Learn

Learning preferences

Make learning more comfortable. Changes apply immediately.

Enlarges page content, including diagrams and their labels. You can also use your browser’s zoom.

Choose the colours that are easiest for you to distinguish. Applies to lesson diagrams and lab plots. Labels, shapes, hatching and line patterns also distinguish meanings. Source photographs and raw image brightness stay unchanged; mask-only views are available for image overlays.

ExampleComparisonSample link

Saved in this browser on this device. Preferences are separate from progress backups.

Learn through experiments

Who can read the payroll?

Can you remove unnecessary access without breaking legitimate work?

Entering midway? Revisit Protect access without losing recovery for the preceding worked example, or start here and use the explanation below.

1 · Try

Start with a concrete question

Synthetic access-control table: a visitor needs the public guide; an editor also needs the team draft; an administrator needs all three files. Each granted permission permits reading one file.

Try the initial inputs, then write a prediction before changing one setting. All calculations run locally on your CPU.

Go directly to the experiment · Review basic mathematics

2 · Predict

What do you expect?

Predict whether denying everyone private-file access is a successful repair.

3 · Experiment

Change one thing. Inspect what happens.

  1. Try broad access and inspect every role in the trace.
  2. Predict the effect of switching to public-only access; check blocked work.
  3. Find a policy with zero excess permissions and zero blocked tasks.
  4. Change which account is stolen. Explain the remaining risk.
Experiment inputs
Inputs
Your settingsMechanism
Calculation belowEvidence
Compare outcomes
Excess grants3 permissions
Required actions blocked0 actions
Files reachable by stolen account3 files

Compare the current results

Every bar starts at zero and uses the same numeric scale in this chart. The upper bound automatically adjusts to the largest current value (at least 1), so compare the numbers when changing inputs. Units and quantities come from each label; different kinds of quantity are not interchangeable. Displayed values are rounded to at most six significant digits.
03
  • Excess grants3
    Excess grants: 3Horizontal bar from zero to 3, on the shared zero to 3 numeric axis.
  • Blocked required actions0
    Blocked required actions: 0Horizontal bar from zero to 0, on the shared zero to 3 numeric axis.
  • Reachable files3
    Reachable files: 3Horizontal bar from zero to 3, on the shared zero to 3 numeric axis.

Follow the calculation

  1. visitor: public guide allowed; team draft allowed; payroll export allowed.
  2. editor: public guide allowed; team draft allowed; payroll export allowed.
  3. administrator: public guide allowed; team draft allowed; payroll export allowed.
  4. Stolen visitor account can read 3 of 3 files.

Legitimate work succeeds, but unnecessary grants increase access after account theft.

Captures keep your inputs, prediction and observation. Results are recalculated from those inputs. Resetting inputs keeps your captures and challenge history.

4 · Understand

Explain the mechanism

Who can read the payroll?

Synthetic access-control table: a visitor needs the public guide; an editor also needs the team draft; an administrator needs all three files. Each granted permission permits reading one file.

Follow the mechanism

Least privilege means granting access needed for a task. It requires a task contract, not merely removing permissions.

The table has nine possible grants: three roles multiplied by three files. Six grants are necessary, so broad access contains three excess grants.

Role matching still lets a stolen administrator account read every file. Access design and account protection address different problems.

Worked example

visitor: public guide allowed; team draft allowed; payroll export allowed.

editor: public guide allowed; team draft allowed; payroll export allowed.

administrator: public guide allowed; team draft allowed; payroll export allowed.

Stolen visitor account can read 3 of 3 files.

Calculation

Excess grants = granted but unneeded cells; blocked work = needed but denied cells.

Try a controlled comparison

  1. Try broad access and inspect every role in the trace.

  2. Predict the effect of switching to public-only access; check blocked work.

  3. Find a policy with zero excess permissions and zero blocked tasks.

  4. Change which account is stolen. Explain the remaining risk.

What this does not establish

  • All roles, files and theft scenarios are fictional. This does not implement a real authorization boundary.

  • Reading is the only operation; writing, delegation and revocation are omitted.

5 · Apply

Try a fresh case

A new assistant needs 2 of 5 files but receives access to all 5. How many excess grants exist?

This is a public practice check. Retries support learning; matching a number does not certify independent proficiency.

Take the investigation further

Choose any extension. These are project prompts for you to carry out; they are not automatically assessed.

School investigation

Draw permissions for a school club; identify public, member and organizer tasks.

College investigation

Implement a permission matrix and tests for denied operations in an isolated program.

Workplace investigation

Write a fictional access review with task owners, approval reasons and a revocation plan.

6 · Continue

Keep the evidence, choose your next step

Completion records your own decision that you have worked through this investigation. Practice checks and independent project evidence are separate.