A non-admin role that can grant itself administrator

Human user holds a role that can rewrite the security model.

A non-admin whose custom role grants role or user administration can grant themselves anything through the API: a low-privilege login that can bootstrap itself to full control.

Same method as the integration version, pointed at roles held by human users. Read the privilege list of every custom role for role and user administration. Built-in administrative roles are expected to hold these; a custom business role holding them is the finding.

Remove those privileges, reserve admin for named people, and turn on prevent-elevation-of-privilege.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• An integration account that can grant itself privileges
• A role-holding team with both people and service accounts in it