Library › Cybersecurity AI › IT and security teams

Write least-privilege notes from an access export

Practice: Setting limits and rules. About 5 minutes.

About this exercise

Write the quarterly access review notes. Policy: remove access unused for 90 days or more, remove admin rights from anyone outside IT, disable contractors after their end date, and remove access from a person's old department after a move. Accounts with a documented exception stay as they are. List only accounts that need a change, numbered, each with the action and the policy reason. Plain text, under 90 words.

Common mistakes when you ask AI for this

  • Not giving the policy. The AI applies its own idea of least privilege and flags the backup service account and the 89-day user. Try: Spell it out: "Remove access unused 90+ days, admin only in IT, contractors off after end date, exceptions stay."
  • Reviewing every account. The AI writes a line for all 8 accounts, including the ones that are fine. Try: Add: "List only accounts that need a change."
  • Vague actions. The AI says 'review access' instead of saying what to remove. Try: Ask: "Name the exact role to remove or say disable account."
  • No reason given. Auditors need to see which rule each change comes from. Try: Say: "End each line with the policy reason."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 90 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 70 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the audit record they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Gives the policy
  • Lists only changes
  • Asks for the reason
  • Sets a word limit
  • Asks for plain text

Practice this now ↑

Related exercises