Agent WranglersScope and ownership Required
Give every duty one named owner
Give every duty, control and register one named person as owner and one as deputy. A team name is not an owner.
How to do it
Store owners as staff IDs from your identity provider. When someone leaves, the leaving checklist moves their duties before the account closes. The owner keeps the entry true and answers the auditor.
How to check
A script compares every owner and deputy in the registers with the active users in the identity provider. It fails on any name that is missing or disabled.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/scope-and-ownership/named-owners.