Abstract

This study asks whether named backup staff can authenticate to approved support systems during planned absence. Public evidence frames the governance boundary, while a 30-record local sample supplies descriptive observations. [1] [2] [3]

Methodology

Editors retained source population, purpose, and limits. The design uses 30 records, 2 independent reviewers for ambiguity, stable definitions, and no invented public company rate. Counts, a median, the 90th percentile, unresolved records, and reviewer disagreement remain separate.

Research question and boundary

The question is whether named backup staff can authenticate to approved support systems during planned absence. Sending, assigning, approving, and completing are different events; authority and consequence remain explicit.

Government, academic, standards, and local operating records answer different questions and are not combined into false certainty.

Evidence interpretation

Tests cover identity provider, shared mailbox, calendar delegation, document repository, and escalation directory as separate systems. Credentials are never shared, and the study records only pass, failure class, and approved remediation. Excess access is a defect alongside missing access. Scenarios stop before sending messages, changing production records, or exposing unnecessary content.

For this executive-support question, the bounded application is to run bounded planned-absence tests using non-destructive tasks and record access, blocked paths, approval latency, and primary-owner intervention. [1] [2] [3]

Measurement design

Relevant measures include successful outcomes, stale permissions, device failures, unavailable approvers, excess privilege, recovery time, and repeated blockers. Each requires a denominator, observation window, source system, and interpretation limit.

The study reports missing records, censored observations, exceptions, and known confounders rather than dropping inconvenient cases.

Limitations and decision use

The cited sources do not establish a universal target for whether named backup staff can authenticate to approved support systems during planned absence. Sector, role, regulation, consequence, and available backup affect applicability.

A second 30-record sample using the same definitions is required before treating a pattern as stable. The result supports a bounded governance decision, not a causal claim.

Operational implication

Use the measured pattern to run bounded planned-absence tests using non-destructive tasks and record access, blocked paths, approval latency, and primary-owner intervention. Record the decision owner and the evidence date, then repeat the same definitions in a later review window. The final record should identify the observation that changed the decision, the unresolved uncertainty, the system holding the supporting evidence, and the date when the conclusion expires. Preserve excluded records with reasons so a reviewer can reconstruct the denominator and distinguish a real change from altered data collection.

If the later sample changes direction, revise the interpretation explicitly rather than silently changing a threshold. This keeps the research conclusion traceable to the records that supported it.

Key findings

  • Tests cover identity provider, shared mailbox, calendar delegation, document repository, and escalation directory as separate systems. Credentials are never shared, and the study records only pass, failure class, and approved remediation. Excess access is a defect alongside missing access. Scenarios stop before sending messages, changing production records, or exposing unnecessary content.
  • The evidence supports examining successful outcomes, stale permissions, device failures, unavailable approvers, excess privilege, recovery time, and repeated blockers without collapsing them into one score.
  • Apply the result by choosing whether to run bounded planned-absence tests using non-destructive tasks and record access, blocked paths, approval latency, and primary-owner intervention.
  • Repeat the defined sample and keep unresolved cases visible.

Sources

  1. Guide to Enterprise Telework, Remote Access, and BYOD Security, NIST
  2. The Effects of Remote Work on Collaboration, Nature Human Behaviour
  3. Working from Home Around the World, National Bureau of Economic Research
  4. Teleworking in the COVID-19 Pandemic, OECD
  5. An employers guide on working from home, International Labour Organization
  6. Remote Work, U.S. Office of Personnel Management
  7. Hybrid Work Is Just Work, Microsoft WorkLab
  8. Working anytime, anywhere, Eurofound
  9. Zero Trust Architecture, NIST
  10. Digital Identity Guidelines, NIST
  11. American Time Use Survey, U.S. Bureau of Labor Statistics
  12. How Working from Home Works Out, Stanford Institute for Economic Policy Research

Return to the Research Content library