Continuous Business Role Optimization at Union Investment

Union Investment operates a mature IAM environment – but scale and complexity create persistent governance challenges. With over 300,000 authorization objects and more than 1,000 connected applications, maintaining a clean, efficient role structure requires continuous effort.

Business roles in a multi-tier model inevitably drift over time. As the organizational structure and application landscape changes, roles that were initially well-designed become outdated. Responsibility for business roles lies with the business departments – but maintaining and optimizing roles is a complex administrative task that sits outside their core work.

At the same time, recurring manual recertification of system role assignments creates significant workload. Many of these assignments could be covered by existing business roles – but identifying which ones, while respecting SoD requirements and inheritance hierarchies, is not practical to do manually at this scale.

The goal was to:

• Continuously simplify the authorization structure with a high degree of automation
• Identify system roles that can be consolidated into business roles automatically
• Reduce the volume of manual system role assignments requiring recertification
• Ensure all optimization proposals respect SoD constraints and role purity requirements
• Keep business role owners in control while minimizing their administrative burden

Union Investment deployed NEXIS as a continuous optimization layer on top of its OneIM environment. Role optimization shifted from a recurring manual exercise to an ongoing, semi-automated process.

System roles eligible for consolidation into business roles are now identified automatically and reviewed in a structured workflow. Once the responsible business role owner approves a proposal, the manual assignments it replaces are dissolved directly in OneIM. Each approved consolidation therefore reduces the assignments that enter the next recertification cycle.

Results:

• Automation in place:
  Consolidation proposals are generated continuously, replacing periodic manual role analysis.
• Recertification scope reduced at the source:
  Each approved consolidation dissolves the manual assignments it replaces, lowering the volume entering future recertification cycles.
• Compliance by design:
  Proposals are generated within the SoD matrix and role purity rules, so no consolidation introduces an SoD or purity violation.
• Business ownership retained:
  Every change passes through structured review and business role owner approval, without adding analytical work for the departments.
• Full transparency:
  A reporting dashboard tracks accepted proposals and recertification assignments saved per round, supported by a task overview for open, in-progress, and completed items.