@prefix activity: <https://knobit.org/id/activity/> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix knobit: <https://knobit.org/id/knobit/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix schema: <https://schema.org/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

activity:SO-3 a edu:Activity ;
    rdfs:label "Design access control"@en,
        "Juurdepääsukontrolli kavandamine"@et ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    rdfs:comment "Stage 3 (Access control) of the data-security skill: produces 03-access/access-model.yaml and passes the stage's validation gate."@en ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/activity/data-security/03-access-control> ;
    edu:requiresKnobit knobit:G-255,
        knobit:K-821,
        knobit:S-301,
        knobit:S-302,
        knobit:S-303,
        knobit:S-304,
        knobit:S-305,
        knobit:S-306,
        knobit:S-307,
        knobit:S-308,
        knobit:S-309,
        knobit:S-310,
        knobit:S-311,
        knobit:S-331,
        knobit:S-332,
        knobit:S-333,
        knobit:S-351,
        knobit:S-353,
        knobit:S-354,
        knobit:S-355 ;
    schema:position 3 .

edu:Activity rdfs:label "Activity"@en,
        "Tegevusnäitaja"@et .

knobit:G-255 rdfs:label "Explains segregation of duties"@en .

knobit:K-821 rdfs:label "Recognises a restricted column without access design"@en .

knobit:S-301 rdfs:label "Recognises a role granting more than its jobs require"@en .

knobit:S-302 rdfs:label "Recognises a toxic combination in one role"@en .

knobit:S-303 rdfs:label "Recognises a toxic combination across a job's roles"@en .

knobit:S-304 rdfs:label "Recognises masking a join can undo"@en .

knobit:S-305 rdfs:label "Recognises row security on an updatable column"@en .

knobit:S-306 rdfs:label "Recognises a privileged role with no logging"@en .

knobit:S-307 rdfs:label "Recognises break-glass access with no expiry"@en .

knobit:S-308 rdfs:label "Recognises an access role with no owner"@en .

knobit:S-309 rdfs:label "Recognises an administrator reading restricted data"@en .

knobit:S-310 rdfs:label "Recognises masking applied to one copy only"@en .

knobit:S-311 rdfs:label "Recognises a shared privileged account"@en .

knobit:S-331 rdfs:label "Splits a toxic combination into separate roles"@en .

knobit:S-332 rdfs:label "Closes the clear-text paths around a masked column"@en .

knobit:S-333 rdfs:label "Removes excess entitlements while keeping every duty covered"@en .

knobit:S-351 rdfs:label "Explains least-privilege access design"@en .

knobit:S-353 rdfs:label "Explains data masking and its limits"@en .

knobit:S-354 rdfs:label "Explains privileged and emergency access"@en .

knobit:S-355 rdfs:label "Explains row-level security"@en .