CVE-2026-9789

PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.

Authentication directly blocks unauthenticated actors (partial prevention of CWE-284) but leaves authorization logic, policy enforcement, and role checks untouched, so the control neither eliminates nor fully mitigates the broader weakness.

PR.DS-01 encryption mitigates impact of failed access checks on stored data but neither implements nor constrains access-control logic itself.

High-level policy that explicitly assigns security responsibilities and mandates topic-specific rules (including access control) reduces the chance that developers or administrators will implement systems without proper authorization checks.

The classification scheme is explicitly aligned with the access-control policy, so protective controls are applied consistently and the risk of improper access decisions is lowered.

Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.

Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.

Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.

Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.