Back to standardsAI Access Control Standard
Minimum controls for authenticating and authorizing humans, apps, services, agents, tools, and runtimes.
Minimum controls
- No anonymous production AI access
- Caller/agent/service identity required
- Entitlement required for model/tool access
- Least privilege and periodic access review
- Access decisions logged and revocable
Related records and procedures
Records: Identity, Consumer, Agent, Entitlement, Access Review.
Procedures: Register identities, grant/review/revoke access.