Purpose statement
In short: A purpose statement is a short written description of what an agent is for, which tasks it may perform and which data it needs. Reviewers compare an agent's live access against this statement, so any access that goes beyond the stated purpose stands out.
Which controls use this term?
- GOV-03Documented purpose. Write down what each agent is for, which tasks it may perform and which data it needs, before it gets access.
- GOV-04Least privilege at creation. Grant each new agent only the permissions its documented purpose needs, at the moment its identity is created.
Which terms are related?
Reviewed by The Register desk