## TL;DR
Export every distinct job title from the HRIS, merge the variants into canonical titles, and write down the access set each title gets: groups, apps, licenses. That table becomes the source of truth for provisioning, so a new hire's title determines their access instead of the ticket author's memory.

## Steps
1. Export the distinct job titles for active employees from the HRIS. Expected: a deduplicated list, usually 50 to 200 rows for a mid-size company.
2. Normalize variants into canonical titles: Senior Engineer and Sr. Engineer become one row. Expected: a mapping table from every variant to its canonical title.
3. For each canonical title, list the access it gets: AD or Entra groups, app licenses, shared mailboxes, VPN or device policies. Expected: one row per title with its default access list, reviewed by the department head.
4. Name an owner per title, usually the department head, to approve exceptions. Expected: a named person, not a team alias, recorded next to each row.
5. Store the mapping where provisioning reads it: a shared sheet for manual shops, or an HRIS custom field that Okta or Entra lifecycle rules consume. Expected: a new-hire ticket can auto-populate access from the title field.
6. Schedule a quarterly review. Expected: a calendar task for the access owner; new titles appear after every reorg.

## Use this when
- New hires with the same title get different access
- Managers ask what access a given title comes with
- Building joiner automation that reads HR fields
- Auditors ask how access decisions are made

## Not for this skill when
- Approving a single exception (use the exception process, then update the table)
- Titles change weekly in a tiny startup (too unstable to map; revisit at 50 people)
- Regulated role segregation (mapping helps, but you still need formal access reviews)

## Compatibility
- Any HRIS with a title export: Workday, BambooHR, Rippling, spreadsheets
- Okta lifecycle management or Entra ID lifecycle workflows for automation

## Variants
### Title changes but the role does not
Keep the canonical role and its access set until the actual access changes; retitling alone does not change provisioning.
### Acquired company has its own titles
Map the acquired titles onto your canonical roles rather than duplicating the whole table.

## Why it happens
Titles live in HR, access lives in tickets, and nothing connects the two, so every hire becomes a custom order assembled from memory. The mapping table is that connection.

## Edge cases
- Contractors with employee titles: keep a separate contractor role; never mix the rows.
- Matrixed employees with two titles: assign both roles and review quarterly.
- Union or regulated titles with legal access constraints: the table documents them, it does not override them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pwK0GjcLCxNBW2fZOh59NQ