{"id":"sec-it-mfa-exclusion-review","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Review who is excluded from sign-in approvals","free":false,"task":"Review the accounts excluded from sign-in approvals (MFA). Policy allows exclusions only for the 2 named break-glass accounts and for service accounts with an exception ID that hasn't expired (today is Nov 6, 2026). List only accounts to remove from the exclusion group, numbered, as 'account - reason it doesn't qualify'. Plain text, under 70 words.","materialLabel":"Exclusion group export (attached to your prompt automatically)","material":"Group: MFA-Excluded (exported Nov 6, 2026)\n\naccount            | type      | exception ID | exception expires | added by | note\nbg-admin-01        | break-glass | -          | -                 | IT       | sealed envelope in safe\nbg-admin-02        | break-glass | -          | -                 | IT       | sealed envelope in safe\nsvc-scanner        | service   | EX-14        | 2027-03-31        | IT       | copier scan-to-email\nsvc-old-crm        | service   | EX-09        | 2026-06-30        | IT       | CRM retired in July\nr.patel            | user      | -            | -                 | helpdesk | \"phone broken, temporary\" (added Aug 2)\nceo.assistant      | user      | -            | -                 | IT       | \"CEO asked, too many prompts\"\nsvc-backup         | service   | -            | -                 | IT       | backup agent\n\nPolicy (IAM-4): Only bg-admin-01 and bg-admin-02 are break-glass accounts. Service accounts need a current exception ID. User accounts are never excluded.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Accepting the notes","why":"The AI keeps the CEO's assistant because the CEO asked, or r.patel because it says temporary.","fix":"Say: \"User accounts are never excluded, whoever asked.\"","checks":["r0","r1"]},{"title":"Missing the expiry","why":"Without today's date, the AI doesn't notice EX-09 has expired.","fix":"Add: \"Today is Nov 6, 2026; expired exceptions don't count.\"","checks":["r1"]},{"title":"Reviewing every row","why":"The AI comments on all 7 accounts.","fix":"Ask: \"List only accounts to remove.\"","checks":["numberedItems","r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 70 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 50 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the access review they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the policy","patterns":["break-?glass","exception id","user accounts","policy"]},{"label":"Gives today's date","patterns":["today","nov(ember)? 6","expir"]},{"label":"Lists only removals","patterns":["only (the )?accounts","remove","doesn'?t qualify"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Exclusion lists grow through favors and forgotten exceptions. Give the AI the exact policy and today's date, and ask only for what must be removed.","rubricLabels":["Lists exactly svc-old-crm, r.patel, ceo.assistant and svc-backup, and not bg-admin-01, bg-admin-02 or svc-scanner","The reasons match: svc-old-crm's exception expired (2026-06-30), r.patel and ceo.assistant are user accounts (never excluded, no matter who asked), svc-backup has no exception ID","Every line follows 'account - reason'"]}