Standing up zero-trust access across nine countries.

Nine countries, nine ways in.

Aperture's imaging centres were acquired or built over eighteen years, and access to the picture archive was granted per site, by the site. A radiographer moving from Lyon to Ghent was given a new account rather than a transferred one, and the Lyon account usually stayed open behind them.

A count taken in January found 11,400 active accounts against 6,800 employees. Of those, 2,140 had not authenticated in over a year and 148 belonged to people who had left, three of them more than four years earlier.

A national regulator had given notice of a review of access controls over patient imaging, with a date attached. That date is what turned an acknowledged problem into a programme.

Standing privilege is the part that is hard to remove.

Everyone agrees that leavers should be offboarded. The harder problem is the account that is legitimately in daily use and permanently over-scoped.

Two patterns accounted for most of it. Radiologists reporting across sites had been given site administrator rights, because that was the only role that let them open a study from another centre. And the third-party engineers who maintain the modality software held permanent accounts, because raising access each time took longer than the fault they had come to fix.

Neither is solved by deleting accounts. Both are solved by making elevated access temporary and making the temporary path quicker than the permanent one. Otherwise people route around it, and you have added a control that only inconveniences the compliant.

• 1,940 accounts held site administrator rights. Sixty-two of them needed to.
• Vendor support access averaged 313 days of standing privilege per engineer.
• No record anywhere of who had approved any of it.

Twelve days to the first token.

Gate went in against one site first. Ghent, 210 staff. Identity was seeded from the HR record rather than from the existing directories, and that single decision made the rest of the programme possible: joiners, movers and leavers now originate in one place, and the nine directories became consumers instead of sources.

Elevation replaced standing rights. A radiologist opening a study from another centre gets access to that study for eight hours, approved by their own clinical lead and logged against the accession number. Vendor engineers request a session bound to a named fault ticket, and the session expires when the ticket closes.

Sentinel takes Gate's decision log. The evidence the regulator asked for (who could open which study on a given date, and on whose approval) is now a query rather than a project.