What Proves Day-One Access Is Actually Ready?

Research question: what evidence distinguishes requested, approved, provisioned, successfully tested, and excessive access for a Philippines-based new hire? This protocol examines a narrow administrative evidence problem. It does not make an employment, legal, payroll, security, hiring, benefits, or performance decision.

Why this matters to a staffing buyer: An onboarding checklist can show green even when an invitation expired, multifactor enrollment failed, the worker entered the wrong tenant, or a copied role granted more access than the starting tasks require. Buyers need to distinguish administrative activity from usable and appropriately scoped access.

Evidence basis: the Philippine Data Privacy Act and its implementing rules establish principles including transparency, legitimate purpose, proportionality, accountability, security, access, and retention. National Privacy Commission materials describe the responsibilities surrounding personal-data processing. DOLE materials provide labor-context references. NIST CSF 2.0 and SP 800-53 provide governance, identity, access, audit, personnel-security, and record-integrity concepts. These sources frame a test; the responsible organization must determine its actual duties.

Unit of analysis: one named account and permission bundle required for one approved day-one task. Fixing the unit before review prevents an attractive batch total from concealing one unresolved person, permission, record, or decision. Every unit receives a stable non-identifying reference.

Method: construct one hundred synthetic account records across email, ticketing, file storage, HR systems, calendars, password management, reporting, and training tools. Seed expired invitations, shared credentials, duplicate identities, missing approvers, overbroad groups, unavailable owners, failed multifactor enrollment, wrong environments, and access that should begin later. Use invented people, organizations, dates, values, and identifiers only. A study administrator retains the seeded answer key separately until reviewers finish their first classifications.

Required evidence fields: worker reference, system, business purpose, requested role, requestor, required approver, approval event, provisioned identity, permission groups, invitation expiry, authentication test, task test, exception, next owner, review date, and removal trigger. Each field must have a stated business purpose and authoritative source. Blank, unknown, not applicable, restricted, and not yet received remain different values; none may be translated into approval or completion for convenience.

Before testing, the responsible owner writes the accepted states, required evidence, role permissions, response windows, escalation path, and stop conditions. Freeze those definitions for the first pass. If a rule changes, version it and rerun affected cases instead of rewriting earlier results.

Primary measure: correct separation of requested, approved, provisioned, usable, least-privilege exception, blocked, deferred, and not required. Secondary measures include day-one delay, unauthorized privilege, shared-account use, wrong-environment access, false-ready status, and time to reach an accountable owner. Reviewers cite the exact event supporting every classification and use cannot determine when evidence is insufficient. A confident guess counts as an error even when it accidentally matches the answer key.

Error taxonomy: An invitation sent is not an account created; a successful login does not prove the right task can be completed; task success does not prove excess permissions are absent; and manager urgency does not substitute for the required approval. Each state needs its own evidence.

Decision boundary: The onboarding coordinator may collect requirements, route approvals, schedule tests, record observable results, and escalate exceptions. System owners approve and provision access. Security sets control requirements. The hiring manager owns task need. HR owns employment-process decisions.

Comparison design: Compare one ready checkbox with a system-by-system state model. Test a reusable role template against individual business-purpose review so the study can reveal both missing permissions and inherited privilege that the task does not need. Give reviewers the same underlying cases in randomized order. Compare correctness, unnecessary access, unresolved work, serious errors, and review time rather than measuring speed alone.

Privacy and security treatment: Use test tenants or invented evidence. Never put passwords, recovery codes, authentication secrets, or full access exports into the coordination record. Limit screenshots to the minimum state evidence and review whether support tickets expose identifiers to unintended recipients. Record who viewed, exported, notified, or changed evidence because a restricted main screen does not prevent a downstream copy from exposing the same data.

Negative controls are essential. Include ordinary cases that should proceed, incomplete cases that should stop, and misleading cases containing a plausible but insufficient signal. A process that never stops is uncontrolled; a process that stops every case is not useful.

Analysis plan: Report readiness by system and state rather than one blended onboarding percentage. Show false-ready results, overprivilege, and authentication failures separately. Measure whether reviewers can reproduce the classification from preserved evidence without needing secret material. Two reviewers independently classify an overlapping sample. Preserve disagreements, categorize their causes, and send them to the named owner. Do not average disagreement away or let the first data entry become the answer by default.

Set quality thresholds before opening the answer key. The owner defines acceptable routing accuracy, maximum unresolved age, serious-error classes, and pilot stop conditions. A faster workflow fails if it increases unauthorized decisions, disclosure, false closure, or loss of provenance. Publish counts and denominators for every result, including exclusions and their reasons.

Run a repeatability check after the first review. A second reviewer receives the written definitions and clean cases, without coaching from the first reviewer. Low agreement may show an ambiguous rule, weak source, or missing state. Clarify the rule, record a new version, and retest the affected cases before live use.

Provider evidence should match the proposed operating model. Buyers can request a sanitized role demonstration, blank register, permission view, escalation map, and sample audit export. Each artifact has a date and scope. A policy, sales statement, or successful demonstration does not establish continuous operation; missing evidence stays an open question.

Separate fact, classification, decision, and inference in the result. A source event is an observed fact. Applying a frozen rule produces a classification. An authorized owner may make a decision. Researchers may then infer where the workflow is fragile, but that inference must be labeled and cannot be presented as a measured live-company outcome.

Uncertainty should remain visible. Missing events, ambiguous definitions, unavailable owners, integration delays, inaccessible evidence, and contradictory sources receive explicit codes. Report waiting time separately from active processing time so an external dependency is not mistaken for coordinator performance.

Limitations: The study does not penetration-test systems, certify a security program, decide lawful access, or represent every identity provider. Synthetic workflows understate vendor outages, device problems, accessibility barriers, and informal workarounds. A live pilot should begin with a small approved queue, named reviewers, least-privilege access, monitored exceptions, and a stop rule for unexpected sensitive information or decisions outside the written lane.

Decision use: The useful output is a day-one access matrix with business purpose, accountable approver, provisioned identity, permission scope, successful bounded test, exceptions, review date, and removal owner. Buyers can ask a provider to demonstrate the record with sanitized cases. That demonstration is point-in-time evidence, not a guarantee of compliance, accuracy, security, or employment outcomes.

Sources checked September 23, 2026: National Privacy Commission, Implementing Rules and Regulations of the Data Privacy Act of 2012 (https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/); National Privacy Commission, Republic Act 10173 – Data Privacy Act of 2012 (https://privacy.gov.ph/data-privacy-act/); Department of Labor and Employment Bureau of Working Conditions, Labor Advisories (https://bwc.dole.gov.ph/issuances/labor-advisories/); National Institute of Standards and Technology, Cybersecurity Framework 2.0 (https://www.nist.gov/cyberframework); National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Revision 5 (https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final). These primary government sources provide privacy, labor-context, governance, access-control, and audit concepts. They do not decide a specific employment matter, certify a provider, or replace advice from authorized legal, HR, payroll, security, or benefits owners.