Recognises a role granting more than its jobs require
An entitlement in a role that no job holding the role needs.
Can AI do this?
Not settled yet The benchmark tested this, but the models' answers do not settle yet whether they master it. 0 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 75% | Not shown |
| gemini-3.5-flash-lite | Low cost | 73% | Not shown |
| gpt-6-luna | Low cost | 74% | Not shown |
| claude-haiku-5-5 | Low cost | 75% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The entitlement and its removal or the job need to state
How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: RL-004 ANALYST includes EN-030 export full customer list; JB-005 needs only analytical reads Acceptable: EN-030 removed, or a job whose need is stated
Also known as: Role granting more than its jobs need
Related knobits
Builds on
Usually followed by
All 20 knobits of Design access control.
Source: Review checklist 03-access-control, row 1 (27002 5.15, 5.18; PCI 7)