Business Need Beats Convenience
Apply business-need-to-know to shape access requests for payment data.
The request Finance wants read-only production database access for reconciliation. Read-only can still expose account data and expand the CDE access population. Decision principle Task -> Fields -> Role -> Review Shape access by the job outcome, then limit fields, permissions, duration, and review. Raw DB access convenient but broad business access without unnecessary PAN exposure Business need-to-know is narrower than curiosity, convenience, or historical habit. 01 Clarify task 02 Shape data 03 Approve and review Step 1 Mateo asks for read-only access to the full payment database.
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in