At Grab, we have an internally built system (that I think is backed by Active Directory and leverages experience from ppl from okta). As a "requestor", I choos

At Grab, we have an internally built system (that I think is backed by Active Directory and leverages experience from ppl from okta). As a "requestor", I choose from a list of services, then I select which role I want, then there are meta attributes (like which country's data I want to access, etc.). This then lets me oAuth into the internal app with a JWT. My access is time limited (max of 90 days or only 2 hours). As a data owner and EM, I approve requests for services and data that I own. As an service creator, I have to register the service in the tool, provide all of my various roles and configurations. This system works with both internal and external authorizations. Like if I need prod AWS write access. It doesn't cover all data (some tools have similar internally built systems), but we will eventually migrate everything to it. This is probably all I have time to share.