PR.AA-05 says access permissions are "defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties". Evidence needs a written policy, role definitions, permission exports and review records, plus a control that stops one person shipping their own change.
Break the sentence into five checks
PR.AA-05 is in the Protect function, in the category for identity management, authentication and access control. Its text packs in several ideas.
| Phrase | What to show |
|---|---|
| Defined in a policy | Written access policy with role definitions |
| Managed | Request and approval records |
| Enforced | Settings that make the rules real, such as roles and branch protection |
| Reviewed | Dated permission reviews with outcomes |
| Least privilege | Roles scoped to tasks, few standing admins |
| Separation of duties | Author cannot approve own change to production |
Treat each row as a small evidence package.
Engineering examples
For least privilege, show custom roles that grant only what a task needs, time limited elevation for admin work and narrowly scoped tokens. For separation of duties, show branch protection requiring review by someone other than the author, a deploy path where approval and execution differ and a split between who writes pipeline definitions and who administers secrets.
For enforcement, export the settings rather than describing them. Branch rules, required reviewers and environment protection rules are all visible in configuration.
Steps to assemble the package
- Write a one page access policy that states the principles and the review cadence.
- Define roles for each system and write what each role may do.
- Export current permissions and compare with the role definitions. Remove extras.
- Turn on enforced review for changes to production code and pipeline definitions.
- Run a review each quarter, and attach the export, the decisions and the follow up changes.
- Keep a list of exceptions, such as a single person team that cannot separate duties, with compensating controls like after the fact review.
Small teams sometimes cannot fully separate duties. Say so, and show what compensates.
What assessors may probe
They may pick a recent production change and ask who wrote it, who reviewed it and who deployed it. They may pick a leaver and ask when access ended. They may ask to see the people with admin rights. Prepare those three traces ahead of time and you will have answers to the most common sampling questions.
Where Safeguard fits
Safeguard includes agent identity and an MCP Guardrail, along with compliance and evidence automation, if you need access and tool call records for AI agents. You can try the free scan at gold.safeguard.sh/scan. An auditor decides what counts as sufficient evidence.
Quick check
Is least privilege measurable?
You can measure proxies: number of standing admins, share of tokens with narrow scopes, age of unused permissions. Report the trend.
Does CSF require separation of duties for every team?
The text names the principle. How you apply it depends on risk and size, and compensating controls should be documented where full separation is not possible.
Sources
Last reviewed: 19 October 2026.
