Which IAM practice is foundational for securing access to AI models and data?

• A. Strict Password Rotation
• B. Public Access
• C. Regular Offline Backups
• D. Least Privilege

Answer: (D)

Limiting access to only what is needed to perform a task is the foundation of secure IAM in AI environments. This approach, often called least privilege, means granting the smallest set of permissions required so users and services cannot access or modify data, models, or settings beyond their role.

In practice, least privilege reduces risk in AI workflows by ensuring that a data scientist can run analyses on datasets or a deployment service can infer predictions without also having broad rights to alter training data, change model weights, or access other teams’ resources. It supports safer isolation between stages (training, validation, deployment) and encourages the use of separate service accounts and fine-grained permissions tailored to each job. Regularly reviewing and adjusting these permissions keeps access aligned with current responsibilities and prevents privilege creep.

Other options don’t address access control in depth: rotating passwords helps credential hygiene but doesn’t limit what resources a user or service can actually reach; making resources publicly accessible defeats security by design; and offline backups focus on availability and recovery rather than controlling who can access or modify data and models.