A solid-waste utility shares one long-lived AI API key across teams, and a contractor just left. What access-security practice should it adopt?
Select an answer to reveal the explanation.
Short Explanation
A single long-lived key shared across the utility can leave too much access in place. Give each team its own scoped key, and rotate or revoke keys when a contractor leaves—good credential hygiene helps limit exposure.
Full Explanation
A long-lived API key shared across teams creates a large blast radius: when a contractor leaves, the same secret may still unlock multiple integrations and workloads. Scope keys per team and rotate or revoke them after the contractor’s departure so access ends promptly and each team has only the access it needs. Emailing the master key to every new intern spreads the same powerful credential and weakens individual accountability for misuse. Carving the key into a break-room whiteboard exposes it in plaintext to anyone who can see it. Keeping the shared key unchanged so old scripts continue working, while skipping reviews after departures, leaves access in place after roles change and can prolong exposure if the key is leaked. Exam caveat: rotation requires updating dependent scripts and checking for failed authentication from forgotten jobs; otherwise, an avoidable outage may encourage continued reliance on the shared key. Practical check: inventory keys by team and owner, revoke the shared key after the contractor leaves, issue scoped replacements, confirm calls using the old key fail, and verify authorized workloads resume with the new credentials and logging enabled.