AGDLP

How AGDLP structures access control

AGDLP is a group-based authorization pattern that reduces direct user-to-resource permissions by inserting intermediate group layers. That matters because it gives administrators a repeatable way to express access through membership and role-like grouping instead of granting entitlements one account at a time.

Its core value is that permissions become easier to understand, review, and change. When access is granted through groups, the security team can adjust membership without rewriting resource permissions, which helps keep access decisions consistent across many systems and teams.

Why the model uses nested groups and permissions

The “Accounts, Global groups, Domain Local groups, Permissions” sequence is the heart of the model. Accounts represent the principals, global groups collect users by business role or function, domain local groups hold resource-specific access, and permissions are applied at the resource boundary.

That layering creates separation between who someone is, how they are organised, and what they can reach. In practice, it lets organisations map business structure to technical authorization in a way that is easier to audit than direct ad hoc entitlements.

Where AGDLP fits in IAM governance

AGDLP is most useful in environments that need disciplined entitlement management. It supports joiner-mover-leaver processes, access reviews, and least-privilege design because access can be governed at the group level rather than scattered across individual accounts.

The model also makes ownership clearer. Teams can own group membership, resource owners can own permission assignments, and IAM teams can define the rules that connect those layers. That division of responsibility is one reason the pattern remains common in enterprise directory-based access control.

What AGDLP does not solve on its own

AGDLP improves structure, but it does not automatically make access secure. Poorly governed groups can still accumulate excessive privilege, stale memberships can linger, and overly broad resource groups can hide overexposure behind a neat naming scheme.

It also depends on strong administrative discipline. If groups are created without naming standards, ownership, or periodic review, the model can become just another way to organise excessive access instead of a control that reduces it.

Practitioner Guidance

Governance implication: Treat AGDLP as an operating model for entitlement hygiene, not as a one-time directory design. Its value depends on clear group ownership, predictable naming, and regular review of whether each group still reflects a real business need.

What to watch for: Watch for group sprawl, nested groups that obscure effective access, and permissions assigned directly to users or resources outside the model. Those are the usual signs that AGDLP has drifted away from least-privilege intent.