A contractor supporting the 311 model needs to watch Base View but must not sync software images. Which BCM permission approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation
You need Base View visibility for 311 support, not the ability to reimage the city. Give the contractor scoped BCM access for read-oriented monitoring, with image-sync and firmware privileges withheld. A permanent engineer screen-share or a shared break-glass group can spread privileges and blur accountability.
Full Explanation
Assign BCM permission scopes that give the contractor read-oriented Base View visibility for 311 support while withholding image-sync and firmware privileges. The contractor can observe health and utilization for triage without being able to reimage the city’s GPU estate. Granting full image-sync and firmware rights for convenience exceeds the engagement and increases the blast radius if credentials leak or mistakes occur. Relying on a permanent screen-share of an engineer’s logged-in workstation bypasses a named, revocable account and makes it harder to establish who performed actions during an incident. Adding the contractor to a shared break-glass admin group used for every vendor normalizes over-privilege and undermines incident attribution across vendors. Exam caveat: time-bound contractor accounts with explicit expiry are preferred; monitoring-only access is the conceptual floor for this stem, not a claim that contractors never need deeper access under separate change control. Practical check: provision a named BCM identity with Base View or monitoring-oriented roles, confirm image-sync and firmware actions are denied, verify Base View reads succeed for 311 nodes, and revoke or expire the account when the engagement ends.