A small team I was helping brought on a student for a short project last year, a few weeks of work on one specific feature. To make that possible quickly, I gave them direct access to the staging database and a scoped-down but still fairly broad admin account, with a mental note to remove it once the project wrapped. That note never turned into an action, and I only rediscovered the account a year later, going through an unrelated cleanup.
Why it happened this way
Nothing about granting the access felt careless in the moment. The project had a real deadline, the intern needed real access to actually be useful, and setting up something more scoped down would have taken time we didn't have for a three-week engagement. The plan to revoke it afterward was genuine. It just depended entirely on someone remembering to do it once the excitement of the project ended and everyone moved on to the next thing, and nobody did.
What I actually found a year later
The account was still active. Still had the same broad access it had been given for a three-week project that ended eleven months earlier. The intern, as far as I know, never did anything with it beyond the original scope, and I have no real reason to think otherwise. That's not really the point. The point is that for eleven months, a credential existed that nobody was actively tracking, tied to someone no longer involved with the project in any way, and its continued existence depended entirely on nobody with bad intentions ever discovering it. That's not a security posture. That's just luck holding, and it held, but it didn't have to.
Why this is so easy to let happen
Granting access has a natural trigger: someone needs to start work, so access gets created right away. Revoking access has no equivalent natural trigger. Nobody's blocked from doing anything if an old account just sits there unused. There's no error message, no reminder, nothing that surfaces the fact that a temporary grant quietly became permanent the moment everyone stopped thinking about it.
What I do differently now
- Any access granted for a defined, short-term engagement gets an actual calendar reminder set at the same time it's created, not a mental note.
- Where the platform supports it, I set an actual expiration date on the account or the invite, rather than relying on anyone remembering to revoke it manually.
- Every few months, I go through the full list of who has any kind of standing access to a project, not just who's actively working on it, and ask whether each one still makes sense.
- For anything short-term, I default to the most scoped-down access that still lets the person do the work, rather than the most convenient one to set up quickly.
None of this is about not trusting the person the access was given to. It's about recognizing that a temporary grant with no built-in end date isn't temporary at all. It's permanent, with an informal, unenforced plan to eventually end it that depends entirely on someone remembering, and someone, including me, usually doesn't.