Security & Access Request (SAR)
The hospital's security and access request system was a 15–20 year old Microsoft Access file. User onboarding was almost entirely manual — no audit trail, no role-based access, no compliance visibility. Nobody knew who had access to what, roles never expired, and there was zero insight into login patterns or suspicious activity. With SOX requirements tightening, the process was a liability.
Built a full .NET Core MVC application from scratch. A background service syncs users, groups, and manager chains from Active Directory across multiple OUs on a configurable schedule, with caching and zero-result abort protection. RBAC controls who can request, approve, and audit — with role expiration dates, automatic reversion to default roles, and separation-of-duty conflict detection. High-privilege role assignments auto-trigger access reviews.
A custom middleware tracks every login with IP, hostname, device type, and maps IPs to physical locations using database-driven network range rules. A Security Monitoring command center surfaces login history, access pattern alerts, and role assignments — all filterable, paginated, and exportable to CSV. Real-time notifications push via SignalR. Every change — role assignments, AD group modifications, user status — is audit-logged with full before/after history, filterable by date range and change type. All admin settings (SMTP, sync intervals, feature flags) are database-backed and configurable from the UI without redeployment.
Replaced a decades-old Access file with a SOX-compliant web application. Automated user provisioning cut onboarding time dramatically. The admin dashboard surfaces KPIs (stale requests, orphaned users, disabled physicians) in real time. Security auditors can export full audit trails filtered by date, user, and action type. Role conflicts are detected automatically. The system runs as a hosted background service with no manual intervention required.