Acceptance criteria
Separate policy, approval, administration, investigation and exception duties; authenticate administrators through enterprise SSO; apply least-privilege roles over policy, alerts, raw prompts, exports and dashboards; and record administrative and investigative actions.
Why it matters
Whoever can change policy or read prompts holds a lot of power, so roles must be separated and every action recorded.
How to verify
Show separate policy, investigation and exception roles, SSO login and the record of an admin action.
OWASP adoption context
Administrative role separation and enterprise authentication apply to governance of workforce AI regardless of the end-user adoption tier.
Framework mappings
- NIST CSF 2.0 GV.RR-02, PR.AA-03, PR.AA-05SOC 2 CC6.1, CC6.3ISO 27001 A.5.3, A.8.2, A.8.3, A.8.5, A.8.15
Separating administrative duties, authenticating administrators through enterprise SSO and restricting access to prompts, exports and policy functions implement authenticated, least-privilege administration. Recorded administrative and investigative actions provide an activity trail. The role assignments must actually prevent conflicting duties; SSO alone does not establish authentication strength. ISO/IEC 27001: A.5.3: Adopt the organizational process and validate this requirement against the buyer’s actual ISMS scope; product availability is not implementation. A.8.3: Apply restrictions before the operation. A.8.5: SSO must meet buyer-approved authentication requirements; its presence alone does not prove MFA or session strength. A.8.15: Logs need usable attribution and appropriate retention, protection and analysis; a live view alone is insufficient.
Distinct policy, approval, investigation and exception duties make AI-risk responsibilities and authorities concrete. The roles provide evidence for governance assignments and lines of responsibility; these references do not prescribe enterprise SSO or establish every organization-wide role and communication path.