AZ400-Q: limit a release maintainer
A release engineer must approve deployments but must not edit source. Which access model best fits?
- A) Give organization-owner access.
- B) Share a developer’s personal token.
- C) Grant the smallest environment/deployment approval permission, separate from repository write access. ✓
- D) Use the same account for every engineer. Answer: C. Separation and least privilege limit the blast radius. Why not the others: Broad, shared, or personal access is harder to control and audit.