Lesson 3 — Roles, Authentication, Authorization, Access & Entitlement
Security is collaborative
Data Management cannot simply hand security to Information Security and walk away.
- Data Stewards / business owners — know business meaning, sensitivity, legitimate use, and which roles need access.
- Information Security — understands technical controls, attack patterns, encryption, identity, monitoring, and security architecture.
- Data Governance — decision rights, policy oversight, classification authority, escalation, enterprise alignment.
- Legal / compliance — interprets external obligations.
- Auditors — independently test whether policies and controls work.
- Architects / modelers — locate sensitive data and design structures that express classification/access requirements.
- DBAs / application teams — implement database/application controls.
Chain of custody: responsibility must stay explicit as data moves across roles, systems, vendors, and organizations.
The Four A’s + Entitlement
Authentication — “Who are you?”
Verify that a user/system is the claimed identity.
Authorization — “What may you do?”
Grant privileges based on identity, role, policy, classification, and business need.
Access — “What are you actually able to use?”
The actual ability/use of data or systems after authorization.
Entitlement — “What total data/capability exposure did the grant create?”
One role or authorization may expose more columns, tables, views, or capabilities than the designer realizes. Entitlement inventory is therefore essential.
Audit — “Can an independent reviewer prove what happened and whether it complied?”
Audit evaluates actions, controls, logs, and evidence against criteria.
Entitlement is best thought of as the scope produced by the authorization, not merely another login step.
Example chain
Jordan authenticates with company credentials. Jordan is authorized for a Customer-Service role. The entitlement includes contact data, shipping address, and last four account digits—but not full payment details. Jordan opens a customer record (access). A bulk export triggers monitoring. Internal Audit later tests whether role grants matched approved policy.
Least privilege made concrete
Least privilege means the minimum sufficient access for legitimate work, not the smallest possible access regardless of business need.
Access removal is part of the control lifecycle. Transfers, terminations, and ended vendor engagements require prompt revocation and periodic recertification.
Exam discriminator
If identity is already verified and the user sees payroll data outside the job, Authentication succeeded. The failure is Authorization / Entitlement.
Source anchor: pp. 216–218 and role/control sections pp. 238–243.