Two halves of one discipline
In access control, a subject is any actor that can act in a system: an employee account, an administrator, a contractor, a service account, or a process running for one of them. The two words of the term ask different questions about that subject.
Capability management asks what the subject can technically do. It owns the assignment, review, and revocation of privileges: roles, rights on files and systems, permission to use removable media or to install software, and administrative elevation.
Behavior management asks what the subject is permitted to do. It owns the conduct rules: acceptable use of channels and data, restrictions for defined groups, conditions for stopping or flagging an action, and the consequences of breaking them.
The two halves constrain each other. A subject may be able to export a customer database and still be prohibited from doing so, because no policy can permit what the underlying capability denies. Mature programs manage the pair together: capability sets the ceiling of possible harm, and behavior rules define the corridor of acceptable action below it.
| Dimension | Capability management | Behavior management |
|---|---|---|
| Core question | What can this subject do? | What may this subject do? |
| Primary object | Privileges, roles, rights, entitlements | Rules of conduct and their enforcement |
| Typical instruments | Least privilege, separation of duties, access review | Acceptable use policy, restrictions, sanctions |
| When it fails | Privilege creep, orphaned accounts | Rules on paper, inconsistent enforcement |
Why insider threat programs rely on it
Most insider threat models describe risk as the combination of motivation, opportunity, and capability. Intentions cannot be read, and opportunity is built into ordinary work, because people must reach data to use it. The factor you can control directly is capability, along with the behavior around its use.
Reducing capability does not make an incident less likely. It makes the incident that does occur smaller, slower, and easier to see. That places the discipline at the preventive end of an insider threat program: it works every day, while detection is judged on rare events.
Capability management in practice
In practice the work is a lifecycle, not a one-time lockdown. Many teams keep their groups in a directory service, so reviews start from one list of accounts.
| Control | What it means |
|---|---|
| Least privilegeAccess matches current duties | Each subject holds only the access its duties require, and only for as long as they last. |
| Separation of dutiesNo single approver | No single subject both creates and approves a critical action. Privilege combinations are reviewed, not only single rights. |
| Provisioning and recertificationNamed approver, periodic review | Access is granted with a named approver, reconfirmed by its owner and revoked on role change. |
| Privileged and service accountsTime-limited elevation | Administrative elevation is time-limited, scoped, and logged. Service accounts are inventoried and their credentials rotated. |
| Non-human subjectsProcesses and automations | Processes and automations get an explicit, minimal, and reviewable capability set. |
Where it sits among other controls
Capability and behavior management is preventive, and its neighbors cover what it cannot see. Identity and access management supplies the plumbing: directories, groups, and approval workflows. Behavior analytics observes conduct against baselines and declared rules, and data loss prevention enforces rules at the content level, whoever holds the privilege.
The division of labor matters in both directions. Monitoring without capability limits produces alerts without containment, since a confirmed violation leaves the subject able to repeat it. Capability limits without observation produce silent containment, because nobody learns when the rules are tested. Investigation and response take over once a signal exists.
What it looks like in Anexet
In the Anexet console, rights are set per user group. The Privileges tab lists the modules that group members can open, and the access view shows which group grants each right, so an unexpected permission can be traced to its source.
1 / 2
Behavior management in practice
Behavior management begins on paper and ends in enforcement. A published rule that nobody enforces creates an appearance of control, not control:
- 1
Set acceptable use rules
Define which channels, data, and actions are normal at work, in a policy that subjects know and acknowledge.
- 2
Add technical restrictions
Where behavior meets capability: blocking conditions, channels switched off for defined groups, quarantine of out-of-policy actions.
- 3
Apply predictable consequences
Use sanctions that are proportionate and applied consistently. Deterrence depends more on consistency than on severity.
- 4
Observe against the rules
Compare what subjects actually do with what the rules allow, so violations surface as events.
- 5
Guide and reinforce
Training, clear examples, and recognition of good practice shape conduct, not only punish its absence.
Limits and trade-offs
The failure modes are predictable. Capabilities set tighter than the work requires block ordinary tasks and create exception queues. Left loose, they build up into privilege creep. Conduct rules enforced selectively lose their meaning faster than rules that do not exist, because they teach people that enforcement is arbitrary.
Behavior observation overlaps with employee monitoring and inherits its legal limits: proportionality, transparency, purpose limitation and, in many jurisdictions, consultation with employee representatives. It reduces impact without removing risk, so programs pair it with detection and response.
A subject acting within its granted rights can still cause harm. Pair these controls with detection and response.
Where to start
Start with the data that would hurt most if it left, then map the capabilities and channels that reach it. Policies written for every file and every privilege at once end up blocking work and get switched off.
Further reading: Profiling.
Capability decides what can happen. Behavior rules decide what should happen. Both need an owner.
Anexet Team