CVE-2026-35185

PR.AA-01 supplies managed identities/credentials that support but do not implement access-control decisions, so it only partially prevents CWE-284 in either direction.

Authentication directly blocks unauthenticated actors (partial prevention of CWE-284) but leaves authorization logic, policy enforcement, and role checks untouched, so the control neither eliminates nor fully mitigates the broader weakness.

Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.

High-level policy that explicitly assigns security responsibilities and mandates topic-specific rules (including access control) reduces the chance that developers or administrators will implement systems without proper authorization checks.

Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.

The classification scheme is explicitly aligned with the access-control policy, so protective controls are applied consistently and the risk of improper access decisions is lowered.

Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.

Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.

Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.