Tools & Access
Every account a person can hold lives in this one table. It is deliberately the single map: onboarding requests read down the “how to request” column; offboarding revokes down the “owner” column. If a tool isn’t here, it isn’t sanctioned.
| Tool | Purpose | Owner | How to request | Where secrets live |
|---|---|---|---|---|
| Company email / SSO | Identity, MFA, sign-in to everything | Nidal Mohammad | Ask on hire; created day 1 | Personal MFA; no shared creds |
| Azure DevOps | Boards, Repos, Pipelines — system of record | Firas Alhawasli | Team lead requests org + project + team | PATs are personal, scoped, expiring |
| Git repos | Source code per project | Team lead | Added to the repo team by lead | SSH keys / PAT, personal |
| Azure Key Vault | App secrets & connection strings | Wahid Bitar | Team lead grants per-project access | In Key Vault — never in code or chat |
| CI/CD pipelines | Build, test, deploy to environments | Firas Darwish | Comes with Azure DevOps team access | Service connections, managed by owner |
| Chat / messaging | Async comms | Firas Alhawasli | Created day 1 | n/a |
| App stores (Apple / Google) | Mobile releases | Fadel Sabbagh | Mobile lead adds to team account | Signing certs / keys, in Key Vault + platform |
| Client-owned systems | Per-SOW access (client DevOps, servers) | Firas Alhawasli | PM requests from client; time-boxed | Client-managed; we hold nothing after handover |
| Design / other SaaS | Tool-specific | Nidal Mohammad | Ask L1 support | Per-tool, personal accounts |
Rules that keep this table honest
Section titled “Rules that keep this table honest”- No shared logins. Every account is personal so revocation is clean and actions are attributable.
- Secrets live in Key Vault, never in code, chat, or this wiki. This page names where they live, never the values.
- Client access is time-boxed and tied to the SOW; code and credential handover is tied to final payment.
- This table is the audit surface. Add a row when you add a tool; offboarding walks every row.
Onboarding uses this from Day-1 Checklist; leaving walks it in reverse via Offboarding.