Illustrative scenario
Identity and entitlement.
Imagine a customer changes service partners. Their support contract and the former partner’s logins remain active, but those people should lose access to that customer’s cases.
I would separate the partner’s user identities, its relationship with the customer, and the customer’s entitlement to support. For each, I’d agree which system holds the authoritative record and who owns the business decisions.
The relationship change would trigger access removal across the relevant systems. I’d define who can approve time-limited exceptions and how teams verify removal, including when an update fails.