{"id":"sec-it-access-review-least-privilege","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Write least-privilege notes from an access export","free":false,"task":"Write the quarterly access review notes. Policy: remove access unused for 90 days or more, remove admin rights from anyone outside IT, disable contractors after their end date, and remove access from a person's old department after a move. Accounts with a documented exception stay as they are. List only accounts that need a change, numbered, each with the action and the policy reason. Plain text, under 90 words.","materialLabel":"Access export, review date Nov 6, 2026 (attached to your prompt automatically)","material":"user | dept | access | last login | notes\na.chen | Finance | Finance-ReadWrite, Global Admin | 2 days ago | -\nb.osei | IT | Global Admin | 1 day ago | -\nc.miller | Marketing | Marketing-Editor | 143 days ago | -\nd.ross | Engineering (contractor) | Repo-Write | 3 days ago | contract end date Oct 31, 2026\nsvc-backup | Service account | Backup-Operator | 200 days ago | exception EX-12 approved by CISO, valid to 2027\ne.kim | Sales | Sales-CRM, HR-Records | 5 days ago | moved from HR to Sales on Sep 1, 2026\nf.diaz | Finance | Finance-ReadOnly | 89 days ago | -\ng.patel | Sales | Sales-CRM | 10 days ago | -","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Not giving the policy","why":"The AI applies its own idea of least privilege and flags the backup service account and the 89-day user.","fix":"Spell it out: \"Remove access unused 90+ days, admin only in IT, contractors off after end date, exceptions stay.\"","checks":["r0"]},{"title":"Reviewing every account","why":"The AI writes a line for all 8 accounts, including the ones that are fine.","fix":"Add: \"List only accounts that need a change.\"","checks":["numberedItems"]},{"title":"Vague actions","why":"The AI says 'review access' instead of saying what to remove.","fix":"Ask: \"Name the exact role to remove or say disable account.\"","checks":["r1"]},{"title":"No reason given","why":"Auditors need to see which rule each change comes from.","fix":"Say: \"End each line with the policy reason.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 90 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 70 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the audit record they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the policy","patterns":["90","contractor","end date","outside it","exception"]},{"label":"Lists only changes","patterns":["only (the )?accounts","need(s)? (a )?change","skip","leave out"]},{"label":"Asks for the reason","patterns":["reason","why","policy"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Least privilege means your policy, not the AI's. Give it the exact rules, including exceptions, and ask only for the accounts that need action.","rubricLabels":["Lists exactly a.chen, c.miller, d.ross and e.kim, and does not list b.osei, svc-backup, f.diaz or g.patel","The actions match: a.chen remove Global Admin, c.miller remove or disable unused access, d.ross disable (contract ended Oct 31), e.kim remove HR-Records","Each line names the policy reason (admin outside IT, unused 90+ days, contract ended, department move)"]}