Explains privileged and emergency access
Named, logged, time-limited privileged access without business reads; break-glass expires and is reviewed (ISO/IEC 27002:2022 8.2, 8.15).
Can AI do this?
AI does this partly Some of the tested AI models master this; others do not show it. 2 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 99% | Not shown |
| gemini-3.5-flash-lite | Low cost | 98% | Not shown |
| gpt-6-luna | Low cost | 100% | Mastered |
| claude-haiku-5-5 | Low cost | 100% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: Named, logged, time-limited privileged access without business reads; break-glass expires and is reviewed (ISO/IEC 27002:2022 8.2, 8.15).
How it is assessed: Answers a written question on the privileged and break-glass access correctly
Related knobits
Needed for
- S-306 Recognises a privileged role with no logging
- S-307 Recognises break-glass access with no expiry
- S-309 Recognises an administrator reading restricted data
- S-311 Recognises a shared privileged account
- S-508 Recognises privileged access outside recertification
All 20 knobits of Design access control.
Source: Practice the stage 3 reference and review checklist rest on