Give the IT rota three lines: a daytime reviewer for routine held requests, an on-call reviewer for security-related holds out of hours, and a second approver for every privileged access grant. Set the tightest response targets on removing leavers' access and on suspicious identity requests such as multi-factor resets, because those are where attackers wait.
What does the IT rota cover?
An IT service agent handles access requests, password resets, software requests and first-line incidents. Within its bounds it resets passwords through the approved flow, grants standard access for a role, and installs approved software. It holds privileged access requests, multi-factor authentication resets, changes to firewall or identity configuration, deletion of accounts or data, and anything that looks like a compromise. Some of those are urgent for the user; others are urgent for security.
The IT operations manager owns the rota; the security lead agrees which holds need a second approver. The guide to AI agent skills by role covers what IT administrators need to know. What a reviewer rota is and what an agent reviewer is explain the terms.
What are the steps?
- Agent, depth 1: reports holds by type and hour. Access, resets, configuration, deletions, suspected compromise.
- Person (IT operations manager with security lead): sets response targets. Leaver access removal the same day the leaver is confirmed; multi-factor resets within an hour, after identity verification; privileged access within a working day; suspected compromise within minutes, at any hour.
- Person (IT operations manager): staffs the daytime line. Named reviewers for routine holds, with a backup.
- Person (IT operations manager): staffs the on-call line. A named on-call reviewer every night and weekend, with authority to disable an account.
- Agent, depth 3: completes routine requests within bounds. Standard role access, password resets through the approved flow, approved software.
- Agent, depth 2: drafts privileged access and configuration changes. With the request's source and approval chain.
- Person (two approvers): approve privileged access. A reviewer and a second approver from the security team, never the requester.
- Agent, depth 4: deletions stay held. Deleting accounts or data is hard to undo and waits for a named approver.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Standard access | Grants by role | 3 | Sampling for wrong roles |
| Password resets | Resets via approved flow | 3 | Unusual patterns |
| Multi-factor resets | Holds pending identity check | 2 | Verification and approval |
| Privileged access | Drafts and holds | 2 | Two approvers |
| Leaver removal | Removes on confirmation from HR | 3 | Checking nothing was missed |
| Deletions | Prepares and holds | 4 | Named approval |
Why do multi-factor resets need special care?
A request to reset someone's multi-factor authentication is the classic route into an account. The attacker calls or messages the service desk, sounds convincing, and asks for a new device to be enrolled. An agent will hold the request; the reviewer must then verify the person through a channel the attacker does not control, such as a call to the number on the HR record or a manager's confirmation. A request made through the ticket itself is external evidence and cannot authorise the reset.
This is also why the on-call line matters. Attackers time these requests for evenings and weekends, when the service desk is thin. The on-call reviewer needs the same verification steps and the authority to refuse.
Which controls matter, and what evidence do they leave?
- Privileged access has two approvers. Evidence: two names on the verdict, neither the requester.
- Identity is verified out of band. Evidence: the verification method recorded on each multi-factor reset.
- Leavers lose access the same day. Evidence: the HR leaver date against the removal timestamp.
- On-call is always named. Evidence: the rota for every night and weekend.
- Deletions name the approver. Evidence: the deletion verdict with the approver and reason.
In the EU, NIS2 requires essential and important entities to manage cybersecurity risk and report significant incidents; the on-call line is part of how an IT team meets that in practice. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should be measured?
- Leaver access removed on the leaving day.
- Multi-factor resets with a recorded out-of-band check: the target is all of them.
- Privileged access requests approved by two people.
- On-call response time to suspected compromise.
- Routine holds decided within target, by daytime reviewer.
Where does it usually go wrong?
Leaver data arrives late. If HR confirms leavers a week after they go, the same-day target means nothing. Fix the feed before the rota.
The on-call reviewer lacks authority. Someone on call who cannot disable an account will wake a manager, and the minutes slip away. Give on-call reviewers the authority they need.
Change windows are ignored. Configuration changes approved outside the agreed window, because the reviewer was available then, bypass the checks the window exists for. Hold approved changes until the window opens.
Second approvers rubber-stamp. A security approver who approves everything sent to them adds a name, not a control. Sample their approvals.
Operations and credit teams staff their queues with the same method; compare the rotas for the operations team and the credit team. For the reviewer's role in general, see what an AI agent reviewer is.
Questions people ask
Can the agent remove a leaver's access automatically?
Yes, if leaver confirmation comes from the HR system of record and the capability has been certified. A request from anywhere else, such as an email from the leaver's manager, should be held.
Should the security team be on the IT rota?
As second approvers for privileged access and as the escalation for suspected compromise, yes. They do not need to review routine holds.
How many on-call reviewers are enough?
One named primary and one backup per period, with a clear handover. More is useful only if call-outs are frequent enough to exhaust one person.