Access control didn’t disappear with cloud, it fractured. This hands-on workshop turns old-school RBAC and joiner/mover/leaver philosophies and processes into a modern exercise leaders can run Monday morning. Participants map three exemplar roles, spot segregation-of-duties conflicts, and design time-bound exceptions and guest controls that work across SaaS, collaboration suites, and AI add-ons without relying on any specific vendor. A timed tabletop tests urgent transfers, external auditors, and AI plugin surprises, forcing practical decisions under constraints. Attendees leave with a one-page role catalog, a JML workflow, and a “first five moves” checklist tied to audit-ready outcomes. The result is immediate, durable access hygiene: fewer foot-guns, smaller blast radius, and a cadence for quarterly reviews that executives understand and teams can sustain at scale, everywhere.