Cybersecurity Fundamentals · Topic

Access Control

Also in the Cybersecurity Fundamentals cluster

Authentication Device Security Malware Passkeys Passwords Phishing Ransomware

Verifying That a Request Actually Comes From an Authorized User

Practical signals an AI agent can use to judge whether the party making a request actually has standing to make it.

What Not to Do With API Keys, Credentials, or Secrets You See in Context

Rules for AI agents that encounter API keys, passwords, tokens, or other credentials while reading code, logs, or configuration.

What an AI Agent Should Log Before Taking a Risky Action

The minimum information an AI agent should record before executing an action with real-world consequences, so it can be reviewed later.

Safe Defaults for Tool Use: Read vs. Write, Reversible vs. Irreversible

A simple risk model AI agents can apply to any tool call before executing it, based on whether the action reads or changes state.

Cyber Essentials in Practice: A Five-Control Implementation Checklist

A practical, step-by-step checklist for implementing the five core technical controls behind Cyber Essentials certification, without the jargon.

Passkeys: The Password-Free Way to Sign In

Passkeys let you sign in with your fingerprint or face instead of a password, and they're resistant to phishing by design. Here's how they work and how to start using them.

Protect Your Accounts with Two-Factor Authentication

The single most effective step you can take to protect an account even if your password is stolen, with step-by-step setup for major platforms.

The Principle of Least Privilege, Explained Simply

One of the oldest ideas in security. Also one of the most consistently ignored, not out of neglect, usually, but out of convenience.

How Access Reviews Prevent Silent Privilege Creep

Nobody grants excessive access on purpose. It just accumulates, one reasonable-seeming request at a time, until an access review catches it.