The bottleneck was a department
A global automotive group runs dozens of subsidiaries and a dealer network on the other side of the company boundary. Hundreds of people are onboarded and offboarded, and hundreds of access requests are raised, every day.
Every one of those requests passed through the IT Help Desk. Not because anybody had decided it should, but because the Help Desk was the only function with rights in the systems involved — so it became the place where the whole network’s identity work accumulated.
What one request used to cost
Creating a user meant the Help Desk manually creating or updating that person’s profile in a third-party system, dealership by dealership. Granting an application meant five steps across three groups of people:
- The request arrives at the Help Desk.
- The business owner is asked for approval.
- A ticket is raised for the application team.
- Everyone waits for the work to be done.
- The Help Desk goes back and updates the third-party system by hand with the new permissions.
Nothing here is unreasonable on its own. The problem is what the five steps become when they are repeated hundreds of times a day: long waits for the dealer, a Help Desk spending its day on data entry, and a re-typing step at the end — the manual update of the third-party system — that is exactly where errors get in.
Moving the work to where the knowledge is
The person who actually knows whether a new salesperson should exist is the administrator at that dealership, not the Help Desk. The redesign followed that: dealers submit their own requests through a self-service interface in Monokee, and the Help Desk is out of the path entirely.
What did not move is control. A dealer can create a user profile and ask for an application; they cannot grant it. Submitting a request starts a workflow in the Visual Identity Orchestrator, which routes it to the business approvers who own that application. Once approved, the workflow itself:
- provisions the access in the third-party system;
- updates the user’s profile;
- opens the corresponding ticket in the customer’s ticketing platform;
- records every action for audit.
The re-typing step is gone. So is the ticket that used to exist only to ask a human to do something a connector can do — the ticket is still created, but as a record of what happened rather than as an instruction to somebody.
Delegation, and the part that made it work
Delegating to administrators outside the company is easy to describe and hard to build, because the workflow has to stop and wait for somebody who is not in your directory, sometimes for days.
The mechanism introduced here handles exactly that: certain steps pause while waiting for an input that only a dealership administrator can give. When the input arrives, the workflow resumes from the precise point where it stopped — no restart, no parallel process to reconcile, nothing for anybody to chase.
That is what makes the delegation model safe rather than merely convenient. Responsibility for the identity lifecycle sits with the dealership that owns those people, while approval and provisioning of application access stay centralised. The group gave away the work, not the governance.
The results
From the customer’s own analysis:
- Request processing time cut by more than half.
- Manual activity reduced to where a human is genuinely needed — data entry by the external dealer, and business approvals. Everything between them is automated.
- Fewer errors, as a direct consequence of removing the manual re-keying.
- The Help Desk freed from repetitive administration and returned to work that needs its judgement.
The customer put it more plainly:
We are now completing in two hours what previously took us two weeks.
Where to go next
The delegation and approval mechanics are described on the Visual Identity Orchestrator page, the B2B side of the model on B2B & supply chain identity, and the separation between the group and the organisations under it on Multi-domain.