A utility billing clerk is promoted to supervisor. Leadership wants the new role approvals without keeping every former clerk entitlement. What is the soundest approach?
Select an answer to reveal the explanation.
Short Explanation
Promotion should not mean all the old stuff plus the new stuff forever. Swap into the supervisor role package and drop clerk-only rights you no longer need—clean transition, not privilege lasagna.
Full Explanation
Sound role transition defines the target supervisor job’s least-privilege package, assigns that role, and removes clerk entitlements the new position no longer requires. Promotions in municipal utility billing must not become permanent stacks of every past job’s rights; otherwise supervisors retain unnecessary operational write paths and violate least privilege while complicating audits. Documented role definitions plus a controlled cutover preserve day-one capability without eternal privilege sprawl.
Permanently adding the supervisor role atop the clerk role to avoid downtime institutionalizes cumulative privilege and makes recertification harder. Sharing the departing supervisor’s password until HR paperwork finishes destroys individual accountability and creates an unmonitorable shared secret during a sensitive handoff. Granting Domain Admin so “role design becomes unnecessary” is the opposite of IAM discipline and massively expands compromise impact on city directories.
Exam caveat: prefer role redesign and entitlement swap over add-only promotions; temporary overlap may be acceptable if time-boxed and ticketed, but permanent stacking is not. Operational check: maintain a role catalog for clerk versus supervisor billing duties, automate removal of clerk-only groups at promotion effective date, and verify in the next access review that the employee holds only supervisor-appropriate entitlements.