Single Sign-On Convenience vs. Granular Access Control Precision

Business Context

Single sign-on systems, allowing clinical staff to authenticate once and access multiple connected systems without repeated separate logins, significantly improve workflow efficiency and reduce the documented clinical risk associated with excessive authentication friction, such as staff sharing credentials to avoid repeated logins. However, single sign-on architectures can, if not carefully designed, propagate broad access rights across multiple systems based on a single authentication event, reducing the granularity with which access to specific, highly sensitive functions or data categories within each connected system can be independently controlled and audited.

Healthcare TRIZ Resolution

Rather than avoiding single sign-on to preserve maximal per-system access granularity, which reintroduces authentication friction and its associated workaround risks, or implementing single sign-on without preserving granular downstream access control, the resolution layers single sign-on convenience for baseline system access on top of a separate, preserved, granular role-based access control layer within each connected system, so that a single authentication event streamlines login but does not, by itself, determine the specific scope of access to sensitive functions or data categories, which continues to be governed by system-specific, granular authorization rules evaluated independently of the authentication event itself.

Applicable TRIZ Principles

Principle 1 – Segmentation Separate the authentication convenience layer from the access authorization layer, rather than allowing a single event to govern both.

Principle 40 – Composite Materials Combine single sign-on convenience with preserved, system-specific granular access control rather than treating the two as mutually exclusive architectures.

Principle 3 – Local Quality Preserve fine-grained, system-specific access rules for the most sensitive functions even within a streamlined authentication architecture.

Expected Outcome

Preserved workflow efficiency

Maintained granular access control

Reduced credential-sharing workaround risk

Clear separation of authentication and authorization

Decision Indicators

Early indicators that this contradiction is limiting organizational performance include:

Single sign-on implementation resulting in broader access to sensitive functions than individual staff roles should warrant

No independent, system-specific access authorization layer maintained alongside the single sign-on authentication layer

Audit findings showing access rights inconsistent with documented role-based policy following single sign-on implementation

Staff reporting credential-sharing or authentication workaround behavior prior to single sign-on adoption, motivating its implementation, without a corresponding access-granularity review

Security or compliance review identifying access control gaps specifically introduced or obscured by the single sign-on architecture

Monitoring these indicators helps information security leadership ensure authentication convenience improvements do not inadvertently erode access control precision.