A shared AI platform identity currently spans model, vector-store, and logging systems. What change best applies least privilege?

Splitting the shared identity into separate model, vector-store, and logging identities best applies least privilege when one platform identity currently spans those systems. Distinct service identities limit blast radius: compromise of a logging credential should not yield vector-store write or model-admin rights, and vice versa. Municipal AI platforms that share one identity across model invocation, RAG storage, and telemetry concentrate risk and complicate audit attribution.

Scoping the shared identity to read-only permissions for model, vector-store, logging fails by concept because keeping one identity across all three planes leaves blast radius intact and a blanket read-only scope is not least privilege; least privilege requires separate identities that each hold only the permissions its own plane needs, including necessary writes. Restricting the shared identity with source IP checks for model, vector-store, logging fails because network location checks do not limit what the shared identity can do once the check passes; an allowed address can still exercise excessive model, vector, or logging rights and does not apply least privilege. Enabling detailed audit logging for the shared identity across model, vector-store, logging fails by concept because audit logging records activity but does not reduce privileges; without splitting into scoped-down permissions it leaves the shared over-privileged rights in place and does not apply least privilege.

Exam caveat: Least privilege for AI platforms means separate identities (or roles) per plane—model, data/vector, and logging—with each scoped to minimum rights, not keeping the shared identity across all planes with read-only scoping, IP checks, or audit logging.

Operational check: Replace the shared platform identity with scoped model, vector-store, and logging identities; revoke the old shared principal; confirm each component works with only its own rights; and verify a stolen logging credential cannot invoke the model or modify vector indexes.