Identity and Access Management (IAM) Concepts · Topic 2 of 2
Logical Access Controls
Least privilege, separation of duties, just-in-time access, and the DAC, MAC, RBAC, rule-based and ABAC access control models, applied to people and AI agents.
- 3 min
- Least privilege: only the access needed, only for as long as needed.
- Separation of duties: no one person or system completes a critical task alone.
- DAC is owner-decided; MAC uses labels; RBAC uses roles; rule-based uses fixed rules; ABAC uses attributes.
What it is
Logical access controls decide what an identity may do in systems and data, as opposed to physical controls such as door locks. Two principles guide them, least privilege and separation of duties, and several access control models describe how decisions are made.
How it works
Principle of least privilege (PoLP)
Give each identity only the access it needs to do its job, for only as long as it needs it.
- A support AI assistant that summarizes tickets gets read access to the ticket queue, not administrator rights.
- An agent that only reads payroll records for reports should have read-only access, not write access.
- Administrator rights needed occasionally are granted just in time, per task, with approval and logging, rather than held permanently.
Separation of duties (SoD)
Split critical tasks so that no single person, or system, can complete them alone. The person who prepares a payment should not be the one who approves and releases it. If an AI assistant prepares payment batches, a different employee reviews and releases them.
Separation of duties stops one person or one compromised account from committing and hiding fraud. Look for answers where the preparer and the approver are different.
Access control models
| Model | How access is decided | Example |
|---|---|---|
| Discretionary (DAC) | The owner of a resource decides who gets access | A user shares a file with colleagues |
| Mandatory (MAC) | The system compares labels (classifications) with clearances; users cannot change them | Military classified systems |
| Role-based (RBAC) | Access follows job roles | All "ticket readers" get the same permissions |
| Rule-based | Fixed rules apply to everyone, regardless of role | No sign-ins outside 7 a.m. to 7 p.m. |
| Attribute-based (ABAC) | Decisions use attributes of the user, resource and context | Access only from managed devices in the finance department |
Other related controls
- Need to know: even with permission to a system, see only the data your task requires.
- Privileged access management: vault admin credentials, record admin sessions, use separate admin accounts.
- Multifactor authentication: stronger proof of identity before access is granted.
How the exam asks about this
- "Sign-ins are refused outside business hours whatever the role." Rule-based access control.
- "Permissions follow job functions." Role-based access control.
- "Admins use permanent domain admin accounts for daily work." Grant admin rights per task for a limited time, with logging.
What to remember for the exam
- Least privilege: only the access needed, only for as long as needed.
- Separation of duties: no one person or system completes a critical task alone.
- DAC is owner-decided; MAC uses labels; RBAC uses roles; rule-based uses fixed rules; ABAC uses attributes.
- Just-in-time access reduces standing admin rights.
- AI agents follow the same principles as people.
Logging every action does not fix excess access. Remove the permissions that are not needed.
Common mistakes
Mixing up rule-based and role-based access control.
Granting broad admin rights for convenience.
Letting the same person prepare and approve a transaction.
Check yourself
Which model lets the resource owner decide who has access?
Discretionary access control (DAC).
What does separation of duties prevent?
One person or system completing a critical task alone.
How should rarely needed admin rights be granted?
Temporarily, per task, with approval and logging.
Topic 2 of 2 in Identity and Access Management (IAM) Concepts
Test yourself on Identity and Access Management (IAM) Concepts
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.