Access rights, data permissions, and software licenses move allies through quickly and slow opponents down, with every delay explained as a security, compliance, or capacity requirement.
An example
Six months after an asset manager consolidated its data onto a new analytics platform, the head of the quantitative team, who had argued against the vendor, was still waiting for write access to the portfolio database. Each of her tickets sat in review for three to five weeks. A portfolio team allied with the chief operating officer got the same access in two days, plus seats in the platform's first training cohort, which the chief operating officer's office had picked. When her analysts built a risk report from the old system, the investment committee was told it used unofficial numbers. Her team's queries were flagged twice for audit review. Every delay came with an email citing a compliance requirement. In March her team's report correctly flagged a liquidity problem in one fund that the official dashboard had missed, and the committee chair asked why it had taken a workaround to find it.
Why it works
Allies get smooth access: tickets fast-tracked, elevated rights granted without scrutiny, early training and licenses, which makes the favored path easy. An opponent without access cannot carry out their own agenda, so its value collapses, and even partial access comes with constant friction, such as slow tickets, repeated justifications, and audits of their usage, that makes every independent move costly and visible. Work produced outside the official platform is dismissed as unofficial. Security and compliance are legitimate reasons, which gives each delay plausible deniability, and one office often controls both the rules and the exceptions. It weakens when someone senior mandates access by role, or when results from outside the system prove right.
The thinking behind it
Jeffrey Pfeffer Pfeffer's The External Control of Organizations: A Resource Dependence Perspective (1978) argues that whoever controls a critical, scarce resource gains power over those who depend on it. Access rights, data permissions, and licenses are such resources in a modern company. A team waiting weeks for database access depends on the administrator's goodwill, which is why the defense is to make access a matter of role, decided by someone with no stake in the team's work.
Oliver E. Williamson Williamson's Markets and Hierarchies: Analysis and Antitrust Implications (1975) explains that controls and review layers grow wherever an organization fears opportunism it cannot see. That fear is the legitimate reason access is controlled at all, and it is what makes each delay plausible. Auditable ticket times and written reasons for unequal treatment apply the same safeguard to the controllers themselves.
Warning signs
Ticket times for one team run to weeks while comparable requests elsewhere clear in days. That team's usage draws extra audit reviews. Training and license rosters track allegiance more than role, and a small number of people approve who gets a seat. Reports produced outside the official system are dismissed as unofficial. Every explanation cites a compliance flag or a capacity limit.
How to defend yourself
Collect the timelines: every ticket, its submission date, its resolution date, and the reason given, beside comparable requests from other teams where you can see them. Then:
- ask for the written policy behind each delay or denial, and who applied it
- request access by role, with the criteria for each permission level stated
- keep producing correct work by whatever approved route you have, and document the results
Take the comparison to someone senior to whoever controls access, such as the chief information security officer or the chief executive, and ask for access to be mandated by role. Results from outside the system that turn out right make the gatekeeping visible.
How a leader shuts it down
Make access decisions auditable, with ticket times reported by team. Keep the administrator who grants access apart from any executive with a stake in a team's work, and require written reasons for unequal treatment. Run automated access reviews against role definitions, and assign training seats and licenses by role.