Explains least-privilege access design
Jobs state their needs; roles are built from jobs; every entitlement traces to a need; roles have owners (ISO/IEC 27002:2022 5.15, 5.18; PCI DSS v4.0.1 Req. 7).
Can AI do this?
Not settled yet The benchmark tested this, but the models' answers do not settle yet whether they master it. 0 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 99% | Not shown |
| gemini-3.5-flash-lite | Low cost | 99% | Not shown |
| gpt-6-luna | Low cost | 100% | Not shown |
| claude-haiku-5-5 | Low cost | 99% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: Jobs state their needs; roles are built from jobs; every entitlement traces to a need; roles have owners (ISO/IEC 27002:2022 5.15, 5.18; PCI DSS v4.0.1 Req. 7).
How it is assessed: Answers a written question on the least-privilege access design correctly
Related knobits
Needed for
- K-821 Recognises a restricted column without access design
- S-301 Recognises a role granting more than its jobs require
- S-308 Recognises an access role with no owner
- S-309 Recognises an administrator reading restricted data
- S-333 Removes excess entitlements while keeping every duty covered
All 20 knobits of Design access control.
Source: Practice the stage 3 reference and review checklist rest on