Most broken remote access is not a broken product; it is the absence of a design. Over years, teams add one
path here, one rule there, and the estate becomes a chart nobody can draw. Our architecture desk reverses that.
We describe the access model end to end, check it against the platforms you already run, and only then begin any
configuration.
The design pack is the primary deliverable: a written architecture with reference diagrams, decision records,
the identity rules that support it, and the monitoring signals that prove it works. Nothing in the pack depends
on a product we sell, because we sell none.
FIG 4 · Every rule has an owner, a purpose and a review date.
Design principles we apply
REF ACC-DSN-320PRINCIPLES SixREVIEW Annual
Broker every entry. Users should not reach internal systems directly. Access should pass through a
controlled brokering point that evaluates identity, device and context before a session is allowed.
Least privilege by default. A person receives the smallest reach that completes their work, for the
shortest time that is practical, and loses it automatically when the reason ends.
One identity of record. A single directory acts as the source of truth. Everything downstream mirrors
it rather than creating parallel user lists.
Strong authentication everywhere. Phishing-resistant factors for administrative reach, with
conditional rules that raise the bar for unusual locations and untrusted devices.
Observable by construction. If a control cannot be seen in logs and reports, it is not designed yet.
Every rule we write emits a signal someone owns.
Reversible changes. Each step has a documented rollback position so a bad wave is a pause, not an
outage.
The design pack, item by item
REF ACC-DSN-340VOLUME 40–120 pagesFORMAT PDF + source
Current-state map. How access actually works today, drawn from evidence rather than assumption, with
every undocumented shortcut called out.
Target architecture. The access model we recommend, with brokering points, zones, trust boundaries and
the flows between them.
Identity rules. A written table of who reaches what, under which conditions, and how each rule is
enforced and reviewed.
Session handling. How privileged and third-party sessions are brokered, observed, recorded and
escalated, plus retention for the records.
Monitoring plan. The signals we will collect, the thresholds that matter, and the routines that turn
signals into action.
Roadmap. A sequenced plan from today to target, with dependencies, effort bands and owner names.
Typical duration · four to eight weeks for a mid-sized enterprise, depending on the number
of sites and the state of existing documentation.
We also pressure-test the design against daily reality. A model that works in a diagram can still fail on a
busy Monday morning, so we walk each rule past the people who will live with it: the service desk that takes the
calls, the administrators who request elevated reach, and the teams who travel or work unusual hours. Where a
rule would create an unreasonable burden, we either reshape it or write an explicit, owned exception with an
expiry date. That habit keeps the design honest and stops people from quietly working around it later.
