Chapter 11 — Supervised laboratory
Lesson map
Lesson 11 published. Map, example, EX051.
flowchart TD
N0["Learning outcomes"]
N1["11.1 The lab"]
N2["Lab — Finding permissions beyond role needs"]
N3["11.2 Results"]
N4["11.3 Reporting carefully"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX051"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 The lab"]
N2["Lab — Finding permissions beyond role needs"]
N3["11.2 Results"]
N4["11.3 Reporting carefully"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]
[Learning outcomes]
|
v
[11.1 The lab]
|
v
[Lab — Finding permissions beyond role needs]
|
v
[11.2 Results]
|
v
[11.3 Reporting carefully]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX051]
Learning outcomes
You will (1) carry out a contained access review lab; (2) find excessive permissions; (3) report results with care.
11.1 The lab
Ines sets a supervised lab using synthetic data modelled on Thornbury's case management system. The task is to compare each user's permissions with their job role and identify excess access. The lab runs entirely offline on generated names and roles, so no real person's data is involved. Owen first writes down the expected permissions for each role with help from a synthetic role description, because a review is only as good as its definition of what each job needs. Ines approves the role definitions before Owen runs the comparison.
Lab — Finding permissions beyond role needs
# Compare user permissions with role needs (synthetic case management data).
need = {"housing": {"cases"}, "safeguarding": {"cases", "safeguarding"}, "finance": {"rent"}, "temp": {"cases"}}
users = [("u1", "housing", {"cases"}, True), ("u2", "housing", {"cases", "safeguarding"}, True),
("u3", "housing", {"cases", "safeguarding"}, True), ("u4", "safeguarding", {"cases", "safeguarding"}, True),
("u5", "finance", {"rent", "case-edit"}, True), ("u6", "finance", {"rent"}, True),
("u7", "temp", {"cases"}, False), ("u8", "housing", {"cases"}, True), ("u9", "safeguarding", {"cases", "safeguarding"}, True)]
found = 0
for u, role, has, contract_active in users:
issues = sorted(has - need[role]) + ([] if contract_active else ["account active after contract end"])
if issues: found += 1; print(f"{u} ({role}): {', '.join(issues)}")
print(f"{found} of {len(users)} users need action")
Run with python3 lab_access.py. Verified output:
u2 (housing): safeguarding
u3 (housing): safeguarding
u5 (finance): case-edit
u7 (temp): account active after contract end
4 of 9 users need action
11.2 Results
The lab finds four users with excess permissions: two housing officers with safeguarding note access they no longer need after changing teams, a finance assistant with case editing rights and a temporary worker whose contract has ended but whose account is still active. Owen ranks them by risk: the active leaver account and safeguarding access first, because they expose the most sensitive data. Ines checks his ranking and agrees, noting that ranking by sensitivity helps busy owners act on the most important items first.
11.3 Reporting carefully
Owen writes the lab report as he would at work: role names and counts in the main text, individual names in a restricted appendix, recommended actions and the evidence for each. He notes that the lab could not see permissions granted inside documents or shared folders outside the system. Ines grades the report highly for its care with personal data and its honest limits. She reminds him that a real review would also need the system owner's confirmation before any access is removed.
Worked example
Owen runs an offline access review lab, finds four excess permissions, ranks them by sensitivity and reports carefully with limits.
Synthetic case. All lab data is synthetic.
Errors and limits
Role definitions may be wrong. Access outside the system remains invisible.
Exercises
- EX051 — Definition first. Why define expected permissions before the review? Rubric: 3 = a review is only as good as its definition of needs;; 2 = baseline;; 1 = vague;; 0 = none.
- EX052 — Lab finding count. How many users had excess permissions in the lab? Rubric: 3 = 4 of 9;; 2 = four;; 1 = vague;; 0 = none.
- EX053 — Top risks. Which findings ranked highest? Rubric: 3 = the active leaver account and unneeded safeguarding access;; 2 = two;; 1 = finance;; 0 = none.
- EX054 — Report structure. Where do individual names go in Owen's report? Rubric: 3 = a restricted appendix;; 2 = appendix;; 1 = main text;; 0 = none.
- EX055 — Lab blind spot. What could the lab not see? Rubric: 3 = permissions inside documents or shared folders outside the system;; 2 = outside access;; 1 = vague;; 0 = none.
Synthesis
A careful access review defines needs first, ranks excess by sensitivity and reports with respect for personal data.
Continue studying — chapter 11 of 12
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →