Identity & Access Governance

The Principle

‍

Identity is the new perimeter. In an organization that serves healthcare systems, government agencies, AI platforms, and research institutions — across time zones, languages, and classification levels — the question is never "are you on the network?" The question is: "who are you, what do you need, and can we verify both right now?"

Ariana Nexus governs access to every system, dataset, and application through a centralized identity framework. No access is inherited. No access is permanent. No access is assumed. Every identity — whether an employee in Arlington, a guest collaborator in London, or a future Human Intelligence Collective interpreter in Sacramento — is authenticated, authorized, scoped, and monitored through a single, auditable control plane.

‍

Governance Architecture

The Identity Lifecycle

Ariana Nexus manages identities across their full lifecycle — from provisioning through active use to deprovisioning — ensuring that access rights reflect current roles, not historical accumulation.

Provisioning: When a new identity is created (employee, guest, or service account), it is assigned a role with predefined permissions based on job function. No identity is provisioned with administrative or elevated access by default. All provisioning decisions are documented and approved by an authorized administrator.

Active Management: During the active lifecycle, identities are subject to continuous policy enforcement — MFA at every sign-in, Conditional Access evaluation at every session, and compliance verification at every device. Access rights are reviewed periodically to ensure alignment with current responsibilities.

Modification: When an individual's role changes — promotion, lateral move, project reassignment — their access rights are updated to reflect the new role. Prior permissions that are no longer required are revoked. This prevents privilege creep, one of the most common and exploitable security gaps in organizational environments.

Deprovisioning: When an individual leaves the organization or an engagement ends, their identity is disabled within twenty-four (24) hours. All active sessions are terminated. Device access is revoked. SharePoint and Teams permissions are removed. For guest identities, access expiration is enforced automatically based on the engagement timeline.

Audit: Every provisioning, modification, and deprovisioning event is logged in Microsoft Entra ID audit logs with timestamps, the administrator who performed the action, and the specific changes made. These logs are retained in accordance with Ariana Nexus's data retention policies and are available for compliance reporting and incident investigation.

‍

Identity Tiers

‍

Ariana Nexus operates a tiered identity model that separates access rights by function, sensitivity, and trust level. This ensures that every individual has exactly the access required for their role — no more, no less.

‍

Tier 1: Administrative Identities

Administrative identities have elevated privileges over the Microsoft 365 environment, including the ability to manage users, configure security policies, and access audit logs. Due to the sensitivity of these privileges:

• Administrative accounts are held by a strictly limited number of authorized personnel.
• Administrative actions require Multi-Factor Authentication with phishing-resistant methods.
• Administrative sessions are time-limited and subject to enhanced monitoring.
• Break-glass (emergency access) accounts are maintained for disaster recovery scenarios, secured with offline credentials, and audited for any use.
• Ariana Nexus is evaluating Microsoft Entra Privileged Identity Management (PIM) for just-in-time, approval-based administrative access elevation, planned for deployment in the 2026–2027 hardening phase.

Tier 2: Standard Employee Identities

Standard employee identities represent the core workforce of Ariana Nexus — full-time employees who access Microsoft 365 services (Exchange, SharePoint, Teams, OneDrive) for daily operations.

• Every employee identity is provisioned with role-based permissions scoped to their function.
• MFA is required for all sign-ins, with no exceptions.
• Conditional Access policies evaluate device compliance, location, sign-in risk, and application sensitivity at every session.
• Employees are assigned to Security Groups in Microsoft Entra ID that govern access to specific SharePoint sites, Teams channels, and shared resources. Group membership is reviewed quarterly.
• Employees do not have administrative access to the Microsoft 365 tenant unless explicitly elevated under Tier 1 protocols.

Tier 3: External Collaborator Identities (Guest Access)

Ariana Nexus collaborates with clients, institutional partners, and external advisors through Microsoft Entra External Identities (B2B guest access). Guest identities are subject to the following controls:

• Guest accounts are provisioned only upon documented business need and sponsor approval by an authorized Ariana Nexus employee.
• Guest access is scoped to specific SharePoint sites, Teams channels, or resources designated for the engagement. Guests cannot browse, discover, or access resources outside their assigned scope.
• MFA is required for all guest sign-ins, enforced through Conditional Access policies that apply to external identities.
• Guest accounts are assigned an expiration date aligned with the engagement timeline. Expired guest accounts are automatically disabled.
• Guest access is reviewed at least quarterly. Stale or unnecessary guest accounts are removed.
• Guest identities do not have access to internal email, internal Teams channels, administrative consoles, or any resource designated as internal-only.

Tier 4: Human Intelligence Collective Identities (Planned)

As the Human Intelligence Collective scales — incorporating interpreters, translators, subject-matter experts, and independent contractors — Ariana Nexus will provision a dedicated identity tier with the following characteristics:

• Collective member identities provisioned in Microsoft Entra ID with role-specific permissions scoped to their engagement (e.g., access to specific annotation pipelines, interpretation scheduling platforms, or quality assurance workflows).
• MFA required for all access.
• Device compliance enforced via Intune policies, including managed device requirements for members accessing PHI or CUI.
• Time-bound access aligned with contract duration, with automatic deprovisioning upon engagement completion.
• Segregation of Collective member identities from employee identities and administrative identities, ensuring that the scaling of the workforce does not expand the organizational attack surface.

Target deployment: Q4 2026 – Q1 2027, aligned with the hiring plan for 50+ interpreters and 10 project managers outlined in the Ariana Nexus growth strategy.

‍

Microsoft Entra ID — The Central Identity Plane

‍

All identity and access governance at Ariana Nexus is centralized in Microsoft Entra ID (formerly Azure Active Directory), the cloud-native identity platform included in Microsoft 365 Business Premium. Entra ID serves as the single source of truth for all authentication, authorization, and access policy enforcement.

Multi-Factor Authentication (MFA)

MFA is enforced for 100% of identities — employees, administrators, and guests — with no exceptions and no bypass paths.

Supported MFA methods:

• Microsoft Authenticator push notifications (primary method)
• FIDO2 security keys (available for administrative identities)
• SMS and voice verification (fallback methods, with planned deprecation in favor of phishing-resistant methods)

Enforcement scope:

• All interactive sign-ins to Microsoft 365 services
• All access to SharePoint, Teams, OneDrive, Exchange Online, and the Microsoft 365 admin center
• All guest access sessions
• All Conditional Access policy evaluations

Conditional Access

Conditional Access policies are the policy engine that enforces Zero Trust access decisions at every session. Ariana Nexus has deployed the following Conditional Access policies:

Currently Enforced:

• Require MFA for all users — Every sign-in, every session, every identity tier.
• Block sign-ins from untrusted locations — Sign-ins from countries or IP ranges outside of approved geographies are blocked or escalated to step-up verification.
• Require compliant device — Access from non-compliant devices (per Intune compliance policies) is blocked or restricted to web-only, read-only access.
• Block legacy authentication — Legacy authentication protocols (POP, IMAP, SMTP AUTH) that do not support MFA are blocked, eliminating a common attack vector.
• Sign-in risk policy — Microsoft Entra ID Protection evaluates sign-in risk in real time (based on IP reputation, atypical travel, credential exposure, and anonymous access). High-risk sign-ins are blocked. Medium-risk sign-ins require step-up MFA.
• Session controls — Enforced session timeouts and re-authentication requirements for sensitive application

Roadmap:‍

• ‍App-level Conditional Access — Granular policies per application (e.g., stricter controls for SharePoint sites containing PHI or CUI). Target: Q3 2026.
• Continuous Access Evaluation (CAE) — Real-time enforcement of policy changes and session revocation without waiting for token expiration. Target: Evaluated with E5 upgrade path.

Role-Based Access Control (RBAC)

Ariana Nexus implements RBAC through Microsoft Entra ID roles and Security Groups:

• Entra ID Roles: Global Administrator (strictly limited), User Administrator, SharePoint Administrator, Teams Administrator, Security Reader, and Compliance Administrator roles are assigned based on job function.
• Security Groups: Used to govern access to SharePoint sites, Teams channels, shared mailboxes, and applications. Group membership determines what resources an identity can access.
• Dynamic Groups (Planned): Evaluation of Microsoft Entra dynamic group membership, which automatically assigns identities to groups based on attributes (department, job title, engagement type), reducing manual provisioning errors. Target: Q4 2026.

Access Reviews

Ariana Nexus conducts periodic access reviews to ensure that permissions remain aligned with current roles:

• Quarterly Reviews: All guest accounts and external collaborator access reviewed every ninety (90) days. Stale accounts removed.
• Semi-Annual Reviews: All employee Security Group memberships reviewed every six (6) months. Permissions adjusted for role changes.
• Annual Reviews: All administrative role assignments reviewed annually. Privileged access re-justified or revoked.
• Automated Access Reviews (Planned): Ariana Nexus is evaluating Microsoft Entra Access Reviews for automated review workflows with manager attestation and auto-remediation of unattested access. Target: 2027, aligned with E5 or Entra ID Governance license evaluation.
  ‍

Credential Protection

Password Policy

Ariana Nexus enforces the following password standards, aligned with NIST SP 800-63B Digital Identity Guidelines:

• Minimum password length: fourteen (14) characters.
• Password complexity: not mandated (per NIST 800-63B guidance, which recommends length over complexity). Commonly compromised passwords are blocked using Microsoft Entra Password Protection.
• Password expiration: not enforced for standard accounts (per NIST 800-63B, which recommends against periodic password rotation absent evidence of compromise). Passwords are required to change immediately upon evidence of compromise.
• Self-service password reset (SSPR) enabled with MFA verification, allowing users to reset credentials securely without administrative intervention.

Passwordless Authentication (Roadmap)

Ariana Nexus is evaluating the transition to passwordless authentication methods, which eliminate the primary attack vector (password compromise) entirely:

• Microsoft Authenticator passwordless sign-in — Users approve sign-in requests via the Authenticator app without entering a password. Target evaluation: Q4 2026.
• FIDO2 security keys — Hardware-based authentication for administrative and high-security identities. Target evaluation: Q4 2026.
• Windows Hello for Business — Biometric or PIN-based sign-in tied to the device TPM. Applicable when Ariana Nexus deploys managed Windows devices at scale. Target: 2027.
  ‍

Alignment with Security and Compliance Frameworks

‍

NIST SP 800-207 (Zero Trust) — Identity as the primary security perimeter. ‍

Status: Implemented — Entra ID as central identity plane.

NIST SP 800-63B (Digital Identity) — Authentication assurance levels, password guidance.

‍Status: Aligned — MFA enforced, NIST password policy adopted.

NIST SP 800-171 Rev. 2 / Rev. 3 — Access Control family (AC-1 through AC-22).

‍Status: Aligned — RBAC, MFA, least privilege enforced; formal SSP in development (Rev. 2 current for DoD/CMMC; Rev. 3 transition planned per DoD rulemaking).

HIPAA Security Rule (45 CFR § 164.312) — Access controls, unique user identification, automatic logoff, encryption.

‍Status: Aligned — MFA, unique identities, session controls, Purview encryption.

CJIS Security Policy — Advanced authentication for CUI access.

‍Status: Roadmap — MFA satisfies requirement; formal CJIS assessment planned (2027).

CMMC Level 2 — Access Control (AC), Identification & Authentication (IA) domains.

‍Status: Roadmap (2027) — Controls implemented, certification planned.

ISO 27001:2022 — Annex A.9 — Access Control.

‍Status: Roadmap (2027) — Controls aligned, formal certification planned.

SOC 2 (Trust Services Criteria) — CC6 — Logical and Physical Access Controls.

‍Status: Roadmap (2026–2027) — Controls operational, audit engagement planned.

EU AI Act — Access controls for high-risk AI system data.

‍Status: Aligned — RBAC governs AI Data Factory access.

GDPR / UK GDPR — Article 32 — Security of processing.

‍Status: Aligned — MFA, access controls, audit logging implemented.

‍

Sector-Specific Identity Governance

‍

Healthcare (HIPAA)

When Ariana Nexus engages in work involving Protected Health Information, identity governance ensures that only credentialed personnel — authenticated through MFA, operating on compliant devices, and assigned to the specific engagement — can access PHI. SharePoint sites containing PHI are isolated with dedicated Security Groups. Guest access to PHI environments requires an executed Business Associate Agreement and sponsor approval. Audit logs capture every access event for HIPAA compliance reporting.

Government (CUI / NIST 800-171)

For government engagements involving Controlled Unclassified Information, identity governance implements the Access Control (AC) and Identification and Authentication (IA) families of NIST SP 800-171. CUI environments are segregated in dedicated SharePoint site collections with restricted Security Groups. Access is limited to U.S.-based personnel with verified need-to-know. Guest access to CUI environments is prohibited unless explicitly authorized by the government contracting authority.

AI & Technology (AI Data Factory)

The AI Data Factory processes linguistic, cultural, and annotation data for AI model training and validation. Identity governance ensures that HITL reviewers, annotators, and quality assurance personnel are authenticated individually, their access is scoped to only the datasets and pipelines assigned to their task, and their sessions are logged for data provenance and audit trail purposes.

Research & Education

Academic collaborations involving sensitive research data are governed through time-bound guest identities with MFA enforcement, scoped access to designated SharePoint libraries, and automatic deprovisioning upon project completion.

‍

What Identity Governance Means for Our Clients and Partners

‍

For procurement officers: Ariana Nexus can demonstrate, through Entra ID audit logs and Conditional Access reports, exactly who accessed your data, when, from where, on what device, and under what policy conditions.

For CISOs: Our identity architecture is built on Microsoft Entra ID — a Gartner Magic Quadrant Leader in Access Management — with native integration across MFA, Conditional Access, device compliance, and DLP. There are no gaps between identity verification and data protection.

For compliance officers: Our RBAC model, access review cadence, and audit logging satisfy the access control requirements of HIPAA, NIST SP 800-171, SOC 2, and ISO 27001. We can produce access reports on demand for your audit teams.

For government contracting officers: Our identity governance separates CUI-accessible identities from general employee identities, enforces MFA at the authentication assurance level required by NIST SP 800-171 and CJIS, and maintains audit trails that satisfy DFARS 252.204-7012 reporting requirements.

If your organization requires identity architecture documentation, Conditional Access policy evidence, or an access governance briefing, contact trust@ariananexus.com or +1 (202) 771-0224.

‍

Maturity Roadmap

‍

Current (2026) — Operational

MFA enforced for all identities; Conditional Access active; RBAC with Security Groups; Guest access governance; Quarterly access reviews.

Hardening (Q3–Q4 2026) — In Planning

Tier 4 Collective identity provisioning; App-level Conditional Access; Dynamic Groups evaluation; Passwordless authentication pilot.

Certification (2027) — Planned

Privileged Identity Management (PIM) deployment; Automated Access Reviews; SOC 2 Type II audit (CC6); ISO 27001 Annex A.9 certification; CMMC Level 2 IA domain.

Advanced (2028) — Planned

Continuous Access Evaluation (CAE); Decentralized identity evaluation for Collective members; FedRAMP identity requirements; FIDO2 deployment at scale.

Autonomous (2030+) — Vision

AI-driven identity risk scoring; Behavioral biometric authentication evaluation; Identity governance integration with client security architectures.

‍

Limitation of Liability and Disclaimers

‍

No Guarantee of Unauthorized Access Prevention. Ariana Nexus implements commercially reasonable identity and access controls aligned with recognized industry frameworks. However, no identity governance system can guarantee absolute prevention of unauthorized access. Ariana Nexus expressly disclaims any warranty or guarantee that its identity systems will prevent all unauthorized access, credential compromise, or identity-based attacks.

Framework Alignment vs. Certification. Where this page states that Ariana Nexus is "aligned" with a framework, this means controls are designed in accordance with the framework's principles but formal third-party certification has not been obtained unless explicitly stated. Alignment is not certification.

Roadmap Items. The maturity roadmap reflects current plans and intentions as of the Effective Date. Roadmap items are forward-looking statements, not commitments or guarantees. Ariana Nexus reserves the right to modify, defer, or reprioritize roadmap items at its sole discretion. No client, partner, or third party may rely on roadmap items as binding commitments.

Third-Party Platform Dependency. Ariana Nexus's identity governance relies on the Microsoft Entra ID platform and Microsoft 365 Business Premium services. Ariana Nexus does not control the availability, security, or functionality of Microsoft's identity platform and disclaims liability for any incident attributable to the Microsoft platform.

Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ARIANA NEXUS'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATED TO IDENTITY AND ACCESS GOVERNANCE SHALL NOT EXCEED THE AMOUNTS SET FORTH IN THE APPLICABLE ENGAGEMENT AGREEMENT, OR, WHERE NO ENGAGEMENT AGREEMENT EXISTS, ONE HUNDRED DOLLARS ($100). ARIANA NEXUS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING FROM OR RELATED TO ANY UNAUTHORIZED ACCESS INCIDENT. NOTHING IN THIS SECTION SHALL LIMIT OR EXCLUDE ARIANA NEXUS'S LIABILITY FOR: (A) FRAUD OR FRAUDULENT MISREPRESENTATION; (B) DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE; OR (C) ANY OTHER LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED BY APPLICABLE LAW, INCLUDING BUT NOT LIMITED TO LIABILITY UNDER THE UK UNFAIR CONTRACT TERMS ACT 1977, THE UK CONSUMER RIGHTS ACT 2015, OR GDPR.

Dispute Resolution. Any dispute arising out of or relating to this page shall be subject to the dispute resolution provisions in the Terms of Use, Section 18.