1. Read what the person needs to do.
2. Choose the narrowest permission that still lets them do the job.
3. Choose when the access should end.
4. Choose the right sign-in protection.

A correct answer is the combination of all three choices, so guessing one button is not enough.

Grades: 6–12. Run time: about 14–18 minutes.

Discussion question: Why should access change when a role, class, contract, or project ends?

Mechanic: This is the identity-lifecycle deep dive. Every request requires three separate decisions: permission, duration, and sign-in protection. It is intentionally different from Cloud Security Builder, where access is only one of five cloud design areas.

All people and roles are fictional and neutral. No scenario accuses a student of wrongdoing. The game contains no real accounts, credentials, personal data, exploit detail, or stored results.