Maps 7–9 — Roles, Masking, Privilege Risk

Map 7 — Role-Based Access

DATA-FIRST                         USER-FIRST
Classification + Regulation        Workgroup / Job Family
          ↓                                ↓
     ROLE GRID                       ROLE HIERARCHY
          ↓                         inherit / restrict
          └──────────┬─────────────────────┘
                     ↓
             ENTITLEMENT / CRUD
                     ↓
               LEAST PRIVILEGE

Answer check: Role Grid starts with data/classification. Role Hierarchy starts with users/workgroups. CRUD maps operations; RACI maps accountability.

Map 8 — Masking Decision

Must the stored target value be permanently altered?
          │
       YES ──> PERSISTENT MASKING
          │        ├─ moving to target? → IN-FLIGHT
          │        └─ same location?     → IN-PLACE
          │
        NO ──> Must source truth stay intact but display be protected?
                         └─ YES → DYNAMIC MASKING

Answer check: call-center last four with full Production truth = Dynamic. Permanently altered test copy during extract/load = In-flight Persistent.

Map 9 — Privilege-Risk Discriminator

Too much access GRANTED
      → EXCESSIVE PRIVILEGE

Correct access, WRONG USE / PURPOSE / VOLUME
      → LEGITIMATE-PRIVILEGE ABUSE

Lower rights become HIGHER / ADMIN through exploit
      → PRIVILEGE ELEVATION

Changed-fact test: a large export can be excessive privilege or legitimate abuse. Ask whether the permission should have existed at all.

Source anchors: Chapter 7 role/access, masking, and database-risk sections.

← Maps 4–6 · Maps 10–12 →