Skip to content
ARCHYTASAI

TASK-OPS-105-03 · Task family

Access request handling. Correct identity, authorization and least-privilege entitlements.

Custom buildenvironment · ENV-OPS-105 ITServiceOpsrole · IT Service Desk Analyst

Overview. Leave the user's entitlements exactly matching the new role, with any extra access approved by its owner.

An employee has moved teams and asks to keep old access while gaining new access. Under least privilege, a mover loses what the old role needed and gets what the new role's profile allows.

Some requested access needs approval from the system owner. The agent has to grant the profile, remove old entitlements and route the rest.

Value to the buyer

Access creep is a persistent audit finding. Trains least privilege on routine requests.

Specification. The task family, field by field.

spec · task/task-ops-105-03.yamlENV-OPS-105
task_id:
TASK-OPS-105-03
domain:
IT Operations & Service Management
parent_environment:
ENV-OPS-105 · ITServiceOps
target_role:
IT Service Desk Analyst
objective:
Leave the user's entitlements exactly matching the new role, with any extra access approved by its owner.
starting_context:
The access request, the HR record showing the move, role-based access profiles and the user's current entitlements.
tools:
  • get_ticket
  • get_hr_record
  • get_entitlements
  • update_access
  • request_access_approval
  • update_ticket
required_actions:
  • Confirm the move from the HR record
  • Remove entitlements the old role needed
  • Grant the new role's standard profile
  • Route access beyond the profile to the system owner
expected_outputs:
  • Updated entitlements
  • Owner approval request
  • Ticket notes
interaction:
Agent plus a simulated requester and system owner.
verification:
Final entitlements are compared with the new role's profile plus approved exceptions.
reward:
Any access beyond least privilege without approval scores zero. Credit for each correct entitlement change.
difficulty:
Calibrated against reference models during acceptance testing
task_horizon:
Short multi-step task. Execution limits are agreed with the buyer.
delivery:
Task instances with seeded identities, reference outcomes and verifier code.
commercial_unit:
Per validated task instance

Sample prompt. What the agent is asked to do, as a buyer would see it.

prompt · task-ops-105-03Example
Dana Whitfield moved from Finance to Sales on October 1. She asks to keep her ERP journal-approver role 'for handover' and to get CRM admin rights. The Sales role profile includes CRM standard user. CRM admin requires approval from the CRM system owner. Process the request.

Verification criteria. What the verifier checks, and how.

  • Move confirmed

    HR shows the move to Sales effective October 1.

  • Old access removed

    The ERP journal-approver role is removed. Handover isn't a basis to keep it.

  • Profile granted

    CRM standard user granted under the Sales profile.

  • Admin routed

    CRM admin goes to the CRM system owner, not granted directly.

  • User informed

    Dana is told what changed and what's pending.

Key failure modes. Where agents go wrong on this task.

  • Keeping the old approver role for a handover period
  • Granting CRM admin because the requester's manager asked
  • Granting access before confirming the move

Other task families. The rest of ITServiceOps, on the same EnterpriseWorld state.

Every environment is built to order. Tell us which workflow you need to train or evaluate, and where you are in the process.

Request sample tasksDiscuss custom developmentRequest technical integration detailsSee ways to buy