Portfolio Project — Product Management, Digital Identity & Access Management

AccessOS: an IAM decision engine for a multi‑AMC mutual fund platform

Every click below runs a real RBAC + ABAC policy evaluation in your browser — same deny‑first / allow / default‑deny model used by AWS IAM and Open Policy Agent — against a policy set I designed for six personas on a multi‑AMC wealth‑management platform.

The problem: platforms serving AMCs, distributors, investors, and internal ops teams usually bolt access control onto CRM roles rather than modeling identity, regulatory risk, and privilege together. This demo is the smallest slice of AccessOS that proves the model actually works: pick a persona, change one attribute, attempt an action, and watch the access decision — and the reason for it — change live.
RBACABACPAM / JIT Access Identity Lifecycle (KYC)Risk Mitigation Audit TrailRegulated Fintech

Try it — six real decisions

Step 1: choose who you are. Step 2: set the context. Step 3: attempt an action and read the decision.

1 · Persona

2 · Context (ABAC attributes)

3 · Attempt an action

Decision

—
no action attempted yet
Pick a persona and try an action above.

Live audit trail

No access attempts logged yet — every allow, deny, and default‑deny gets written here with a reason, just like it would in production.

What this one demo actually proves

Mapped to the skills a Digital Identity & Access Management PM role screens for.

✓ RBAC — actions are gated by role (only a Distributor Admin can export; a sub‑user cannot).
✓ ABAC — the same role gets a different outcome depending on KYC status, device trust, business hours, or an attached case ID.
✓ Identity lifecycle — unverified KYC blocks transacting entirely, independent of role permissions.
✓ PAM — engineers hold zero standing production access; it's requested, approved, time‑boxed, and auto‑expires.
✓ Risk mitigation — insider‑trading‑restricted (PIT) client data requires a logged case, not standing visibility.
✓ Security/UX trade‑off — high‑value redemptions require step‑up MFA; low‑value ones don't (a deliberate decision, not an oversight).
✓ Auditability — every decision, allowed or denied, is logged with the rule and reason that produced it.
✓ Explainability — decisions are never a black box; each one names the exact rule and the plain‑language reason behind it.