IAM Chapter 8, Part 3: The Border Is the Person

Part of the IAM study series.

IAM isn't supporting export control. IAM is the enforcement mechanism.

Whose call is what: the legal determination (what is controlled, under which regime, at what level) belongs to the export control function. Your job is to make their determination enforceable and provable. Teams get into trouble trying to encode judgment they don't own.

1. Deemed Export: The Sentence That Makes This an IAM Problem

One room, one building, one country, and nobody travels. A US person shows controlled technical data to a non-US person. No border was crossed and nothing was shipped, but an export occurred: a deemed export, to that person's country of nationality.

So every one of these is an export: a SharePoint permission, a PLM entitlement, a screen share in a design review. The regimes all control who may receive technical data, not merely who may ship a thing.

2. Why It Had to Be ABAC, and Where It's Enforced

The policy evaluates the person (nationality, licence coverage, programme assignment) against the document (classification, programme, jurisdiction/ECCN), at the moment of access. A role can't express a rule whose answer varies per person and per document. That's Chapter 6's ABAC, and Part 1's need-to-know.

There are two enforcement points, and you need both:

3. The Licence Expires on 31 March and Nobody Renews It

• What should happen: loud, disruptive, safe. Access is denied, something breaks, someone escalates, and it gets renewed.
• What usually happens: silence. Every file opened after 31 March is an unlicensed export, with no error, no ticket, and no alert. It's found in September, and now you have a disclosure window: reconstruct who touched what, under pressure.

Why it stays silent: the expiry date lives in a spreadsheet, not an attribute; the grant was a permanent group membership; and the policy fails open when it can't check.

The design that fixes it: the licence record lives where the policy engine can read it (a PIP, Chapter 6); the grant is bound to the licence end date, not open-ended (Chapter 7); and the policy fails closed: if licence status can't be determined, deny. Most systems fail open, because availability wins design reviews and nobody in the room represents the regulator.

Warn at 90 days or more, not seven. A government licensing authority takes weeks to months. Discovering the problem on 31 March means you can't fix it on 31 March.

And when access does cut, the pressure begins. A programme is blocked, a delivery is at risk, someone senior is calling. That emergency exception is itself an unlicensed export. If an emergency path exists at all, the approver is the export control officer: not IT, not the programme director. Only one of the three carries the liability.

4. Where These Programmes Actually Fail, and It Isn't the Policy Engine

A flawless engine with nothing to evaluate against is worthless, and both inputs are usually missing:

• Nationality? It's sensitive personal data, people hold several, and HR often has no reliable field. In several European jurisdictions, collecting and processing it needs a legal basis, a DPIA and a works council conversation before you can begin. Obtaining the attribute is frequently the longest item in the programme.
• Classification? 400,000 documents in SharePoint carry no export label at all.

The pragmatic answer on classification: stop trying to label per document. Treat the whole container as controlled (the site, the library, the PLM workspace) and default-deny entry. It's coarse and over-restrictive, and it ships this year rather than never. Refine inward afterwards.

When even that isn't enough: segregate at infrastructure level, with a separate tenant, domain or environment for controlled programmes. It's expensive, genuinely bad for collaboration, and deterministic, which is why most aerospace companies run some of it anyway.

5. Audit Evidence: Enforcement Working Doesn't Produce It

What your systems hold is one frame. Active Directory knows who is in the group right now. It's a state machine: the previous frame was overwritten and nothing kept it.

What the auditor asks for is the whole reel: "Show me everyone who had access to this item during 2024, under which authorisation, and evidence the authorisation was valid on each of those dates."

Retention is two different requirements. The SIEM keeps hot data for about 90 days. The regulator wants five years or more (ITAR recordkeeping; programme data longer). Different requirements, funded by different people, and nobody finds the gap until the request arrives.

Tamper-evidence. If an administrator can edit the log, the log proves nothing. Part 2's test (can this account erase its own tracks?) lands exactly here.

Auditors want a reproducible report, not raw logs. If the answer takes an engineer three days of hand-written queries, that is itself a finding: a control nobody can report on is a control nobody is monitoring.

Decide the evidence design at the same time as the control. Enforcement can be retrofitted; last year's logs can't be generated.

What Breaks in Practice

🔴 CHECKPOINT: Study Notes

← Previous: Blast Radius · Back to the series start · Next: Shrink the Zone →