This assessment objective ensures that your access control procedures operationalize the principle of least privilege by defining how access is provisioned, reviewed, and restricted based on role or job function.