32 C.F.R. § 2400.25 – Access.

(a) A person is eligible for access to classified information provided that a determination of trustworthiness has been made by agency heads or designated officials and provided that such access is essential to the accomplishment of lawful and authorized Government purposes. A personnel security clearance is an indication that the trustworthiness decision has been made. Procedures shall be established by the head of each office to prevent access to classified information before a personnel security clearance has been granted. The number of people cleared and granted access to classified information shall be maintained at the minimum number that is consistent with operational requirements and needs. No one has a right to have access to classified information solely by virtue of rank or position. The final responsibility for determinating whether an individual's official duties require possession of or access to any element or item of classified information, and whether the individual has been granted the appropriate security clearance by proper authority, rests with the individual who has authorized possession, knowledge, or control of the information and not with the prospective recipient. These principles are equally applicable if the prospective recipient is an organizational entity, other Federal agencies, contractors, foreign governments, and others.
(b) When access to a specific classification category is no longer required for the performance of an individual's assigned duties, the security clearance will be administratively adjusted, without prejudice to the individual, to the classification category, if any, required.
(c) The Director, Office of Science and Technology Policy may create special access programs to control access, distribution, and protection of particularly sensitive information classified pursuant to Executive Order 12356 or predecessor orders if:
1. (1) Normal management and safeguarding procedures do not limit access sufficiently;
2. (2) The number of persons with access is limited to the minimum necessary to meet the objective of providing extra protection for the information;
3. (3) The special access program is established in writing; and
4. (4) A system of accounting for the program is established and maintained.