A department head wants to give a new administrative staffer access to one of the thirty-odd internal apps shared by the College of Human Ecology and the Brooks School of Public Policy. That used to mean filing a ticket and waiting for a developer to remote in, edit the access by hand in an outdated ColdFusion system, and email back to confirm. It took several business days every time, for one line of permissions.
The ColdFusion service was so outdated that nobody had a reason to work in it, and an access audit meant hours of assembling answers by hand. Licensing and integrating an identity product would have cost about as much as building one, and those products are sized for enterprises, not for thirty apps and two colleges of staff. The permission data already sat in SQL tables every internal app could read. The only broken part was the process for changing a row.
Now a department head searches for a username and drags it onto a role to grant access, or onto the trash to revoke it. Behind that board is a Node and Express service writing to the same SQL tables. Sign-on is handled by Shibboleth at the web-server layer, which every campus application already sits behind. Nobody files a ticket, no developer edits a row, and granting access takes under a minute.
The board
Removals are soft deletes, so the permission table keeps every grant and every revocation, with who made it and when. The last access audit took one query instead of an afternoon.
The colleges have been moving their internal apps to Node, and the new ones use this for access control. Two years on, they all check the same tables to decide who can see what. In that time nothing has been granted or revoked by mistake, and nobody has reached anything they shouldn't.