TryBench
Enforcing Least Privilege
Audit staff permissions in a markdown table and downgrade excessive admin rights.
Why this matters
Extra access is extra risk. If an account with too many powers is hacked, the attacker gets all of those powers too.
Extra Access Is Extra Risk
Imagine an intern with full database admin rights. If their laptop is phished, the attacker gets the whole database.
In real life: Imagine an intern with the keys to every room. If their laptop is hacked, the attacker walks into every room too.
Give Only the Access Needed
Give each account the least access its job needs. Change full admin rights to read-only for people who only view reports.
In real life: Give each person only the access they need for their job. Someone who only views reports does not need rights to change or delete data.
Show Audits as Clean Tables
Ask the AI for a Markdown table with User, Current Role, and Recommended Role columns. IT can then update many accounts in one go.
In real life: A table with the same columns every time makes it easy for IT to review many accounts and update them in one go.
Your practice task
Have the AI audit the access record below and output ONLY a Markdown table (no intro text) with columns: User, Current Role, and Recommended Role. Downgrade any full database admin who only needs to view campaign counts to a read-only role.
How to do it
- Read the access record above.
- Ask the AI to build a table with columns User, Current Role, Recommended Role.
- Say: downgrade full admins who only need to view reports to READ_ONLY.
- Say: output only the table. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: Least Privilege Access Table
Use during quarterly user access reviews to downgrade excessive admin rights.
Audit the access list below. Output ONLY a Markdown table with columns: User | Current Role | Recommended Role. Downgrade any admin account that only views reports to READ_ONLY.
More lessons in this course
- Spotting Unauthorized Bulk ExportsRead multi-line server logs to isolate off-hours mass customer data downloads and data exfiltration.
- Fake Invoice Scam: Spot Business Email CompromiseSpot typosquatted vendor domains, enforce out-of-band phone verification, and layer email security controls.
- Shadow-AI Governance & Secret LeaksEnforce approved workplace AI tools, classify data, sanitize configs, and rotate credentials if leaked.