Access lets a user or system consume a model. The ability to change it lets someone influence future outputs, safety behaviour, and trustworthiness for every downstream consumer. That is why fine-tuning permissions belong in privileged access governance, not just in ordinary application access reviews.
Access and change are different kinds of permission
Access is the right to use a model as a consumer. That usually means sending prompts, receiving outputs, or calling an API. Change is the right to alter what the model does over time, whether by fine-tuning, updating weights, modifying safety layers, changing system prompts, or adjusting training data and configuration.
The practical difference is blast radius. A user with access can affect their own session or workflow. A user with change capability can affect every downstream consumer, because they may influence model behaviour, safety posture, and trustworthiness for everyone who depends on that model.
That is why the two permissions should not be reviewed at the same level. Ordinary application access reviews answer who may use the model. Privileged governance answers who may reshape the model itself, because that is a higher-impact control boundary.
Why change permission belongs in privileged access governance
Change rights are closer to administrative control than to routine consumption. They can introduce accidental regression, policy drift, hidden prompt changes, data leakage through training inputs, or a silent reduction in safety behaviour. In other words, the question is not just “can this person run the model?” but “can this person alter the behaviour that other people will trust?”
Fine-tuning and related model-update paths should therefore be treated like privileged operations with stronger approval, separation of duties, and traceability. The Authorisation Models Guide is useful here because change permission is an authorisation problem, not merely an application login problem: the decision is about who may perform a high-impact action on a shared control plane.
For the same reason, a model-change path should be reviewed alongside privileged access controls, not buried inside general user access recertification. The review question changes from “is this account still needed?” to “is this account trusted to modify a shared AI asset safely and reversibly?”
What good control looks like in practice
Good control separates read-only use from write-capable operations. It makes model changes explicit, logged, approvable, and attributable. It also keeps the change surface small, so that whoever can alter the model cannot do so casually, anonymously, or through the same interface used by ordinary consumers.
That control boundary should cover more than weights. In many environments, the real risk sits in adjacent levers such as system prompts, tool bindings, retrieval sources, safety policies, deployment versions, and rollback authority. If any of those can be changed, the organisation should treat them as part of the same privileged change domain.
Access controls in frameworks such as CIS Controls v8, NIST SP 800-53 Rev 5 Security and Privacy Controls, and ISO/IEC 27001:2022 Information Security Management all reinforce the same practical pattern: limit powerful actions, track them, and preserve accountability when a control can alter shared behaviour.
Risk and Threat Considerations
When change rights are too broad, the failure mode is not just misuse of a model, but corruption of the model as a trust anchor. A small number of people may be able to introduce unsafe behaviour, weaken guardrails, or persistently bias outputs in ways that ordinary access reviews will never detect.
Failure mechanism: An actor with write-level permissions modifies training, tuning, prompts, or deployment configuration, then uses normal model access paths to make the change look like ordinary usage. The control failure is confusion between consumption rights and authority to alter shared model behaviour.
Impact: Downstream consumers inherit the changed behaviour, which can create safety regressions, inconsistent outputs, policy violations, or erroneous decisions at scale. Recovery is harder than revoking a session, because the organisation must also identify what changed, when it changed, and which outputs were influenced.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Restricts model-change rights to only those who need them. |
| AC-5 — Separation of Duties | Separates model consumption from model modification authority. | |
| IA-5 — Authenticator Management | Change operations depend on stronger control over privileged credentials. | |
| Recommendation — Limit write-level model permissions to a small, approved admin group. Split model-use and model-change approvals across different roles. Protect privileged model-change accounts with stronger credential lifecycle controls. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Defines access rules that should distinguish use from modification. |
| A.8.2 — Privileged access rights | Model editing is a privileged function requiring tighter governance. | |
| Recommendation — Define separate access rules for model users and model editors. Review and restrict model-editing rights as privileged access. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Covers governance of who can use versus modify shared systems. |
| Recommendation — Tighten access control so model-change capability is separately approved. | ||
Practitioner Guidance
What to verify: Confirm that model-use permissions and model-change permissions are separated in policy, tooling, and approval flow. If the same role can both consume and alter the model, the control is too coarse for a shared production system.
Decision rule: If an action can influence future outputs for other users, treat it as privileged change authority and require stricter review than ordinary application access. If it only affects the caller’s own session, it belongs in standard access governance.
Practitioner takeaway: The security boundary is not “who can see the model,” it is “who can change what everyone else will trust.” That distinction should drive the governance model, the approval path, and the audit evidence.
Related resources from NHI Mgmt Group
- What is the difference between reviewing human access and reviewing NHIs?
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between protecting applications and protecting access?
- What is the difference between attack surface management and NHI governance?