Explains least-privilege access design

https://knobit.org/id/knobit/S-351

Context functions	Object understanding
Knobit creation methods	AI generated
Knobit types	Knowledge
LCG purposes	Assessing the learner's knowledge or skill state
LCG purposes	Opening up a learning outcome
action verb	Explains en
assessment criterion	Answers a written question on the least-privilege access design correctly en
assessment method	Written question en
conforms to profile	https://oppekava.edu.ee/a/Knobitite_kirjeldamise_ja_seostamise_reeglid#LCG-KNOBIT-0.1
dcterms:identifier	S-351
dcterms:license	https://creativecommons.org/licenses/by/4.0/
dcterms:source	Practice the stage 3 reference and review checklist rest on en
expected result	Jobs state their needs; roles are built from jobs; every entitlement traces to a need; roles have owners (ISO/IEC 27002:2022 5.15, 5.18; PCI DSS v4.0.1 Req. 7). en
owl:sameAs	https://bitbucket.org/reffa/ontology/id/knobit/data-security/03-access-control/S-351
rdfs:label	Explains least-privilege access design en
schema:creativeWorkStatus	accepted
schema:isPartOf	Data security and privacy (DAMA-DMBOK2)
skos:definition	Jobs state their needs; roles are built from jobs; every entitlement traces to a need; roles have owners (ISO/IEC 27002:2022 5.15, 5.18; PCI DSS v4.0.1 Req. 7). en
skos:prefLabel	Explains least-privilege access design en
target object	least-privilege access design en

Used by

applies knowledge	Recognises a restricted column without access design
applies knowledge	Recognises a role granting more than its jobs require
applies knowledge	Recognises an access role with no owner
applies knowledge	Recognises an administrator reading restricted data
applies knowledge	Removes excess entitlements while keeping every duty covered
includes knobit	Designs access by need, with duties segregated and masking that holds
includes knobit	Data security processes: access, authentication, authorisation, entitlement
requires knobit	Design access control