A telecom company grants its network operations team access to an AI system that summarizes customer complaint data, even though that team does not handle customer complaints. What governance principle was likely violated?
Select an answer to reveal the explanation.
Short Explanation
Just because a door isn't locked doesn't mean you should walk through it. A team that never touches customer complaints has no business reason to see complaint summaries, and handing over that access anyway breaks the need-to-know principle that ought to gate every access decision you make.
Full Explanation
Access should be limited to those with a legitimate business need for the specific data involved — the need-to-know principle — and granting the network operations team access to customer complaint data it doesn't need to do its job is a direct violation of that principle. Basing access on department size is an unrelated and arbitrary criterion that has nothing to do with whether a team actually needs the data. Reviewing access only once per year regardless of role changes is a related risk (stale access can persist), but it isn't the principle violated in this scenario, where access was granted from the start despite no job-related need. Granting access to any team that simply requests it, framed as promoting collaboration, is essentially what happened here and is the flawed practice the scenario illustrates, not a valid governance principle. The general principle: access decisions should be driven by demonstrated business need tied to job function, not by request, department size, or convenience.