# IAM-03 Least-privilege scoping

Domain: IAM Identity, Access & Authorization · HI-AAF v1.3 · Public review · https://humanintel.net/standard/iam/iam-03

OAuth scopes, API permissions, and database privileges granted to agents follow the principle of least privilege, with documented justification for each scope.

Service accounts used by the agent are scoped to the minimum permissions necessary to fulfill the specification. OAuth scopes, API permissions, and database privileges each have documented justification. Over-provisioned permissions are the most common finding in IAM assessments: the control requires active right-sizing, not just a policy statement.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for IAM-03: Permission sets are documented for each agent with justification for each scope; a review of permissions has occurred within the documented cadence; over-provisioned scopes have been identified and remediated.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Permission sets are documented for each agent with justification for each scope.
- A review of permissions has occurred within the documented cadence.
- Over-provisioned scopes have been identified and remediated.

## Framework mappings

- NIST AI RMF: MANAGE 4.1
- ISO/IEC 42001: A.8.3
- SOC 2 (TSC): CC6.1, CC7.2
- EU AI Act: Art. 15(2)
- Singapore: AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by MAS-02 Agent-to-agent authentication: https://humanintel.net/standard/mas/mas-02

## Cite this control

Human Intelligence. HI-AAF v1.3, IAM-03 Least-privilege scoping. Public review edition, July 2026. https://humanintel.net/standard/iam/iam-03