# SEC08-BP04: Enforce access control

## Description

Key policies.

## Implementation Guidance

- Key policies restrict access
- Separation of key admins and users
- Audit key usage
- Cross-account key access controls
- Emergency key access procedures

## Risk Level

High - Unrestricted key access defeats encryption.
