Access Control

Access Control

Design an identity and access management strategy for "$ARGUMENTS". Define the access control model, role hierarchy, least-privilege enforcement, and multi-factor authentication requirements.

Prerequisites

Read .metapowers/security/$ARGUMENTS/00-govern.md. If this file does not exist, tell the user:

Phase 0 (Govern) has not been completed for "$ARGUMENTS". Run a Govern skill first (e.g., /security:security-policy $ARGUMENTS), or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check and log to .metapowers/security/$ARGUMENTS/skip-log.md.

Process

1. Define access control model:

   • Evaluate RBAC (Role-Based Access Control) — recommended for most organizations, simpler to manage and audit
   • Evaluate ABAC (Attribute-Based Access Control) — for complex, context-dependent access decisions (time-of-day, location, device, data sensitivity)
   • Consider hybrid approaches where RBAC provides baseline with ABAC for fine-grained decisions
   • Document the chosen model with justification

2. Create role hierarchy and permissions matrix:

   • Define roles aligned to job functions (not individuals)
   • Create permissions matrix mapping roles to resources and actions (read, write, delete, admin)
   • Implement role hierarchy (senior roles inherit permissions from junior roles)
   • Identify separation-of-duties constraints (no single role should both approve and execute)
   • Document role assignment and removal procedures

3. Implement least privilege:

   • Audit current permissions against actual usage (identify over-provisioned accounts)
   • Define minimum permissions required per role for each system and resource
   • Implement just-in-time (JIT) access for elevated privileges (time-limited, approval-required)
   • Remove standing admin access where possible in favor of on-demand elevation
   • Set up periodic access reviews to detect permission drift

4. Define MFA requirements:

   • Require MFA for all administrative access and privileged operations
   • Define MFA methods by access level (hardware keys for admins, authenticator apps for standard users)
   • Implement MFA for remote access, VPN, and cloud console access
   • Define backup authentication methods for MFA device loss
   • Plan phishing-resistant MFA (FIDO2/WebAuthn) adoption timeline

5. Govern service accounts:

   • Inventory all service accounts and their permissions
   • Assign ownership for each service account (a human is responsible)
   • Implement credential rotation for service accounts
   • Restrict service account permissions to minimum required
   • Disable interactive login for service accounts where possible

6. Define access review and emergency procedures:

   • Set access review cadence (quarterly for privileged access, semi-annual for standard)
   • Define access certification process (managers attest to direct reports' access)
   • Design break-glass procedure for emergency access (pre-provisioned, heavily monitored, time-limited)
   • Define offboarding procedure (immediate access revocation, credential rotation for shared resources)

7. Write the artifact to .metapowers/security/$ARGUMENTS/02-protect.md with heading:

   Access Control Strategy

   Include sections:

   • Access Control Model — chosen model (RBAC/ABAC/hybrid) with justification
   • Role Hierarchy — roles, inheritance, and separation of duties
   • Permissions Matrix — roles mapped to resources and allowed actions
   • Least Privilege Implementation — JIT access, permission minimization, review cadence
   • MFA Requirements — MFA methods by access level with adoption timeline
   • Service Account Governance — inventory, ownership, and rotation policy
   • Emergency Access — break-glass procedures and monitoring

Output

The access control strategy written to .metapowers/security/$ARGUMENTS/02-protect.md. Present a summary to the user highlighting:

• Chosen access control model and key roles defined
• Least-privilege gaps identified and remediation plan
• MFA coverage and phishing-resistant MFA timeline
• Access review cadence and break-glass procedure summary