Skip to content

refactor: AC-04.01 control for clarity #396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 8, 2025
Merged

refactor: AC-04.01 control for clarity #396

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions baseline/OSPS-AC.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,8 +290,8 @@ controls:
- id: OSPS-AC-04.01
text: |
When a CI/CD task is executed with no permissions specified, the
project's version control system MUST default to the lowest available
permissions for all activities in the pipeline.
CI/CD system MUST default the task's permissions to the lowest
permissions granted in the pipeline.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non blocking nit:

Suggested change
permissions granted in the pipeline.
permissions required by the task.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like your suggestion but I think it does change the focus of the requirement from one in which the task's permissions are not configured/unspecified and therefore the task runs in the presumably more well defined and least privilege permission context of it's (the task's) enclosing pipeline to one in which the enclosing pipeline should more proactively try to understand the permission requirements of the task and assign only those.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there CI/CD systems that use the highest permissions as a default? Or is the intent here to say "tasks should have read-only permissions unless explicitly granted more permissions at the task level"?

For example, if I have a github workflow that grants write at the top level of the workflow, would a job in that workflow that inherits write permission violate this control? Does the answer to that question depend on whether or not the job needs write permission?

If the answer is yes (or at least a conditional yes), maybe we're better off being more direct and saying "CI/CD tasks that require permissions beyond read must have permissions explicitly granted at every step" (except with better wording)

applicability:
- Maturity Level 2
- Maturity Level 3
Expand Down
Loading