Philippines staffing research · Published:
Which Active Service Accounts Exceed the Permissions in Their Task Map? - September 14, 2026
A bounded study protocol for least-privilege access exceptions, with source rules, reviewer checks, and explicit limits on what the result can support.
Observation window: one fixed 30-day period ending September 14, 2026, using the frozen eligible population and evidence available at the cutoff.
Research question and scope: Which Active Service Accounts Exceed the Permissions in Their Task Map? - September 14, 2026 The study covers one named workflow, one approved system of record, one fixed period, and the people authorized to review least-privilege access exceptions. It excludes other clients, providers, teams, and periods.
The observation unit is one eligible record from the frozen queue. The primary measure is documented permission differences between active accounts and the approved task map. Define pass, failure, and unscorable results before sampling. Keep later corrections separate from the state visible at the cutoff.
NIST CSF 2.0 informs governance and access questions. The NIST Privacy Framework informs purpose and data minimization. GAO guidance supports testing whether data are fit for the stated use. National Archives guidance supports record identity and retrieval. HHS guidance applies only when a scoped workflow contains protected health information. These sources shape the protocol; they do not supply a client result.
Publish the eligible population, observed count, category counts, reviewer agreement, missing-source count, and exclusions. Use counts for small groups. A missing field is not evidence of poor worker performance when access, system design, or upstream inputs may explain it.
Inference boundary: the study can describe selected records under frozen definitions. It cannot establish causation, rank workers, certify compliance, estimate savings, compare vendors, or predict another workflow.
Limitations include changing permissions, incomplete system histories, reviewer interpretation, an unrepresentative queue, and later evidence that changes a record after the observation cutoff.
An accountable owner may use the result to test one field, label, link, access rule, or escalation change. Repeat the protocol on fresh records before expansion. Do not use it for covert monitoring or automated employment action.
References: the numbered links below are primary government or standards-program sources. They support the control concepts, not a performance claim. Local legal, clinical, security, policy, and personnel decisions remain with authorized owners.
Key stats and source notes
Methodology: define one eligible least-privilege access exceptions queue before looking at outcomes. Freeze the observation period, fields, exclusions, reviewer instructions, and the rule for documented permission differences between active accounts and the approved task map. Include every eligible record or document the random selection method. Two reviewers score the same records independently and preserve disagreements. Report exact counts, denominators, missing evidence, exclusions, and unscorable cases.
- 1. NIST Cybersecurity Framework 2.0
- 2. U.S. GAO Assessing Data Reliability
- 3. National Archives records management guidance
- 4. HHS HIPAA Security Rule guidance
- 5. NIST Privacy Framework
FAQs
What does this study establish?
Only the observed counts for the declared queue, period, definitions, and evidence available at the cutoff.
What does it not establish?
It does not prove causation, compliance, individual performance, provider quality, savings, or a result that transfers to another workflow.