Access Control

Explanation

Access control checks that only authorised users, services and processes can reach the AI system and the sensitive financial data it touches — for example the documents and embeddings behind a retrieval-augmented (RAG) assistant that may contain customer PII, account balances or KYC records. It matters because weak access control is a primary route to data breaches and regulatory penalties in banking. It is measured by the Access Violation Rate, computed as Violation Rate = Count(Unauthorized_Access_Attempts) / Count(Total_Access_Attempts) for systems handling financial data, so it tracks the share of access attempts that were not permitted. To implement and operate it, enforce least-privilege role-based or attribute-based access at every layer — API gateway, retrieval store, model endpoint and admin consoles — with strong authentication, and emit an immutable audit log of every access attempt recording identity, resource, decision (allow/deny) and timestamp; feed denied attempts into a security monitoring pipeline for alerting. The threshold is <0.1% with 100% investigation of violations: the unauthorized-attempt rate must stay below one in a thousand, and every single violation, regardless of rate, must be investigated. A breach of the rate or any uninvestigated violation is an immediate-priority event that triggers incident response, access review and potential credential revocation.