# Permission decay

URL: /systems/trust-and-governance/controls/permission-decay · Id: `control:permission-decay`

> Each night, Permissions a Worker left unused past their decay Setting narrow through an automatic low-stakes Change.

Each night, [Permissions](/business/nouns/permission) a [Worker](/business/nouns/worker) left unused past their decay [Setting](/business/nouns/setting) narrow through an automatic low-stakes [Change](/business/nouns/change).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2) | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. |
| [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3) | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. |
| [ISO27001 A.5.18](/systems/trust-and-governance/criteria/iso27001/a-5-18) | Access rights are provisioned, reviewed, modified and removed according to the access control policy. |
| [HIPAA 164.308(a)(4)](/systems/trust-and-governance/criteria/hipaa/164-308-a-4) | Access to electronic protected health information is authorized consistent with the minimum necessary. |

## Implemented by
- [Security](/workflows/processes/security)
- [Access review](/workflows/processes/security/access-review)
- [Permissions](/code/platform/permissions)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Permission held by a human or agent Worker at the end of each day. |
| Assert | No Permission stays unused past its `decayAfter` Setting without a narrowing Change merged the following night. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A [Prospector](/agents/sales/prospector) [Agent](/business/nouns/agent) has not deleted a [Contact](/business/nouns/contact) in 30 days. That night a low-stakes Change removes the delete Permission from its [Role](/business/nouns/role).