SECAI Core · phase 10 of 15
Access control
The process of determining and assigning privileges to resources, objects, and data. Each resource has an access control list (ACL) specifying what subjects (users and hosts) can do.
The Explain card
- Plain English
- Access control is the process of deciding and assigning who may do what to which resources, objects and data. Each resource carries an access control list (ACL) saying which subjects, users or hosts, can act on it.
- Example
- A retrieval-augmented system indexes company documents. Each chunk inherits the ACL of its source file, so when the model fetches context for a user, it only pulls passages that user is already allowed to read.
- Why it matters
- Models flatten permissions by default: if the data is in the index, the model will happily use it. Carrying ACLs through to retrieval and tools is how defenders stop AI becoming a universal key.
- Hook
- The guest list, enforced at every door.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
