The answer nobody owns

The fourth statement has no owner. Each team can defend its own console: the directory, the campaign and the request clock, the custody of a secret. The sentence underneath, which story grants the verb, and in what state, sits on a sheet that belongs to whoever last edited it. The Billing-Readers row shows the gap. The directory team can see the role. The governance team can see a label that says read. The vault team has nothing to onboard, correctly. The sentence underneath, that the reset would succeed and that Entra wins, has no owner. That absence is the point of the picture.

An answer nobody owns is not an answer. It is a status report waiting to be orphaned.

Three programmes, and the sentence between them

Look at the operating model you already have, not the one a consultancy drew. There is a team, or a function inside a team, accountable for the directory, Conditional Access, and the tenant's role assignments. There is a team accountable for the governance platform, the connectors, and the campaigns. There is a team accountable for the vault, the rotations, and the session recordings. Some organisations fold two of these into one manager. The fold does not create the missing role. It creates a manager with two backlogs and the same gap between them.

Each backlog is real work. Directory hygiene, campaign completion, vault onboarding. Each backlog can be green while the fourth statement is false, stale, or known only to the analyst who joined the row. A connector percentage can rise while disagreement stays high. Ownership is why that warning never becomes a decision. The directory team hears a disagreement as a SailPoint mapping fault. The governance team hears it as an Entra exception to be ticketed back. The vault team hears it as an account that is or is not onboarded. The row waits in the space where each team is correctly not the other team. Waiting is not neutral. The verb keeps succeeding on the description that wins, which is often the description nobody's objective mentions.

Name the sentence so it cannot hide inside a product. For this identity, this verb, this object, this state, this stack is the one that still grants access if the other consoles are closed. It is the whole of what no job description in the three programmes quite contains. Job descriptions contain systems. The answer contains a judgment about systems. Judgments do not fall out of a grid that lists systems down the side and activities across the top. The activity "decide which description wins" is either missing from the grid or assigned to "identity lead" in a way that means coordinate. Coordinate means invite. It does not mean the sentence is yours when the other two teams disagree with it.

This is not a plea for a new department. A department would arrive with a tool preference and become a fourth catalogue. The need is narrower. One named person, for the neighbourhood you already chose, who is accountable for the fourth statement being true next month, and who is allowed to say that the governance platform is behind without opening a programme to replace it. Authority here is verbal and specific. It is the authority to brief the winning description even when the brief embarrasses a coverage metric. Without that, the sheet is a hobby, and hobbies end when the quarter gets loud.

What people call ownership, and what they are pointing at

Ownership gets used for four different things, and the method dies if you accept the wrong one.

Ownership of the system. The directory owner, the platform owner, the vault owner. Necessary, and already staffed. They own whether the console is up, licensed, and backed up. They do not, by that fact, own whether the console's story is the grant. A well-run console can be the losing description. Losing descriptions are still worth storing, and still must not be briefed as the verb.

Ownership of the identity record. A human manager, a sponsor, an application owner in a configuration database. This is the who-cell. It answers who you could call about the account. It does not answer who will say, in the monthly brief, that the account's verb is standing because a synced group still grants it. A sponsor who has never seen the Monday table cannot own the fourth statement. They can own the workload. Those are different calls. Making the sponsor the owner of the sentence, by default, pushes a judgment onto someone who was not given the three stories. They will guess. The guess will favour the stack they have logged into, which is rarely all three.

Ownership of the remediation. The team that will remove the group, rotate the secret, or close the ticket. That team should not be appointed yet. If you hand the fourth statement to the team you hope will fix it, they will rewrite the statement until the fix is small. The vault team will define the problem as onboarding. The governance team will define it as a campaign. The directory team will define it as a Conditional Access gap, including on principals the workload limit cannot see. The definition follows the budget. Hold the line. The owner of the answer is not yet the owner of the change.

Ownership of the brief. The person who will say the sentence to the sponsor, with the count beside it, and will say it again when nothing has changed. This is the ownership the chapter is about. It is closer to a duty than to a platform. It can sit with the identity lead who was asked the original question, if that person will actually read the rows. It can sit with a named analyst, if the lead will not overrule them every time a metric is threatened. It cannot sit with a committee. Committees can endorse a sen tence. They cannot notice that writeback undid it. A name notices. A rota, with a named person on it for the month, can notice. A mailing list cannot.

Write the name in a cell on the sheet, against the neighbourhood rather than against every row, unless a row is so awkward that a second name is honest. "Identity" is not a name. The on-call rotation is not a name unless you also write who had the rotation when the statement was last checked. The same distinction applies to the who-cell of the answer. Weak is a distribution list. Empty is a sheet with no author. Both are findings about the programme, not about the tenant.

Why the answer stays open when the tools are staffed

The reason is dull. The question is cross-stack by nature. The organisation chart is not. Each team can complete its own work and leave the join untouched, and nothing in their objectives goes red. Campaign completion can be a hundred per cent of the rows the platform holds. Vault onboarding can meet its target for accounts that have passwords. Conditional Access can report a high rate for users. The fourth statement can still say, for the row that matters, that an app role the platform never aggregated is standing, and that the vault's silence is expected, and that nobody has briefed it because briefing it would not move any of those three numbers.

Invisible, here, often means invisible to the team whose job is visibility. That is an ownership fact, not only a tooling fact. The prior failure is that no one is paid to be embarrassed by the unmatched pile.

A sponsor may own the who-cell of an agent. They do not automatically own the fourth statement. The exit is still the empty cell. A steering committee does not fill it by putting "own the exit" on a slide.

A name on the sentence, once a month

You are not redesigning the operating model. You are attaching a name to a neighbourhood you can already point at, for a month, with a duty small enough to survive contact with the calendar.

Take the Monday table as it stands. Confirm the neighbourhood is still the one you named, not a quiet expansion into everything the directory can export. At the top of the sheet, write one person as owner of the fourth statements in this neighbourhood. Not a team. A person who can be in the briefing and who can be wrong in public. Under the name, write what they are not taking on. They are not taking the vault backlog, the campaign backlog, or the directory backlog. They are taking the duty to say, for each awkward row, which description wins and what state the verb is in, and to say it again after a month.

Agree the rule of disagreement in writing, in a few lines, with the three system owners. The rule is the one you already use: the description that still grants the verb, if the other consoles are ignored, wins the row. Writing the rule down feels redundant until the first argument. The argument will come from a team whose metric the winning description offends. The written rule is what the owner of the sentence points at, so the argument is about the rule and not about their personality. If the system owners will not agree the rule, that refusal is the finding. You have learned that the organisation prefers three healthy metrics to one true sentence. Brief that. Do not soften it into a roadmap for an identity fabric.

The cadence is monthly, and it is the only cadence for this neighbourhood. Once in the month, the named person reads the awkward rows, updates the winning description if the estate changed, and records "nothing changed" where nothing changed. A cadence owned by a calendar invite with no name will be declined. A cadence owned by a name will at least produce an absence you can see, if they do not do it. Visible absence is better than a green programme. It tells the sponsor the answer has gone stale.

Decide where the sheet lives, and who else may edit the fourth statement. One editor of that column, the named person, plus a deputy they name. Other people may add evidence pointers, object identifiers, and extracts. They may not tidy the winning description to match a campaign result. Tidying is how the catalogue takes the sentence back. If the sheet sits in a workspace the governance platform's operators control alone, the column will start to match the platform, because that is what those operators are paid to make true. Store it where the named person can refuse the tidy. The owner of the answer is the owner of that permission.

Handle the who-cell of each identity separately from the owner of the answer. Where the who-cell is empty, the named person does not become the owner of the account. They become the person who reports that the who-cell is empty. Filling it with themselves would repeat the false-owner problem, a guess standing in for a workload. Empty stays empty.

For workloads and agents, the owner of the answer will not fill the empty exit. They will keep Get-MgServicePrincipalAppRoleAssignment, or the resource access list, as the source of the permission, not the sponsor's memory. A sponsor who disagrees with the permission list loses, unless the list is wrong. The named person is there to stop the permission and the who collapsing into a reassurance.

Do this for one neighbourhood only. An owner of "the enterprise answer" is a title without a table. You will know the duty has been inflated if the name at the top of the sheet cannot point at the systems they actually read. If they cannot, you have appointed a figurehead, and figureheads are how answers stay open with a signature underneath.

When the owner of a stack is also in the room

Sometimes the honest name is a person who already owns one of the three systems. The directory lead is the only one who will actually read app role assignments. That can work, and it can fail in a specific way. The failure is not corruption. It is gravity. A person who spends their days inside one console will see the other two stories as inputs to their console, not as rivals to it. The fourth statement then drifts toward the console they can change.

If the named person owns a stack, write the conflict on the same line as the name. They own the directory, and they own the duty to say when the directory is the losing description. The second half is the part that will be tested the first time a local admin account, absent from Entra, is the winning story, or the first time a governance entitlement is a stale model and they are tempted to brief it as risk because risk justifies their backlog. The owner has to keep stale model separate from a verb that would succeed, even when their own team would benefit from blurring it. A deputy from outside that team is the practical check. Once a month the deputy asks which rows the winning description embarrasses the owner's home metric. Opposition is not the job. If the answer is none, month after month, you do not have harmony. You have gravity.

The vault lead is the hardest version of this, because the vault is proud of static passwords it holds. A vault lead who owns the fourth statement must be willing to say "we have custody of a standing admin, and custody is not a change of state." If they cannot say that in the briefing, they can still own the vault. They should not own the sentence. Split the duties rather than asking them to betray their programme in public without support. The support is the written rule, agreed beforehand, so the sentence is the rule speaking and not a colleague attacking a vault project that took two years.

None of this requires one reporting line over the three teams. A single executive can still receive three green packs and never see the row. The execut ive owns a portfolio. The named person owns the sentence. If they want the duty, they do the read. Their name on the sheet, with the judgment delegated to a reconciled pack, makes the answer nobody's again one layer up. Typing may be delegated. The judgment may not.

The on-premises directory is a fourth voice with a thinner owner

Sync sometimes makes Active Directory the description that wins. Ownership has to follow that admission. The cloud team's name on the sheet does not own the sync rule if they cannot see the on-premises directory. The identity lead in a cloud-first organisation often cannot. The people who can are running a directory the cloud programme has described as residual.

Residual is an ownership dodge. If the chain column says synced, and the verb succeeds with no new approval, the winning description is not Entra's group object alone. Put the extra name on those rows only. A second name for every row is how the duty dissolves into a working group. A second name where the grant is reasserted from another directory is a fact about the chain. Ask that person to confirm the rule is still enabled. Record the confirmation in the evidence pointer. If they will not confirm, the state of the row includes an unknown, and the owner of the answer reports the unknown rather than assuming the sync was switched off because a project plan said it would be. Project plans are full of directories that were going to be decommissioned.

The team that cleans a cloud group and the team that owns the on-premises source may both believe they finished. The owner of the fourth statement is the person who checks, on the next cycle, which side reappeared. That check is the duty, and it is small. Skipping it because both teams reported completion is how the drift survives two green tickets. The review, or the ticket, saw the row and cleaned the copy that does not win.

The monthly brief

The brief is a page. Neighbourhood. Awkward rows re-read. How many winning descriptions are not the governance platform. How many of those are standing. What nothing-changed means this month. Who the owner is, and who the deputy is. The line that keeps the brief from being swallowed is the nothing-changed line. Programmes hate it. A month with no change looks like a month with no work, and the owner will be pushed to list activity instead. Activity in the stacks is allowed as context. It does not replace the sentence about the verb. If the campaign closed two hundred items and the winning descriptions are where they were, say both. An owner who leads with the two hundred has been captured by the metric.

Sponsors will ask whose fault the open answer is. Fault is an operating model aimed at consoles. The owner is not there to prosecute a predecessor. They are there so a completed programme is not mistaken for a closed question. The monthly sentence is a record.

A workshop that adds a row called "authoritative access statement" and assigns it to the identity lead has produced a grid, unless the room leaves with a neighbourhood and a monthly duty. If a council must exist, the sheet arrives unedited and the named person speaks to the rows. A target for the percentage of rows with an agreed description will be met by pushing awkward rows out of the denominator. A duty to say what is true does not need another coverage percentage.

One analyst who understands the sheet and stays late is a single point of failure dressed as commitment. The deputy is not optional. Name them while that person is still here. Write the rule down so the deputy does not have to inherit a style. Make the deputy say the sentence once in the room before you need them. That is the whole of succession for this duty.

The owner is not a second reviewer in the campaign sense. They do not click approve on entitlements. Their read is the join. If a cell the table should already hold is missing, the owner's job is to say missing, not to invent a value so the pack looks full.

The rows owe the owner a stable identifier. If the row is keyed on a display name, the owner spends the month arguing identity rather than granting. A reorganisation that changes team names will try to rewrite the sheet. Let it rewrite headers. Do not let it merge rows because two names now report to the same director. The director is not the object.

The owner also owes the sponsor a refusal. Some months the right brief is that the answer is still open because a removal was made in the stack that does not win. Give the credit for the change that was actually made, and keep the verb on the table. An owner who trades the verb away to keep a relationship has become a diplomat. Prefer a slightly awkward monthly sentence to a warm relationship and a false close.

If you cannot name the owner without using a team word, the duty has not started. If the person you want to name has no time to re-read the awkward rows in the month, they are not the owner. They are a sponsor of the sheet. Sponsors are welcome. They are not the duty.