Access control is the set of rules and mechanisms that decide who or what can reach a resource, and what they are allowed to do with it. A resource can be a file, an application, a database or a whole system, and the “who or what” can be a person, a service account or an AI agent.

How does access control work?

Every request follows the same path. The identity is authenticated, the system evaluates the policy that applies, and access is granted, limited or denied. The decision is then logged, so it can be reviewed later.

What are the main types of access control?

• Role-based (RBAC): By the role a person holds, such as finance analyst or administrator
• Attribute-based (ABAC): By attributes such as department, device, location and time
• Discretionary (DAC): By the owner of the resource
• Mandatory (MAC): By a central policy based on classification levels

Why is access control a security priority?

A stolen credential is only as dangerous as the access behind it. When access is tight, an attacker who logs in reaches very little. When it is wide, the same login can open critical systems. The size of that gap is often called the blast radius of an identity.

What is least privilege?

Least privilege means giving an identity only the access it needs for its job, and nothing more. It is the most effective way to shrink the blast radius of a compromised account, but it erodes over time unless access is reviewed.

What is just-in-time access?

Instead of leaving elevated rights in place permanently, access is granted when it is needed and for a limited time. A privileged account that is not privileged most of the time is far less useful to an attacker.

How do attackers get around access control?

They rarely break it. They use what it already allows:

• Stolen or reused credentials that pass authentication.
• Privilege escalation to move from a low-level account to a powerful one.
• Over-privileged accounts, especially service accounts and forgotten users.
• Privilege creep, where permissions pile up as people change roles.

An engineer moves from finance to the data team and keeps both sets of permissions. Over time the account becomes one of the most powerful in the company, and nobody decided that.

Why is access control not enough on its own?

Access control defines what is allowed. It cannot tell a legitimate use of that access from an abuse of it, because both look the same to the policy. An insider, or an attacker with a valid account, acts within the permissions the account holds.

That gap is closed by watching behaviour after login. Comparing what an identity does with what is normal for it shows misuse that no rule would flag.

Is access control a compliance requirement?

Yes. NIS2 lists access control policies among its baseline security measures, and DORA expects access controls within ICT risk management. Auditors increasingly want evidence that access is justified and reviewed, not only that a policy exists.

How do access reviews work?

Owners periodically confirm that each person’s access is still needed: who has it, why, and whether it matches their role. Reviews work best when they start from real usage, because access that nobody has used for months is the first candidate to remove.

What about non-human identities?

Service accounts, API keys and AI agents need access control too. They often hold broad, long-lived access and have no owner who notices when it changes, so they should be inventoried, scoped and reviewed like any person.

How do you keep access control effective?

Apply least privilege, review access on a schedule, grant elevated rights only when needed and for a limited time, and cover non-human identities as carefully as people.

Sharelock maps identities and privileges to show where access is excessive or unused, then monitors behaviour after login, down to individual transactions and queries on critical applications.