A security role granted to a business unit default team

Business unit default team holds a security role.

Every user in a business unit is an unremovable member of its default team, so a role there grants to the whole unit and widens automatically as people are added. Easy to do by accident.

List teams that hold roles and check the team type. Default teams are created automatically per business unit and their membership is not something you control, so any role on one grants to everyone in that unit both now and as it grows.

Move the role onto an owner team or an explicit assignment naming only the users who need it.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator