When a role is assigned, what happens to existing access for that user?

• A. The user loses all previous access permissions.
• B. The user keeps their existing access without changes.
• C. The user acquires new access and existing access rolls up into the role.
• D. The access is evaluated and permissions are reset.

Answer: (C)

When a role is assigned to a user, the process often involves the consolidation and integration of permissions. This means that the user acquires new access based on the predefined permissions associated with that role, while still retaining their existing access. The rationale behind this approach is that roles are designed to encapsulate a set of permissions typically required for a specific job function or responsibility within an organization.

Thus, when a user is assigned a role, their existing permissions aren't discarded; instead, these permissions are integrated with the new role permissions through a mechanism often called "roll-up." This allows users to maintain continuity in their access rights while receiving additional permissions that may be needed for their roles. It ensures that users have the necessary access to perform their tasks effectively while aligning with the broader organization’s access management practices.

The idea of retaining existing access while acquiring new permissions is crucial in identity governance and helps to prevent disruptions in user productivity and workflow. It means that roles serve as a way to enhance and streamline user access rather than replace or strip away previously granted access rights. This integrated approach allows organizations to achieve better access control through well-defined roles without inadvertently causing access issues for users.