From nothing to business as usual: a shared identity service

Every application was wiring up its own identity connections. The answer was a shared service, but nobody had a way to adopt it.

The problem

A large UK public sector organisation was paying for the same work again and again. Every application built its own connections to identity providers: duplicated effort, duplicated risk, uneven assurance and slow onboarding whenever a new identity source was added.

A shared identity service would let applications integrate once and get federated identity, central policy enforcement and consistent assurance. The technology was being built, but there was no onboarding process, no agreed scope and no repeatable way for teams to adopt it. We were brought in to run product management for the service, then to take it to business as usual without depending on any one person.

Our approach

We designed an onboarding process from scratch, with clear stages, entry and exit criteria, time-boxed testing and a single front door, then refined it with real applications rather than in theory.

We set out the service scope and a shared responsibility model, drawing clean lines between what the service owns, what it supports and what stays with application teams, the platform and identity providers. Security assurance ran alongside onboarding instead of being added at the end.

We kept capability claims to what had been tested, which kept the service credible with security and architecture stakeholders. We kept the external delivery partner accountable for outcomes, not activity. Once the service was ready, we made the case for running it as a service rather than a project that never ends.

The outcome

A live, standardised identity service with attribute-based access control built and tested, a repeatable onboarding process and a signed-off technical architecture. The service went from greenfield to business as usual in about 18 months. A full handover suite means it doesn’t rely on any one individual.