# Task-bound access

URL: /systems/trust-and-governance/controls/task-bound-access · Id: `control:task-bound-access`

> An agent Worker acts with a token scoped to its Role’s Permissions and its Task’s Nouns, expiring with the Task or Mandate.

An agent [Worker](/business/nouns/worker) acts with a token scoped to its [Role](/business/nouns/role)’s [Permissions](/business/nouns/permission) and its [Task](/business/nouns/task)’s [Nouns](/business/nouns/noun), expiring with the Task or [Mandate](/business/nouns/mandate).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1) | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3) | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. |
| [ISO27001 A.5.15](/systems/trust-and-governance/criteria/iso27001/a-5-15) | Rules control physical and logical access to information and assets, based on business and security requirements. |
| [HIPAA 164.308(a)(4)](/systems/trust-and-governance/criteria/hipaa/164-308-a-4) | Access to electronic protected health information is authorized consistent with the minimum necessary. |
| [HIPAA 164.312(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-312-a-1) | Systems that hold electronic protected health information allow access only to authorized persons or software. |

## Implemented by
- [Security](/workflows/processes/security)
- [Permissions](/code/platform/permissions)
- [Identity](/code/platform/identity)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Action by an agent Worker in the report period. |
| Assert | Each ran under an unexpired token whose scope lies inside both its Role’s Permissions and its Task or Mandate. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
An [Agent](/business/nouns/agent) reconciling one [Customer](/business/nouns/customer)'s month gets a token scoped to that Customer's [Transactions](/business/nouns/transaction). When the Task closes, the token expires.