classes of user
163601·updated Sep 1, 2026A grouping mechanism used in access-control policy and governance by which individual accounts or principals are aggregated into named categories that share a common privilege profile, trust level, or functional responsibility. Unlike a single role tied to one job function, a "class of users" operates at a higher level of abstraction — it may encompass multiple roles, account types (e.g., privileged, non-privileged, service accounts), or populations (e.g., internal users, contractors, administrators) that warrant the same set of access rights and the same oversight treatment. In practice, standards such as NIST SP 800-53 require organizations to periodically review "the privileges assigned to roles or classes of users to validate the need for such privileges," recognizing that privilege requirements change over time with shifts in mission, technology, or threat. NIST SP 800-171A similarly operationalizes the concept by requiring that organizations define the frequency at which privileges assigned to roles or classes of users are reviewed, and then actually perform that review to validate continued need.
Source
Review the privileges assigned to roles or classes of users [ Assignment:the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- AC-6(7): Review Of User Privileges - CSF Tools
- Assessing Security Requirements for Controlled Unclassified Information
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A categorization scheme used in access control policy to group principals — human users, service accounts, or processes — by shared functional role, organizational position, trust level, or privilege profile, so that access rights and restrictions can be assigned uniformly to the group rather than individually. NIST SP 800-53 uses it as a policy variable (e.g., "the privileges assigned to organization-defined roles or classes of users") to let each organization name the groupings that map to its own mission and business functions. The CNSSI 4009 glossary likewise places it at system-description level, listing "classes of users" alongside operational policies and system interactions as components of a security concept of operations. In authorization frameworks, membership in a class is determined by attributes associated with the user and then mapped to one or more application roles, with selective access granted based on that membership — making the expression a standard way to abstract the diversity of real-world principals into a manageable, auditable privilege structure.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- classes of users
- possessive
- classes of user's
- pluralpossessive
- classes of users'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A grouping mechanism used in access-control policy and governance by which individual accounts or principals are aggregated into named categories that share a common privilege profile, trust level, or functional responsibility. Unlike a single role tied to one job function, a "class of users" operates at a higher level of abstraction — it may encompass multiple roles, account types (e.g., privileged, non-privileged, service accounts), or populations (e.g., internal users, contractors, administrators) that warrant the same set of access rights and the same oversight treatment. In practice, standards such as NIST SP 800-53 require organizations to periodically review "the privileges assigned to roles or classes of users to validate the need for such privileges," recognizing that privilege requirements change over time with shifts in mission, technology, or threat. NIST SP 800-171A similarly operationalizes the concept by requiring that organizations define the frequency at which privileges assigned to roles or classes of users are reviewed, and then actually perform that review to validate continued need.DR-088 backfill from the noun definition column