We define who gets access to what and under which conditions. This includes least privilege rules, approvals where needed, time-bound access, break-glass governance, and audit requirements aligned to your operating model.