation, KMS program, detective controls → cloud-security-engineer
• Access ticket fulfillment, key rotation runbooks, patching, restores → cloud-system-administrator
• VPC/RDS/serverless build without IAM as primary deliverable → cloud-engineer
• SIEM/EDR deployment, WAF, broad security tooling → information-security-engineer
• SOC 2 evidence pipelines and automated control checks → compliance-engineer
• CI OIDC and pipeline scan gates only → devsecops
• Inherent/residual risk scoring and risk register → security-risk-analyst
• Authorized exploitation or pentest validation → penetration-tester
• Legal interpretation, employment policy, or contract redlines → commercial-counsel

Related skills

Need	Skill
Cloud org guardrails, CSPM, network/KMS security	cloud-security-engineer
Cloud resource build and workload identity wiring	cloud-engineer
Day-2 IAM tickets, rotation, break-glass execution	cloud-system-administrator
Enterprise landing zone and CCoE governance	enterprise-cloud-architect
SIEM, EDR, encryption, security-as-code guardrails	information-security-engineer
GRC program, framework scope, audit coordination	compliance-specialist
Audit evidence automation from IdP and cloud APIs	compliance-engineer
CI/CD OIDC federation and pipeline least privilege	devsecops
Risk register, treatment, and executive heat maps	security-risk-analyst
Cloud framework evidence and residency packages	cloud-compliance-specialist
Security program strategy	cybersecurity

Core Workflows

1. Scope and governance model

Identity domains, RACI, and boundaries vs cloud security and ops.

See references/iam_specialist_scope.md.

2. Identity lifecycle and access governance

Joiner/mover/leaver, provisioning, reviews, and exceptions.

See references/identity_lifecycle_and_governance.md.

3. Entitlements and authorization models

RBAC/ABAC/PBAC design, role engineering, and SoD.

See references/rbac_abac_and_entitlements.md.

4. Federation and SSO protocols

SAML, OIDC, SCIM, and SaaS onboarding.

See references/federation_sso_and_protocols.md.

5. Privileged access and PAM

JIT, vaulting, break-glass, and session controls.

See references/privileged_access_and_pam.md.

6. Cloud IAM and least privilege

Cross-cloud IAM patterns, policy review, and machine identity.

See references/cloud_iam_and_least_privilege.md.

Outputs

• Entitlement catalog — roles, permissions, owners, review cadence
• Access review campaign — scope, attestations, remediation tracker
• Federation design — trust, claims, MFA, provisioning flow
• PAM policy — elevation paths, approval, monitoring, break-glass
• Cloud IAM policy set — least-privilege JSON with trust boundaries documented
• SoD matrix — incompatible duties, compensating controls, exceptions
• Service account standards — creation, rotation, audit queries

Principles

• Identity is the perimeter — authenticate strongly; authorize minimally
• No standing privilege — prefer JIT and time-bound elevation for admin
• Prove every grant — reviews, logs, and SoD checks on sensitive entitlements
• Humans ≠ machines — separate lifecycle, credentials, and audit trails
• Federation fails closed — misconfigured trust denies access; monitor sync errors
• Break-glass is rare, logged, and reviewed — not a daily admin shortcut