# Permission widening

URL: /systems/trust-and-governance/controls/permission-widening · Id: `control:permission-widening`

> A Permission widens only through a merged Change with an Approval, never by direct edit.

A [Permission](/business/nouns/permission) widens only through a merged [Change](/business/nouns/change) with an [Approval](/business/nouns/approval), never by direct edit.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2) | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. |
| [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3) | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. |
| [ISO27001 A.8.2](/systems/trust-and-governance/criteria/iso27001/a-8-2) | The allocation and use of privileged access rights is restricted and managed. |
| [ISO27001 A.5.18](/systems/trust-and-governance/criteria/iso27001/a-5-18) | Access rights are provisioned, reviewed, modified and removed according to the access control policy. |

## Implemented by
- [Security](/workflows/processes/security)
- [Access review](/workflows/processes/security/access-review)
- [Permissions](/code/platform/permissions)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Event that adds a Permission to a Role or Worker in the report period. |
| Assert | Each cites a merged Change carrying an Approval from a Worker other than the one gaining the Permission. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A support [Agent](/business/nouns/agent) needs refund rights for a recruiting [SaaS](/products/templates/saas). A Change grants them and merges with the [Customer Lead](/agents/customer/customer-lead)'s Approval; the Agent cannot approve its own grant.