CVE-2026-97324

Account management defines and authorizes the exact privileges granted to each account or role.

Mandates that access-control decisions are made and applied to each request before access occurs.

Requires a tamperproof, always-invoked reference monitor that performs authorization checks.

Enforces only the authorizations that were assigned, so correct assignment is a prerequisite.

Separation of duties constrains which privilege combinations may be assigned to any actor.

Least privilege directly requires that only the minimal necessary privileges are assigned to each actor.

PR.AA-01 supplies managed identities and access-request workflows that can support downstream authorization decisions, yet does nothing to enforce or verify authorization checks inside a product, leaving CWE-285 fully unaddressed by this control alone.

Network segmentation/zero-trust limits external reachability (partial prevention of exploitation) but leaves application-level authorization logic untouched, so the CWE remains fully introducible and only one facet of its risk is addressed.

By requiring documented authorization rules and periodic policy reviews, the control makes it less likely that authorization decisions will be omitted or implemented inconsistently across applications.

Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.

The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.

Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.

Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.

By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.