Entitlement Risk

SL-05

Permissions assessed against actual usage. An entitlement nobody exercises is pure exposure — it carries all the breach risk of access with none of the operational benefit.

DischargesS.8(4)R.6

Run a certification campaign

3 leavers still hold entitlements

svc_ai_index_7, Uday Tiwari, Pallavi Gupta. Access for a departed person is the easiest finding a regulator or auditor will ever record, and it is entirely preventable.

Excessive permissions

468

Unused permissions

752

Privileged identities

Leavers with access

With children's data access

Permission exposure by department

Excessive permissions are those the identity holds but does not need; unused are those it has not exercised in the observation window. Both are candidates for revocation, but excessive is the one that expands blast radius.

68 identities

			Privileged groups
svc_scheme_sync Service account · IT & Digital Infrastructure	9	4	db_datareader_prodwarehouse_etl	6children	Critical	suspended
Sunita Pandey Employee · Human Resources	10	12	None	6	Low	active
svc_warehouse_etl_2 API / automation identity · IT & Digital Infrastructure	12	4	db_datareader_prod	0children	Critical	active
svc_reporting_3 Service account · Health & Nutrition Services	4	15	db_datareader_prod	3	Low	active
Vikram Shah Employee · Grievance & Public Response	14	14	None	4	Low	active
Pallavi Nair Employee · IT & Digital Infrastructure	4	13	None	3	Medium	active
svc_notify_6 Service account · Human Resources	5	10	db_datareader_prod	7	High	active
svc_ai_index_7Leaver Service account · Health & Nutrition Services	4	13	db_datareader_prod	8	Medium	leaver
Devika Khanna Privileged administrator · Procurement & Vendor Management	11	1	Domain Admins	11	High	active
svc_notify_9 Service account · Grievance & Public Response	2	9	None	7	High	active
svc_backup_agent_10 Service account · Education & Scholarships	12	20	None	11	Medium	active
Aditi Desai Employee · Education & Scholarships	—	14	None	2	High	active
Manish Sharma Employee · IT & Digital Infrastructure	9	16	db_datareader_prod	8	High	active
Pallavi Reddy Employee · Procurement & Vendor Management	10	7	None	6children	Medium	active
svc_notify_14 API / automation identity · Citizen Registry & Family ID	6	10	None	4	Medium	disabled
Sanjay Sharma Employee · Welfare Scheme Delivery	6	13	None	4children	Critical	suspended
Chetan Chopra Employee · Human Resources	9	20	db_datareader_prod	8children	Medium	active
Harpreet Rao Employee · Welfare Scheme Delivery	11	8	None	2	High	active
svc_backup_agent_18 Service account · IT & Digital Infrastructure	7	—	None	0children	Low	disabled
Harpreet Kapoor Privileged administrator · Welfare Scheme Delivery	12	15	sso_adminsDomain Admins	10children	Critical	active
svc_scheme_sync_20 Service account · Welfare Scheme Delivery	7	14	None	9	Critical	active
Anil Shah Employee · Grievance & Public Response	8	17	None	1	Medium	active
Kavya Malik Privileged administrator · Health & Nutrition Services	6	22	db_owner_prod	0	Low	active
Lakshmi Kapoor Employee · Grievance & Public Response	9	15	None	9	Medium	disabled
svc_backup_agent_24 Service account · Procurement & Vendor Management	9	18	None	2	Low	disabled

1–25 of 68

1 / 3

Evidences:S.8(4)R.6Least privilege is a required control, and certification records are what make it demonstrable rather than asserted. Run campaigns from Discovery → Access & Entitlements.