{"id":"sec-mgr-access-requests-approval","audience":"managers","category":"security","track":"security","technique":"constraints","title":"Decide on access requests using the access policy","free":false,"task":"Four people on your team asked for system access. Decide each one using the access policy, as exactly 4 numbered lines like '1. Name - Approve / Deny / Approve until DATE - reason'. Approve only what the person's job needs, and give temporary access an end date. Plain text, under 90 words.","materialLabel":"Access requests and the policy (attached to your prompt automatically)","material":"Access policy (Operations, section 2):\n2.1 Approve access only if the person's current job needs it.\n2.2 Access for a project or cover gets an end date matching the project or cover period.\n2.3 Admin rights on any system go to IT only. Managers can't approve them.\n2.4 Nobody gets access \"just in case\".\n\nRequests this week (you are their manager):\n1. Leila (Ops analyst): read access to the Shipping Dashboard. She builds the weekly shipping report, her main task.\n2. Tom (Ops coordinator): Admin on the Warehouse Scheduler \"so I can fix things faster when IT is slow\".\n3. Kenji (Ops analyst): access to the Payroll Reports folder. He's covering for Ana in Finance from Nov 10 to Nov 21 while she's on leave; the cover includes running the payroll report.\n4. Rosa (Ops intern): edit access to the Supplier Contracts folder \"in case I need it someday\".\n\nNotes: Tom has been frustrated with IT response times. Kenji's cover was approved by Finance.","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Saying yes to everyone","why":"The AI sympathizes with Tom's frustration and approves with a caution.","fix":"Say: \"Decide using the policy only. Managers can't approve admin rights.\"","checks":["r0","r1"]},{"title":"Forgetting end dates","why":"The AI approves Kenji's cover access with no end date, so it stays forever.","fix":"Add: \"Temporary access gets an end date.\"","checks":["r0","r2"]},{"title":"No clear decision shape","why":"The AI writes 'probably fine' or 'consider limiting'.","fix":"Give the shape: \"Name - Approve / Deny / Approve until DATE - reason.\"","checks":["r2","numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 90 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 70 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the access tool they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Uses the policy","patterns":["policy","2\\.\\d","job needs"]},{"label":"Gives decision labels","patterns":["approve","deny","until"]},{"label":"Asks for end dates","patterns":["end date","temporary","until"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(line|request|item)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Access decisions should follow the policy, not sympathy. Give the AI the exact decision labels and ask for an end date on anything temporary.","rubricLabels":["Leila is Approve, Tom is Deny, Kenji is Approve until Nov 21, and Rosa is Deny","Tom's reason says admin rights can only go to IT (2.3), and Rosa's says no 'just in case' access (2.4)","Each line follows 'Name - decision - reason' and only Kenji's has an end date"]}