Only the permits VLAN service account should be able to call the internal building-code model endpoint. Which control best enforces that?

Restricting endpoint access so only the permits VLAN service account can invoke the internal building-code model is the control that enforces least privilege for that civic API. Endpoint access controls decide which identities may call a model. An internal building-code model is not a public resident service; binding invoke rights to the designated permits VLAN service account keeps permit-system automation on an authorized path and blocks casual or hostile callers elsewhere on the municipal network.

Restricting endpoint access so only the permits VLAN admin role can invoke the model fails because it binds invoke rights to the wrong identity; it would let human admins call while leaving the required permits VLAN service account unable to call, so it does not enforce service-account-only invocation. Restricting endpoint discovery so only the permits VLAN service account can list the model fails because discovery only controls who can list or find the model; it does not restrict which identities may invoke the model, so any other caller who knows the endpoint could still call it unless invocation is also bound to the permits VLAN service account. Restricting model training so only the permits VLAN service account can fine-tune the model fails because training controls who may modify or fine-tune the model; it does not restrict which identities may invoke the model, so any other caller could still reach the endpoint unless invocation is bound to the permits VLAN service account.

Exam caveat: Endpoint access is about which identity may invoke the model API — restricting it to the permits VLAN admin role still authorizes the wrong caller and leaves out the required permits VLAN service account. Restricting model training so only the permits VLAN service account can fine-tune the model is a common distractor against service-account least privilege because it governs fine-tuning, not who may invoke.

Operational check: Place the building-code model on an internal path, allow only the permits VLAN service account to invoke it, attempt calls with a resident SSO token and an unauthenticated client (both denied), confirm permit automation still succeeds, and verify the permits VLAN admin role cannot invoke in its place, since restricting invoke to the admin role authorizes the wrong identity.