A workforce platform holds identity, payroll and device management, and integrates with dozens of downstream systems. What is the central security risk and how is it bounded?

The central risk

Concentration. A platform that holds identity and can provision access to downstream systems is, by design, a single credential away from everything the organisation uses. Its compromise is not an incident in one system — it is an incident in every system it integrates with.

That concentration is also the product's value, so the answer is not to reduce it but to bound what a compromise achieves.

How it is bounded

• Downstream credentials scoped to the minimum operation set. An integration that only needs to create and deactivate users should not hold an administrative token. This is negotiated per integration and is tedious, and it is the single largest determinant of blast radius.
• Per-tenant credentials for downstream systems, so one customer's compromise does not reach another's.
• Approval and rate limits on bulk operations. Mass deprovisioning is the highest-damage action available, and it should require confirmation above a threshold — the same deletion-safety principle that protects against a faulty sync also protects against a malicious one.
• Separation between the control plane that grants access and the systems that hold data, so a compromise of the former is detectable before it becomes exfiltration of the latter.
• Comprehensive, tamper-evident audit of every privileged action, exported to the customer's own systems so detection does not depend on the compromised platform.

The insider dimension

The most sensitive access in such a platform is staff access for support, which is broad by necessity and is the path least covered by customer-facing controls.

The controls that work: just-in-time elevation with an expiry, an approval, a recorded justification, and customer visibility into staff access to their tenant. That last one is uncomfortable and is what turns a policy claim into a verifiable one.

The architectural consequence

Assume the platform will be compromised and design so that the compromise is bounded and detectable. That means credential scoping, per-tenant separation, thresholds on destructive operations, and audit exported outside the trust boundary — none of which prevents the compromise and all of which change what it costs.

For a platform whose customers are trusting it with access to everything, the ability to describe what an attacker could and could not do is itself a product requirement.