hardDesignScenarioConceptSeniorStaffLead
Nobody has write access to production, but the deploy pipeline can change anything. Where does separation of duties live now?
5 min readUpdated 2026-08-15
Answer
Short answer
Removing humans from production moves the privilege into the pipeline, so the boundary becomes who can change what it runs and which identity it assumes. Duties are separated by branch protection, environment approvals and deploying by digest, and it fails when one change alters both code and workflow.
Was this answer helpful?
Likely follow-ups
- Your pipeline needs to run a data fix that no migration covers. How is that authorised and evidenced?
- How do you stop a self-hosted runner from becoming the standing production credential you removed?
- What evidence would you hand an auditor to show that no change reached production without an independent approver?
- Three engineers, one of whom is on call. What separation is real and what is theatre?
Related questions
- A release goes out and afterwards users can see records they were never entitled to. How would you find out, and how long would it take?hardAlso on separation-of-duties and change-management6 min
- What does least privilege look like in practice, and what is separation of duties there to prevent?mediumAlso on separation-of-duties6 min
- How do you design a system so an auditor can prove who accessed a record and why?mediumAlso on separation-of-duties8 min
- A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?hardAlso on change-management6 min