Permission widening
A Permission widens only through a merged Change with an Approval, never by direct edit.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC6.2 | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. |
| SOC2 CC6.3 | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. |
| ISO27001 A.8.2 | The allocation and use of privileged access rights is restricted and managed. |
| ISO27001 A.5.18 | Access rights are provisioned, reviewed, modified and removed according to the access control policy. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Event that adds a Permission to a Role or Worker in the report period. |
| Assert | Each cites a merged Change carrying an Approval from a Worker other than the one gaining the Permission. |
Owner
Security Engineer, Engineering Team.
Example
A support Agent needs refund rights for a recruiting SaaS. A Change grants them and merges with the Customer Lead's Approval; the Agent cannot approve its own grant.