A laboratory door releases only when the holder presents a badge and then types a PIN, and neither credential alone is accepted. Which design principle does this implement?

Answer

Separation of privilege

Options - A. Separation of privilege - B. Least privilege - C. Complete mediation - D. Fail-safe defaults Why - A. Correct — separation of privilege requires MORE THAN ONE privilege attribute before access is granted. - B. Wrong, and this is the classic swap: least privilege is about how FEW rights a principal holds, not how many credentials it must present. - C. Wrong — complete mediation would be the claim that the check happens on every access rather than once and then cached. Here the issue is how many attributes, not how often. - D. Wrong — fail-safe defaults would be the claim that an unlisted badge is denied. The door demanding two things is a different property. The whole discrimination is the direction of the count. Separation of privilege: how many credentials must be PRESENTED. Least privilege: how few rights are HELD. A system can honour both — the isotope store demands two attributes, and hands out the right to open it to as few people as possible.

Stallings & Brown 5e ch1 §1.5; Saltzer & Schroeder 1975 [SALT75]