{"id":"PLT-008","section":"Platform, Privacy & Assurance","requirement":"Separate administrative roles, and authenticate them through enterprise SSO","acceptance":"Separate policy, approval, administration, investigation and exception duties; authenticate administrators through enterprise SSO; apply least-privilege roles over policy, alerts, raw prompts, exports and dashboards; and record administrative and investigative actions.","tier":"Tier-independent","whyItMatters":"Whoever can change policy or read prompts holds a lot of power, so roles must be separated and every action recorded.","verificationMethod":"W","verificationTest":"Show separate policy, investigation and exception roles, SSO login and the record of an admin action.","formerly":"POL-002","alsoIn":["audit"],"sort":62,"adoptionContext":"Administrative role separation and enterprise authentication apply to governance of workforce AI regardless of the end-user adoption tier.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Separating administrative duties, authenticating administrators through enterprise SSO and restricting access to prompts, exports and policy functions implement authenticated, least-privilege administration. Recorded administrative and investigative actions provide an activity trail. The role assignments must actually prevent conflicting duties; SSO alone does not establish authentication strength.\nISO/IEC 27001: A.5.3: Adopt the organizational process and validate this requirement against the buyer’s actual ISMS scope; product availability is not implementation. A.8.3: Apply restrictions before the operation. A.8.5: SSO must meet buyer-approved authentication requirements; its presence alone does not prove MFA or session strength. A.8.15: Logs need usable attribution and appropriate retention, protection and analysis; a live view alone is insufficient.","kind":"framework","references":{"csf":["GV.RR-02","PR.AA-03","PR.AA-05"],"soc2":["CC6.1","CC6.3"],"iso27001":["A.5.3","A.8.2","A.8.3","A.8.5","A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Distinct policy, approval, investigation and exception duties make AI-risk responsibilities and authorities concrete. The roles provide evidence for governance assignments and lines of responsibility; these references do not prescribe enterprise SSO or establish every organization-wide role and communication path.","kind":"framework","references":{"rmf":["GOVERN 2.1"],"iso":["A.3.2","Cl. 5.3"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-008","frameworkRefs":{"ISO27001":["A.5.3","A.8.2","A.8.3","A.8.5","A.8.15"],"ISO42001":["A.3.2","Cl. 5.3"],"NIST-CSF":["GV.RR-02","PR.AA-03","PR.AA-05"],"NIST-AI-RMF":["GOVERN 2.1"],"SOC2":["CC6.1","CC6.3"]}}