> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/company-operating-manual/security-compliance-and-data/access-control.md).

# Access Control

### Purpose

Access control ensures that only authorised people can access systems, repositories, data, and environments.

### Access Principles

* least privilege
* role-based access
* named user accounts
* no shared credentials
* timely removal of access
* periodic access review
* multi-factor authentication where required

### Access Request

Access requests should record:

* requester
* role
* system
* reason
* approval
* access level
* start date
* end date
* review date

### Offboarding

Access must be removed when:

* a person leaves the project
* a supplier engagement ends
* a role changes
* the customer requests removal
* access is no longer needed