# PLT-008: Separate administrative roles, and authenticate them through enterprise SSO


- Area: Platform, Privacy & Assurance

- Verification: Walkthrough
- OWASP adoption tier: Tier-independent
- Formerly: POL-002
- URL: /r/PLT-008

**Acceptance criteria:** Separate policy, approval, administration, investigation and exception duties; authenticate administrators through enterprise SSO; apply least-privilege roles over policy, alerts, raw prompts, exports and dashboards; and record administrative and investigative actions.

**Why it matters:** Whoever can change policy or read prompts holds a lot of power, so roles must be separated and every action recorded.

**How to verify:** Show separate policy, investigation and exception roles, SSO login and the record of an admin action.

**OWASP adoption context:** Administrative role separation and enterprise authentication apply to governance of workforce AI regardless of the end-user adoption tier.

**Mappings:**
- NIST CSF 2.0: GV.RR-02, PR.AA-03, PR.AA-05; SOC 2: CC6.1, CC6.3; ISO 27001: A.5.3, A.8.2, A.8.3, A.8.5, A.8.15 — Separating administrative duties, authenticating administrators through enterprise SSO and restricting access to prompts, exports and policy functions implement authenticated, least-privilege administration. Recorded administrative and investigative actions provide an activity trail. The role assignments must actually prevent conflicting duties; SSO alone does not establish authentication strength.
ISO/IEC 27001: A.5.3: Adopt the organizational process and validate this requirement against the buyer’s actual ISMS scope; product availability is not implementation. A.8.3: Apply restrictions before the operation. A.8.5: SSO must meet buyer-approved authentication requirements; its presence alone does not prove MFA or session strength. A.8.15: Logs need usable attribution and appropriate retention, protection and analysis; a live view alone is insufficient.
- NIST AI RMF: GOVERN 2.1; ISO 42001: A.3.2, Cl. 5.3 — Distinct policy, approval, investigation and exception duties make AI-risk responsibilities and authorities concrete. The roles provide evidence for governance assignments and lines of responsibility; these references do not prescribe enterprise SSO or establish every organization-wide role and communication path.