📘

Access Control

Grant the minimum access necessary.

v1 security curated

🤖

Install 安装

curl -sSL https://updating.cc/skills/security/access-control/SKILL.md -o ~/.agents/skills/security__access-control/SKILL.md

📄

Raw Source

https://updating.cc/skills/security/access-control/SKILL.md

← Back to profession page

SKILL.md Preview 技能内容预览

---
name: Access Control
description: Grant the minimum access necessary.
---
# Access Control

Most breaches are an access-control failure: someone reaches something they shouldn't. Strong authn with weak authz still leaks.

## Principles
- **Authentication (who).** Strong: MFA, short-lived credentials, hardware keys for high-privilege. Long-lived passwords and shared credentials are legacy risk.
- **Authorization (what).** Checked on every action, not just at login. The most common bug (IDOR) is authz missing on a per-resource action.
- **Least privilege.** Default to no access; grant as needed with time limits. Standing admin access is the highest-risk state.
- **Audit.** Log access, especially privileged. Anomalous access patterns are how you detect compromise.

## Lifecycle
- Onboard → grant minimum. Role change → adjust. Offboard → revoke immediately, comprehensively (forgetting one system is how ex-employees retain access).