@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix knobit: <https://knobit.org/id/knobit/> .
@prefix outcome: <https://knobit.org/id/outcome/> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .

outcome:SO-3 a edu:LearningOutcome,
        edu:Skill ;
    rdfs:label "Designs access by need, with duties segregated and masking that holds"@en,
        "Kavandab juurdepääsuõigused vajaduspõhiselt, ülesannete lahususe ja töökindla maskeerimisega"@et ;
    dcterms:description "Stage 3 of the data-security skill: Designs access by need, with duties segregated and masking that holds; produces 03-access/access-model.yaml."@en ;
    dcterms:identifier "SO-3" ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    edu:hasPrerequisite outcome:SO-2 ;
    edu:includesKnobit knobit:G-255,
        knobit:K-821,
        knobit:S-301,
        knobit:S-302,
        knobit:S-303,
        knobit:S-304,
        knobit:S-305,
        knobit:S-306,
        knobit:S-307,
        knobit:S-308,
        knobit:S-309,
        knobit:S-310,
        knobit:S-311,
        knobit:S-331,
        knobit:S-332,
        knobit:S-333,
        knobit:S-351,
        knobit:S-353,
        knobit:S-354,
        knobit:S-355 ;
    edu:relatedTopic <https://knobit.org/id/topic/dmbok2-data-security> .

edu:LearningOutcome rdfs:label "Learning outcome"@en,
        "Õpiväljund"@et .

edu:Skill rdfs:label "Skill"@en,
        "Oskus"@et .

knobit:G-255 rdfs:label "Explains segregation of duties"@en .

knobit:K-821 rdfs:label "Recognises a restricted column without access design"@en .

knobit:S-301 rdfs:label "Recognises a role granting more than its jobs require"@en .

knobit:S-302 rdfs:label "Recognises a toxic combination in one role"@en .

knobit:S-303 rdfs:label "Recognises a toxic combination across a job's roles"@en .

knobit:S-304 rdfs:label "Recognises masking a join can undo"@en .

knobit:S-305 rdfs:label "Recognises row security on an updatable column"@en .

knobit:S-306 rdfs:label "Recognises a privileged role with no logging"@en .

knobit:S-307 rdfs:label "Recognises break-glass access with no expiry"@en .

knobit:S-308 rdfs:label "Recognises an access role with no owner"@en .

knobit:S-309 rdfs:label "Recognises an administrator reading restricted data"@en .

knobit:S-310 rdfs:label "Recognises masking applied to one copy only"@en .

knobit:S-311 rdfs:label "Recognises a shared privileged account"@en .

knobit:S-331 rdfs:label "Splits a toxic combination into separate roles"@en .

knobit:S-332 rdfs:label "Closes the clear-text paths around a masked column"@en .

knobit:S-333 rdfs:label "Removes excess entitlements while keeping every duty covered"@en .

knobit:S-351 rdfs:label "Explains least-privilege access design"@en .

knobit:S-353 rdfs:label "Explains data masking and its limits"@en .

knobit:S-354 rdfs:label "Explains privileged and emergency access"@en .

knobit:S-355 rdfs:label "Explains row-level security"@en .

outcome:SO-2 rdfs:label "Classifies every column, derived ones included, at the level its data demands"@en,
        "Klassifitseerib iga veeru, ka tuletatud veerud, tasemele, mida selle andmed nõuavad"@et .

<https://knobit.org/id/topic/dmbok2-data-security> rdfs:label "Data security (DAMA-DMBOK2 chapter 7)"@en,
        "Andmeturve (DAMA-DMBOK2 7. peatükk)"@et .