I was asked this during an interview for a new graduate DevOps role: "Who typically owns access to corporate applications—IAM engineers, IT staff, application administrators, or Platform/DevOps engineers?" How would you answer, and how would you explain the responsibilities of each group?
5 Answers
Company size and industry make a big difference. A small startup might have one DevOps engineer or even a QA engineer managing nearly everything. A larger or regulated company is more likely to separate approval from implementation so that the person approving access cannot also grant it. Automated provisioning through an identity platform or deployment pipeline may perform the actual change.
I’d answer: “There isn’t one universal owner. I’d first identify the application and define ownership. Generally, the application or business owner approves access, IAM manages the identity and policy framework, IT handles standard user support, and platform teams manage infrastructure-level permissions. I’d also expect auditing, least privilege, and separation of approval from implementation.”
I’d clarify the question before choosing one team. Ask whether ownership means defining the access policy, approving requests, implementing permissions, or being accountable for the application. In a mature organization those responsibilities are deliberately separated: a business or application owner approves access, IAM enforces the process, and an administrator or automated system applies the change.
The best answer is that it depends on the organization, the application, and what “owns access” means. IAM usually defines identity, roles, policies, and approval workflows. Application administrators often handle day-to-day access changes, while IT may manage standard employee onboarding and common business tools. Platform or DevOps teams might manage access to cloud infrastructure, deployment systems, and technical environments.
For a typical enterprise, IAM is the strongest starting point because identity and access management is usually responsible for the overall access model. However, IAM does not necessarily grant every permission themselves. Application administrators may manage application-specific roles, IT may handle routine user access, and DevOps may own permissions for cloud platforms and deployment tooling.
That framing is probably what the interviewer wanted. Saying only “IAM” is too simplistic because IAM may own the process while another team owns the application or executes the change.