What role is responsible for defining and enforcing access policies and permissions for users?

What role is responsible for defining and enforcing access policies and permissions for users?

• A. Identity Types
• B. Access Administrator
• C. User
• D. Service Provider (SP)

Answer: (B)

Defining and enforcing who can access what resources and under which conditions is governance of access control, handled by a role with authority over policy management. The Access Administrator is responsible for shaping these policies—setting entitlements, configuring access rules, and ensuring they’re enforced across the system. They also manage related activities like access reviews and permission assignments, keeping access aligned with security requirements. A regular user doesn’t define policies and only has the permissions granted to them. A Service Provider is the external party offering the identity service rather than the internal policy owner. Identity Types describe categories of identities, not a role that manages access policy.

Defining and enforcing who can access what resources and under which conditions is governance of access control, handled by a role with authority over policy management. The Access Administrator is responsible for shaping these policies—setting entitlements, configuring access rules, and ensuring they’re enforced across the system. They also manage related activities like access reviews and permission assignments, keeping access aligned with security requirements.

A regular user doesn’t define policies and only has the permissions granted to them. A Service Provider is the external party offering the identity service rather than the internal policy owner. Identity Types describe categories of identities, not a role that manages access policy.