AC.L2-3.1.2Transaction & Function Control
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
[a]
the types of transactions and functions that authorized users are permitted to execute are defined; and[b]
system access is limited to the defined types of transactions and functions for authorized users.
App roles and denied APIs: users only get the transactions their job needs
Implementation
AO coverage. Addresses both Transaction & Function Control objectives.
Function catalog. For each CUI app, security and the app owner maintain a matrix of job functions → app roles (read, contribute, admin). “Admin” roles are eligible-only and time-bounded.
Enforcement. SSO asserts group → role mapping. Users cannot self-elevate inside the app; role changes require a ticket approved by the data owner and provisioned by IT (separate people).
Denied by default. APIs and UI actions that export bulk CUI or change sharing are limited to the contribute/admin roles. Read-only users cannot invoke those transactions.
Maintenance. Semi-annual review of the matrix against actual role assignments. After vendor feature releases, re-check that new privileges did not land in the default role.
Accepted gap. One legacy web form inside a SaaS app cannot hide a “share externally” button for read-only users. DLP blocks external share of labeled files; the button remains but the action fails closed.
What the evidence looks like
- Job-function → app-role matrix signed by the data owner
- IdP group-to-role mapping export
- Sample ticket showing requester ≠ provisioner for a role change
- Test notes showing read-only user cannot complete bulk export
Environment
Tools
2 ratings on this revision
Across the finish line
Separating standing admin from just-in-time elevation with ticket linkage is testable. Good model for a small OSC.
Across the finish line
Transaction-based access with explicit deny for standing privileges is a clean read of the objective. Evidence list matches what I would sample.
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.