Accounts and least privilege

15-minute session: read for 3 minutes, trace for 3, experiment for 7, and complete the check for 2. Spend longer whenever you need.

Give each service only the files and capabilities it needs. Separate administrator access from application identity. Authentication asks who is calling; authorization asks which action that identity may perform. Test a student trying to read another student’s record. A hidden button is not an access-control check.

Practice and evidence: Predict the example or draw its state transitions. Change one assumption, test the boundary, and record the actual result. Explain what this small model does not establish about a production system.

def can_read(caller,owner):
    return caller==owner
assert can_read(7,7)
assert not can_read(7,8)
print("Passed")

Expected result: Passed

Practice and evidence

Keep three notes: your prediction, the actual result, and why they match or differ. The completion check grades understanding; the practice task builds skill.