Access Policy
A permission configuration — roles, resources, conditions, and enforcement that controls access.
Why This Object Matters for AI
AI access analysis and least-privilege enforcement require policy data; compliance depends on policy management.
Security & Compliance Capacity Profile
Typical CMC levels for security & compliance in SaaS/Technology organizations.
CMC Dimension Scenarios
What each CMC level looks like specifically for Access Policy. Baseline level is highlighted.
Access policy configuration is entirely informal — developers add IAM roles and resource permissions ad-hoc, and there's no documented standard for how access policies should be structured, reviewed, or enforced across SaaS services.
None — AI has no access policy definitions or standards to evaluate or enforce.
Document basic access policy standards defining role naming conventions, resource permission templates, and required conditions (MFA, IP restrictions) for sensitive operations.
A general access policy document states principles like 'least privilege' and 'no wildcard permissions,' but specific rules for which roles get which SaaS resource permissions are not defined — enforcement depends on which engineer writes the policy JSON.
Can reference the policy standards document but cannot operationalize it because rules are stated as principles rather than specific role-to-permission mappings.
Define specific role-to-permission mappings for each SaaS service specifying allowed actions, resource scopes, and required conditions per role tier.
Role-to-permission mappings define allowed actions and resource scopes per SaaS service, but conditional access requirements (time-based restrictions, device posture checks), periodic review schedules, and automatic revocation triggers are not formalized.
Can validate access policy changes against role mappings but cannot enforce conditional access requirements or detect when policy reviews are overdue.
Formalize conditional access requirements (device posture, network location, time windows), mandatory review schedules per permission tier, and automatic revocation triggers for offboarding and role changes.
Access policy rules define role-based permission templates, conditional access requirements (device posture, geolocation, time windows), periodic review schedules per sensitivity tier, and automatic revocation triggers for offboarding and lateral transfers.
Can enforce access policies end-to-end — validating permission requests, evaluating conditions, scheduling reviews, and triggering revocation based on HR events and compliance signals.
Encode access policy rules in machine-readable policy-as-code (OPA/Cedar) with automated enforcement, condition evaluation, and exception handling workflows.
Machine-readable policy-as-code (OPA/Cedar) enforces access policy rules automatically — role validation, condition evaluation, separation-of-duties checks, and exception routing execute programmatically with full audit trails and drift detection.
Can autonomously enforce access policies across all SaaS services — automated permission validation, condition evaluation, violation remediation, and compliance evidence generation.
Deploy adaptive access policy logic that adjusts permission conditions based on behavioral risk scoring, usage pattern analysis, and organizational restructuring signals in real time.
Adaptive access policy logic adjusts in real time — permission conditions tighten for anomalous behavior patterns, new roles auto-generate policy templates from peer permission analysis, and unused permissions auto-recommend for revocation.
Can autonomously manage the full access policy lifecycle — creation, enforcement, adaptation, and decommission — based on real-time behavioral and organizational signals.
Ceiling of the CMC framework for this dimension.
Capabilities That Depend on Access Policy
Other Objects in Security & Compliance
Related business objects in the same function area.
Security Vulnerability
EntityA discovered security weakness — CVE, severity, affected systems, and remediation status.
Security Event
EntityA logged security occurrence — type, source, target, and risk level that enables threat detection.
Compliance Control
EntityA required security measure — framework, control ID, implementation status, and evidence.
User Identity
EntityAn authenticated user record — credentials, roles, last access, and risk indicators.
What Can Your Organization Deploy?
Enter your context profile or request an assessment to see which capabilities your infrastructure supports.