IAM in Mexican companies: stop giving everyone access to everything

IAM (Identity and Access Management) sounds enterprise-heavy, but the problem is universal: in many Mexican companies, almost anyone can export the customer database, delete ERP records, or log into the AWS console because someone once asked for admin and nobody removed it.

The goal is not to block work. It is for every person—and every automated integration—to have exactly what their job requires, no more.

Symptoms of broken IAM

• Shared accounts like sales@company.com with one password.
• Former employees with active access weeks after offboarding.
• All developers are production admins.
• Integrations with global permissions because it was faster to set up.
• No record of who approved which permission.

Minimum viable role model

You do not need 200 roles in month one. Start with five to eight profiles aligned to real functions: sales, support, accounting, development (staging only), ops (limited production), IT admin, read-only audit, integrations/service.

1. List critical systems and dangerous actions (delete, export, pay).
2. Define which role can perform each action.
3. Assign people to one primary role; avoid permanent exceptions.
4. Review exceptions every 90 days with expiration dates.

If nobody remembers why Juan has payroll access, IAM has already failed.

MFA and federation

Mandatory MFA on email, VPN, cloud consoles, and any panel with personal or financial data. If you use Google Workspace or Microsoft 365, leverage SSO to compatible apps to centralize onboarding and offboarding. Fewer loose passwords = smaller surface.

Service accounts and integrations

APIs between ERP, CRM, and billing often use long-lived keys with excessive permissions. Rotate keys periodically, store secrets in a vault (not .env in the repo), and assign minimum scopes. Document which system uses which credential and who last rotated it.

24-hour offboarding process

HR should trigger an automatic checklist: disable email, revoke VPN, remove from groups, rotate shared passwords they knew, review active SaaS sessions. Late offboarding is one of the most preventable causes of insider fraud and leaks.

Light governance that actually gets done

• IAM owner per system (not an eternal committee).
• Exportable onboarding/offboarding log for audits.
• Alerts when someone gets a new admin role.
• 15-minute quarterly review with HR and IT.

Integration with payroll and HR

Sustainable IAM starts in HR: exact offboarding date, real role vs paper role, temporary contractors with automatic expiry. A payroll-to-IT webhook triggering revocation eliminates 90% of zombie accounts. Without integration, you depend on human memory—and that fails during high turnover seasons.

IAM and LFPDPPP compliance

The law requires controlling access to personal data. Demonstrating roles, logs, and timely offboarding helps with INAI claims and client questionnaires. Good IAM is operational compliance, not just security.

Real cases in Mexican operations

We see it repeatedly: the summer intern with production access, the shared admin@ ERP account, the external integrator with permanent VPN after the project ended. None start malicious; all are incidents waiting for a date. IAM fixes the scenario before the headline.

Accessible tools for SMBs

You do not need SailPoint on day one. Google Workspace and Microsoft 365 include groups, SSO, and integrated MFA. For cloud, native AWS/Azure IAM with per-service roles. The expensive part is not licensing—it is maintaining the role catalog when new projects land every quarter.

Is your company growing and permissions no longer scale? At Devson Labs we design practical IAM for Mexican operations: roles, MFA, integrations, and offboarding processes teams can sustain. Contact us for an initial diagnosis.