Skip to content
Clairos Learn

Safety, privacy, and governance · Lesson 6 of 15 · 9 min

Inspect access boundaries

Access boundaries limit which subjects can read or change which resources. Relevance to a task does not grant permission to cross a tenant or role boundary.

Open the labCourse map
Mastery 0/3Run itExplain itApply it
learner@clairosSimulated AI Ops lab
learner@clairos:~ $
↑ history · Tab complete · Ctrl+C cancel · Esc, Tab to leaveExit 0

Understand the pattern

Access boundaries limit which subjects can read or change which resources. Relevance to a task does not grant permission to cross a tenant or role boundary.

Interpret the evidence

Deny the policy write for the viewer role and use the authorized review path.

A tempting mistake

Allow the write because the viewer has a helpful suggestion.

All names, measurements, prices, versions, and thresholds in this exercise are fictional training data. The evidence supports this bounded scenario, not a claim about a live provider.

Worked example and expected result
$ cat /opt/ai-lab/cases/aiops-safety-governance-006.json
{
  "fixture": "Fictional training data; not a live measurement.",
  "role": "viewer",
  "requested_action": "modify-policy",
  "allowed": false
}

Exit status: 0. The command completed successfully in the training fixture.

$ jq .allowed /opt/ai-lab/cases/aiops-safety-governance-006.json
false

Exit status: 0. The command completed successfully in the training fixture.

$ printf '%s\n' 'deny-policy-write' > /home/learner/lab/aiops-safety-governance-006-decision.txt
(no output; exit 0)

Exit status: 0. The command completed successfully in the training fixture.

Try a variation

Name the assumption that would have to change for “deny-policy-write” to stop being the justified action. Do not silently replace missing evidence with a guess.

Explain it

What does the evidence in “Inspect access boundaries” justify?

Apply it elsewhere

A colleague concludes: “Allow the write because the viewer has a helpful suggestion.” What should you do?

Keep the momentum.

Complete the lab, then explain and apply the pattern.

Next: Read a model cardTry an incident drill

Anonymous lesson and mastery progress lasts for this session. Sign in to keep synced lesson XP between sessions; mastery stays device-local. No speed bonus, lost lives, or hint penalties.

Keep learning

  1. 01Check data retentionRetention describes how long data is kept and for what purpose. A retention setting should match policy and actual deletion behavior, not just a label in a form.Practice
  2. 02Read a model cardA model card records intended uses, limits and evaluation context. It is an evidence source for review, not a guarantee of suitability for every deployment.Practice
  3. 03Review approved useApproved use is specific to the task, data and controls that were reviewed. A new high-impact use needs its own assessment rather than inheriting an unrelated approval.Practice

Case methodology: evidence, limits, decision