Identity lifecycle, least privilege and access-control models

Manage access as a lifecycle

Define identities and responsibilities, provision appropriate access, review it as roles or circumstances change, and deprovision what is no longer justified. Keep track of user, administrator and service accounts and the systems making authentication/authorization decisions. Approval, fulfillment and evidence should be distinguishable. Single sign-on simplifies authentication across services but does not guarantee immediate revocation everywhere.

Limit power and conflicting duties

Least privilege gives only the access needed for the authorized task and context. Separation of duties divides conflicting responsibilities so that one person cannot alone perform an inappropriate end-to-end action. Small organizations may need proportionate review or approval arrangements, but a compensation claim needs evidence. An account used for ordinary work need not have the privileges of an administrator.

Read an access-control matrix

An access-control matrix relates subjects, objects and permitted access rights. Think of subjects as rows, objects as columns and rights as the entries: a receptionist may read a booking but may not approve a refund. The matrix expresses policy; it does not create accounts, enforce permissions or prove that the live configuration matches the policy.

Distinguish access-control models

Role-based access control groups permissions by roles and assigns users appropriately. Discretionary access control permits certain privilege decisions to be delegated to authorized subjects; mandatory access control enforces centrally defined policy and restricts that discretion. Attribute-based access control can evaluate attributes of subjects, resources, actions and context. The current CC outline names access-control models without separately prescribing all these labels. A model description does not prove product enforcement.

Removal has several parts

A role change may mean removing only obsolete permissions rather than disabling the person’s whole account. Departure may require account disabling, permission removal and separate session/token actions. Disabling rather than immediately deleting can preserve audit information. Exact sequencing, retention and downstream effects depend on the system and policy.

Manage non-human access deliberately

Editorial application: give an automation or AI service an accountable owner and the permissions required for its approved task. Review its access and retire obsolete credentials or sessions when the task ends. Human MFA concepts do not mean every unattended service uses the same authentication mechanism as a person. Behavioural or location anomalies are investigative signals, not conclusive identity evidence.

Connect the terminology.