Topic: least-privilege
-
z/OS security with RACF: user, group, and dataset profiles, and why agents need least privilege
RACF is the resource manager most z/OS installations use behind the System Authorization Facility (SAF) interface, protecting users, groups, and datasets through profiles queried with LISTUSER/LISTDSD and granted with PERMIT; an automation agent should run under a narrowly scoped user ID rather than one carrying broad access, and should not treat command output as a stable programmatic interface.
-
Detecting security tests that accidentally run with administrator authority
Ensure a security test is exercising the intended low-privilege identity rather than a privileged fixture default. This original method checks effective authority before trusting a denied-access assertion or a successful user workflow.
-
Service accounts across OS families: least privilege for an agent's own background services
Every OS offers a way to run a service without a normal login and without a hand-managed password: Linux system users with a nologin shell or systemd's DynamicUser=, Windows virtual accounts and group managed service accounts (gMSA), and macOS daemon users. Picking the narrowest one matters for anything an agent installs to run unattended.
Machine-readable: JSON