<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-access-governance
description: >-
  Implement data access governance frameworks including role-based access
  control, entitlement reviews, just-in-time access, data ownership models,
  and access certification to enforce least privilege across data stores.
domain: cybersecurity
subdomain: data-security
tags:
  - data-governance
  - access-control
  - rbac
  - least-privilege
  - entitlement-review
  - jit-access
  - data-ownership
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Implementing Data Access Governance

## Overview

Data access governance ensures that only authorized users access data
appropriate to their role, for legitimate purposes, for appropriate duration.
It combines RBAC/ABAC policies, entitlement reviews, just-in-time access,
data ownership assignment, and access certification campaigns. Effective
governance reduces insider threat risk, meets regulatory requirements
(SOX 404, GDPR Art. 25, HIPAA §164.312), and enables rapid access
revocation during incidents.

Mode: `[MODE: ARCHITECT]` — Access governance design and implementation.

## Prerequisites

- Identity provider with group/role management (AD, Okta, Entra ID)
- Data classification with ownership assignments
- Access request and approval workflow tooling
- Database and application access logging

## Key Concepts

### Governance Framework

| Component | Description | Frequency |
|-----------|-------------|-----------|
| RBAC design | Role-to-data mapping | Initial + change-driven |
| Access provisioning | Request, approve, grant workflow | On-demand |
| Just-in-time (JIT) | Temporary elevated access | As needed |
| Entitlement review | Manager certifies team access | Quarterly |
| Access certification | Full review of all data access | Semi-annual |
| Orphan cleanup | Remove access for departed users | Continuous |

### Access Control Models

```
Access governance layers:
├── Role-Based Access Control (RBAC)
│   ├── Define roles aligned to job functions
│   ├── Map roles to data access permissions
│   ├── Enforce separation of duties
│   └── Review role membership quarterly
├── Attribute-Based Access Control (ABAC)
│   ├── Department + classification + time = access decision
│   ├── Location-based restrictions (geo-fencing)
│   ├── Device compliance requirements
│   └── Data sensitivity-aware policies
├── Just-in-Time Access
│   ├── Temporary elevation for specific tasks
│   ├── Automatic expiration after time window
│   ├── Approval workflow with business justification
│   └── Full audit trail of JIT sessions
└── Data Ownership Model
    ├── Each data set has assigned owner
    ├── Owner approves access requests
    ├── Owner participates in certification
    └── Owner responsible for classification accuracy
```

### Scanning CLI

```bash
# Audit access permissions against RBAC policy
node scripts/agent.js --action audit --input /tmp/access_matrix.json \
  --policy /tmp/rbac_policy.json --output /tmp/access_audit.json

# Detect orphaned access (users no longer active)
node scripts/agent.js --action orphans --input /tmp/access_matrix.json \
  --active-users /tmp/active_users.json --output /tmp/orphans.json

# Generate access certification report
node scripts/agent.js --action certify --input /tmp/access_matrix.json \
  --output /tmp/certification.json
```

## Workflow

### Step 1: Define RBAC Model

Map roles to data access permissions based on job functions.

### Step 2: Audit Current Access

```bash
node scripts/agent.js --action audit --input /tmp/access_matrix.json \
  --policy /tmp/rbac_policy.json
```

### Step 3: Detect Orphaned Access

```bash
node scripts/agent.js --action orphans --input /tmp/access_matrix.json \
  --active-users /tmp/active_users.json
```

### Step 4: Run Certification Campaign

```bash
node scripts/agent.js --action certify --input /tmp/access_matrix.json
```

## Detection

```yaml
title: Data Access Governance Detection
id: b8e0b429-014f-4dde-b159-bb1fae0305a1
status: experimental
description: Detects suspicious activity related to implementing data access governance techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] RBAC model defined with role-to-data mappings
- [ ] Access provisioning workflow requires manager approval
- [ ] JIT access configured for privileged data access
- [ ] Entitlement reviews conducted quarterly
- [ ] Orphaned access automatically detected and revoked
- [ ] Separation of duties enforced in role design
- [ ] Access certification evidence retained for audit

## References

- [NIST SP 800-53 AC-2 — Account Management](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [SOX Section 404 — Internal Controls](https://www.sarbanes-oxley-101.com/sarbanes-oxley-compliance.htm)
- [CIS Control 6 — Access Control Management](https://www.cisecurity.org/controls)
- [GDPR Article 25 — Data Protection by Design](https://gdpr-info.eu/art-25-gdpr/)
