An employee moves to another branch in the software but can still open an old request through a session left running. Another request awaits their approval at the previous branch. This is more than changing a branch label: when do new permissions take effect, and who inherits unfinished work?
A transfer with an effective time
Before pricing multi-branch software, describe transfer as a distinct business event. Identify both branches, approved timing, approver and access that should start or stop. A developer should not infer policy from a “manager” title or a user-list selection.
In a fictional camera-equipment rental business, a coordinator changes branches with an open computer session, another device login and unfinished approval. No real account is modified or application tested here. The case defines requirements the business owner can review with a supplier.
Three snapshots instead of one login test
- Before effectiveness: record branch, role and accessible requests so comparison relies on evidence rather than memory.
- After effectiveness in an existing session: have the specialist explain how the application recognizes change and the expected outcome of authorized checks involving earlier requests.
- After a new login: review new-branch permissions and any explicitly retained old access, distinguishing authentication from completing work.
For each snapshot, record application version, test environment, suitable test account and outcome evidence. Identify missing coverage when another device or session type cannot be tested. A successful new login does not establish what happens in a session predating the transfer.
Pending requests need decision ownership
Does an approval travel with the employee, move to a deputy in the previous branch or await authorized review? The organization must decide. Reassignment should not happen accidentally through membership changes, and assigning work does not authorize access to all historical branch data.
The coordinator may need to read earlier information without retaining approval rights. Separate reading, acting and follow-up ownership. Give temporary exceptions a reason, boundary and reviewer rather than silently broadening access to keep a request moving.
A transfer sheet for the proposal
A short record can connect identity, timing and unfinished work. This is not a complete permissions catalogue: it specifies changes triggered by transfer and the evidence needed to demonstrate them.
- Employee, both branches, effective time and approving role.
- New and withdrawn rights, with the relevant action and resource.
- Included sessions and devices, plus verification exclusions.
- Pending requests, replacement follow-up owner and historical-access decision.
- Approved exceptions, review dates and evidence that the need ended.
- Expected and observed outcomes and a correction or completion owner.
One person may hold several roles in a small organization; decisions must remain understandable. Ask how a supervisor can recognize an incomplete transfer and who follows up discrepancies. A new branch label in the employee record does not document every requirement above.
An identity provider is not the whole application policy
OWASP recommends correct authorization checks on every request rather than relying on earlier authentication. Entra documentation explains that an application-issued session follows application policy and cannot be directly revoked by Entra. Ask about the project's actual session behavior rather than accept a universal instant-effect promise.
The latter source concerns emergency revocation in a particular product, not a ready branch-transfer procedure or universal deadline. A specialist must choose and demonstrate suitable behavior through authorized testing. Proposal assessment requires neither disabling commands nor an employee's password.
Include the sheet in the requirements file when discussing custom software with Nextwave. Explicitly price transfer behavior and pending work so changing team responsibilities produces an understandable result.
Sources and limits
Relevant OWASP authorization and Entra session sections were read on 4 November 2026. No permissions were changed or tests performed. Prepared with AI assistance and information and translation review.
