Enforce user access privileges to AI systems

Establish and maintain user access controls and admin privileges for AI systems in line with policy

Keywords

Access Controls

Organizational Policy

Application

Mandatory

Frequency

Every 3 months

Type

Preventative

Crosswalks

AML-M0005: Control Access to AI Models and Data at Rest

AML-M0019: Control Access to AI Models and Data in Production

LLM02:25 - Sensitive Information Disclosure

LLM06:25 - Excessive Agency

LLM10:25 - Unbounded Consumption

DSP-07: Data Protection by Design and Default

DSP-08: Data Privacy by Design and Default

IAM-01: Identity and Access Management Policy and Procedures

IAM-02: Strong Password Policy and Procedures

IAM-03: Identity Inventory

IAM-04: Separation of Duties

IAM-05: Least Privilege

IAM-06: User Access Provisioning

IAM-07: User Access Changes and Revocation

IAM-08: User Access Review

IAM-09: Segregation of Privileged Access Roles

IAM-10: Management of Privileged Access Roles

IAM-13: Uniquely Identifiable Users

IAM-14: Strong Authentication

IAM-15: Passwords and Secrets Management

IAM-16: Authorization Mechanisms

IAM-17: Knowledge Access Control - Need to Know

IAM-18: Output Modification and Special Authorization

LOG-04: Audit Logs Access and Accountability

LOG-09: Log Protection

LOG-12: Access Control Logs

Control activities

Typical evidence

Implementing system-level access controls tailored to AI systems. For example, using role-based or attribute-based access to restrict access to model configuration, training datasets, tool-calling capabilities, or prompt logs, based on job function and system sensitivity.

Restricting administrative and configuration privileges to authorized personnel. For example, limiting ability to alter system behavior, tools, or models.

B007.1 Config: User access controls

Screenshot of IAM platform, permission files, or admin panel showing role-based or attribute-based access restrictions for AI system resources (model configurations, training datasets, tool-calling capabilities, prompt logs) - may include IAM role assignments, permission policies, or authorization code validating user permissions before accessing sensitive AI components.

AIUC-1 is built with industry leaders

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Phil Venables

Former CISO of Google Cloud

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."