下面這段文字還是從標題的書中摘錄出來的。
What do I mean by that? Well, the thing so many companies have gotten wrong is: they have 10,000 users and 30,000 roles. If I can do five different things as part of my job, then I have five roles. If the guy sitting next to me also has five different roles, then between us we have ten different roles. Ouch! I’ve actually heard of even worse examples, where organizations had literally millions of roles, with the excuse being, “Everybody is unique.” As a product manager at Oracle puts it, “When everybody is unique, nobody is unique.”
Let’s say I’m appearing in a Shakespeare play. Let’s go with Titus Andronicus, because it’s extremely violent and bloody, much like the software market. If I’m appearing as Titus in one theater, and there’s another production of the same play down t he street, I’m not Titus-1 while the other guy is Titus-2. We’re both reading from the same scri pt. We’re both Titus. We’ve both been assigned that same role. What’s different is our context, since we’re in different theaters, and besides that, I’m tall, swarthy, handsome, and articulate, and the other guy’s kind of ugly. But we both have the same essential role, speak the same lines, and end up in the same horrid way.So instead of 30,000 roles for 10,000 people, it should be 10,000 roles for 30,000 people.
But wait, there’s more! It should probably be more like 100 rol es for 10,000 people, a vast order of magnitude less. Don’t turn a slight variation into an excus e for a whole new role. If the plastics division has a Quality Control Officer, and so does the metals division, then you have one role, with the context being the division. The grant of that role may still require different approvers; remember not to confuse the role with the granting of that rol e. But the baseline definition of the role will be consistent, yet flexible. Using context as a quali fier on a role keeps the number of roles from exploding.
總結來說，定義role的時候，最佳實踐儘量減少role的個數。要區分role和context，比如這個人是某某部門經理，這個可以當作是一個role，但是他的location應該是作爲一個context。因此在IAM項目實施的時候，注意不要設計過多的role。