What it means
The approach improves isolation, delegated ownership, billing, quotas, policy, and incident containment when the hierarchy and shared services are designed deliberately.
Why it matters
More accounts do not automatically improve security. Identity, networking, logging, policy inheritance, inventory, and lifecycle automation must operate across the entire estate.
Practical focus
- Separate environments and high-impact trust boundaries
- Centralize identity, logging, security, and billing appropriately
- Automate account creation and baseline enforcement
- Maintain ownership and closure processes
Common mistakes
- Creating accounts without a hierarchy or owner
- Building shared services that become a universal blast radius
- Leaving old accounts active after workloads move
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: