# Unseated access

URL: /systems/trust-and-governance/controls/unseated-access · Id: `control:unseated-access`

> A Worker unseated from a Role holds none of that Role’s Permissions from the moment it leaves.

A [Worker](/business/nouns/worker) unseated from a [Role](/business/nouns/role) holds none of that Role’s [Permissions](/business/nouns/permission) from the moment it leaves.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.2](/systems/trust-and-governance/criteria/soc2/cc6-2) | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. |
| [SOC2 CC6.3](/systems/trust-and-governance/criteria/soc2/cc6-3) | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. |
| [ISO27001 A.6.5](/systems/trust-and-governance/criteria/iso27001/a-6-5) | Security responsibilities that remain after termination or a change of job are defined and enforced. |
| [HIPAA 164.308(a)(3)](/systems/trust-and-governance/criteria/hipaa/164-308-a-3) | Workforce members get appropriate access to electronic protected health information, and others are prevented from obtaining it. |

## Implemented by
- [Security](/workflows/processes/security)
- [Staffing](/workflows/processes/staffing)
- [Workforce](/systems/workforce)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Worker unseated from a Role in the report period. |
| Assert | The set of Actions it ran under that Role after unseating is empty. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A [Human](/business/nouns/human) leaves the [Billing Specialist](/agents/finance/billing-specialist) seat at 17:00. A refund attempt under that Role at 17:01 ends `refused`.