When the Org Chart doesn't exist

n the previous posts in this series, Nick Slabaugh and I (John Thornton) covered the lessons we learned in the first three of our RBAC engagements. These initial lessons came to form the discipline that we called Role Model Analysis, the short explanation for which is that it's a quantitative and qualitative approach to determining which of a company's organizational attributes (e.g. division, department, job-title, location etc.) best aligned with the access that an organization had. It's an elegant solution that worked for years, until it didn't. And while success is a great teacher, failure has lessons of its own.

To be really clear on this, Role Model Analysis works, most of the time. Chances are it's a viable fit for your current organization and it will produce valuable new roles that will reduce the cost of your IAM operations. It is the method by which my two former employers run their RBAC programs after I introduced it there and an artifact from that process is (as of August 2026) still the background to my personal LinkedIn page. I believed in it, because it was the most effective way in which to run an RBAC program. It no longer is and one of the reasons for that became very clear in the engagement you're about to read about.

The client was a large insurance company; if you have a passing familiarity with the US healthcare system, you've heard of them. The previous decade had been an acquisitive one for them. They had been picking up smaller insurance companies left and right and integrating them to various degrees into their business. At the same time they had also stood up their IAM practice and began regularly reviewing their users' access. They suffered from the same woes that every other company that implements IAM has, excessive review items, rubberstamping and too many manual access requests. This all sounds like a very promising setup for an RBAC effort.

In the midst of their acquisitions and the centralization of their IT resources, the company had neglected to wholly integrate its HR data. The organizational structure of the company was reduced to purely reporting structures. There was an entry for "Department" for every person but these had been copied from its acquisitions without standardization or rationalization against a target operating model. It was not unusual for three people in a reporting chain to all be listed in different departments. If you're reading this and think "That doesn't sound like a healthy company", this was several years ago and the power of hindsight confirms this, the "controversies" section of this company's Wikipedia page makes up roughly 50% of the content. In fairness, 2020-2022 was a tough time to be in the health insurance industry.

Role Model Analysis depends on a well-defined and structured organization. It accepts that most companies in fact have multiple structures, for example, a department retail store would have both a departmental structure (e.g. home goods, food, clothing etc.) and a geographic one (Store #1, Store #2, Store #3 etc.), and it allows an IAM practioner to choose from the best of the provided options as a way to organize a company's roles. Companies without formal organizations aren't rare, most companies in fact don't have formal organizations, because most companies don't survive long enough to warrant them. It is, however, exceedingly rare to see a company massive enough to warrant an IAM program (much less an RBAC program) that hasn't formally captured their business structure. The value was still there, but Role Model Analysis wasn't the tool to capture it, it was too dependent on the existence of an underlying corporate structure.

I ended up moving on from the experience appropriately humbled and left with a question tickling the back of my brain: "How can we build an effective role model without organizational attributes?"