AI access and approval matrix

Explicit permissions. Named owners. Revocable access.

This sample shows a deliverable format. It is not a client case study, completed assessment, certification, or assurance of security. Use your browser’s print option to save a PDF.

Use case

Fictional example: an internal assistant prepares draft supplier summaries.

Data boundary

Approved supplier documents only. No credentials, payment details, personnel records, or unrelated customer information.

Read access

Read-only access to an approved folder, using a dedicated identity. Owner: procurement systems lead.

Write and send actions

Drafts remain in a review queue. A named employee approves any external message or update to a business system.

Logging and review

Record document sources, tool actions, approval decisions, and exceptions. Define retention and review with the relevant owners.

Revocation

System owner can disable the identity, revoke tokens, and remove folder access. Confirm the workflow stops during an agreed exercise.

Evidence and limitations

Illustrative only. Permissions and controls must be validated for the actual system before use.