# The lex records whose category is security-privacy-compliance

This index as JSON: https://banes-lab.com/json/api/facets/lex/category/security-privacy-compliance

## Entries

- [Ad-Hoc Permission Checks](https://banes-lab.com/records/lex/ad-hoc-permission-checks.md): Authorization logic scattered inline throughout the codebase instead of centralized, leaving checks inconsistent and easy to omit.
- [Ambient-Credential Trust](https://banes-lab.com/records/lex/ambient-credential-trust.md): Treating any request that carries ambient credentials, such as a session cookie, as legitimate without verifying its origin or intent.
- [Anonymous Sensitive Access](https://banes-lab.com/records/lex/anonymous-sensitive-access.md): Permitting access to sensitive resources without first establishing the caller's identity.
- [Assumption-Driven Security](https://banes-lab.com/records/lex/assumption-driven-security.md): Designing defenses around assumed threats rather than a deliberate analysis of realistic attack vectors.
- [Authenticated-Equals-Authorized](https://banes-lab.com/records/lex/authenticated-equals-authorized.md): Conflating authentication with authorization, so any authenticated caller is granted access without a permission check.
- [Broad Admin Access](https://banes-lab.com/records/lex/broad-admin-access.md): Granting sweeping administrative privileges by default instead of the least access each role requires.
- [Document-Only Policy](https://banes-lab.com/records/lex/document-only-policy.md): Expressing security policy only as prose documentation, so it cannot be enforced automatically and drifts from what the system does.
- [Hardcoded Rules](https://banes-lab.com/records/lex/hardcoded-rules.md): Embedding access rules directly in code, so changing policy requires a code change and cannot respond to runtime attributes.
- [Hardcoded Secrets](https://banes-lab.com/records/lex/hardcoded-secrets.md): Embedding credentials, keys, or tokens directly in source or configuration, exposing them to anyone who can read it.
- [Immortal Client-Trusted Session](https://banes-lab.com/records/lex/immortal-client-trusted-session.md): A session that never expires and is trusted from client-supplied state alone, so a captured token grants indefinite access.
- [Insecure Defaults](https://banes-lab.com/records/lex/insecure-defaults.md): Shipping default settings that favor convenience over safety, leaving a system exposed unless it is explicitly hardened.
- [Manual-Only Review](https://banes-lab.com/records/lex/manual-only-review.md): Relying solely on human review to catch policy violations, which neither scales nor reliably covers every case.
- [Plaintext Sensitive Storage](https://banes-lab.com/records/lex/plaintext-sensitive-storage.md): Storing sensitive data unencrypted at rest, exposing it to anyone who reaches the underlying storage.
- [Plaintext Transport](https://banes-lab.com/records/lex/plaintext-transport.md): Sending data over an unencrypted channel, exposing it to interception and tampering in transit.
- [Point-in-Time Audit Only](https://banes-lab.com/records/lex/point-in-time-audit-only.md): Verifying compliance only at isolated audit moments, leaving the intervals between checks unmonitored for drift.
- [Raw Output Rendering](https://banes-lab.com/records/lex/raw-output-rendering.md): Emitting untrusted data into output without encoding it for its context, enabling injection attacks such as cross-site scripting.
- [Security as Afterthought](https://banes-lab.com/records/lex/security-as-afterthought.md): Deferring security concerns until late in development, when vulnerabilities are costly and difficult to remediate.
- [Single Control Reliance](https://banes-lab.com/records/lex/single-control-reliance.md): Depending on one security control with no layered defenses, so a single bypass compromises the whole system.
- [String-Concatenated SQL](https://banes-lab.com/records/lex/string-concatenated-sql.md): Assembling SQL queries by concatenating untrusted input into strings, opening the system to SQL injection.
- [Trusted Internal Network Assumption](https://banes-lab.com/records/lex/trusted-internal-network-assumption.md): Assuming that traffic originating inside the network perimeter is inherently trustworthy, ignoring insider and lateral-movement threats.
- [Trusting External Input](https://banes-lab.com/records/lex/trusting-external-input.md): Accepting external input as well-formed and safe without validating it, exposing the system to malformed or malicious data.
- [Unbounded Autonomy](https://banes-lab.com/records/lex/unbounded-autonomy.md): Allowing an actor or component to act without governance limits, so unsafe or unauthorized actions go unchecked.
- [Unbounded Data Collection](https://banes-lab.com/records/lex/unbounded-data-collection.md): Gathering and retaining more personal data than a purpose requires, inflating privacy risk and regulatory exposure.
- [Uncontrolled Change](https://banes-lab.com/records/lex/uncontrolled-change.md): Permitting changes to a controlled system without review, approval, or record, undermining compliance and traceability.
- [Unknown/Unowned Risk](https://banes-lab.com/records/lex/unknown-unowned-risk.md): A risk that has been neither identified nor assigned to an owner, so it goes unmanaged until it materializes.
- [Unnecessary Public Surface](https://banes-lab.com/records/lex/unnecessary-public-surface.md): Exposing more endpoints, ports, or interfaces publicly than the function requires, enlarging the attack surface.
- [Unrestricted Access](https://banes-lab.com/records/lex/unrestricted-access.md): Permitting access to a resource with no controls, so any caller can invoke any operation.
- [Assets](https://banes-lab.com/records/lex/assets.md): The data, systems, and capabilities of value that a threat model enumerates as the things worth protecting.
- [Attribute Definitions](https://banes-lab.com/records/lex/attribute-definitions.md): Declared descriptions of the subject, resource, action, and environment attributes that an access policy evaluates.
- [Authenticated Principal](https://banes-lab.com/records/lex/authenticated-principal.md): The verified identity of the user or service on whose behalf a request executes, against which permissions are checked.
- [Authorization Policy](https://banes-lab.com/records/lex/authorization-policy.md): The declared set of rules determining which principals may perform which actions on which resources.
- [Consent/Policy](https://banes-lab.com/records/lex/consent-policy.md): The recorded permission and governing rules under which personal data may lawfully be collected and processed.
- [Context-Aware Encoding](https://banes-lab.com/records/lex/context-aware-encoding.md): Choosing an output encoding matched to the destination context, such as HTML, an attribute, a URL or a script, so data is neutralized wherever it lands.
- [Continuous Authorization](https://banes-lab.com/records/lex/continuous-authorization.md): The practice of re-verifying a caller's authorization on every request rather than trusting a single earlier check.
- [Controls](https://banes-lab.com/records/lex/controls.md): The safeguards and countermeasures put in place to reduce security or compliance risk to an acceptable level.
- [Data Minimization](https://banes-lab.com/records/lex/data-minimization.md): Collecting and retaining only the personal data strictly necessary for a stated purpose.
- [Defined Policy](https://banes-lab.com/records/lex/defined-policy.md): An explicit, declared set of rules specifying what is permitted or denied, against which enforcement acts.
- [Evidence Automation](https://banes-lab.com/records/lex/evidence-automation.md): The ability to generate and collect compliance evidence automatically from live systems rather than assembling it by hand.
- [Identity Proof](https://banes-lab.com/records/lex/identity-proof.md): The evidence a principal presents to establish its identity, such as a password, token, or certificate.
- [Key Management](https://banes-lab.com/records/lex/key-management.md): The activity of generating, distributing, rotating, and revoking cryptographic keys across their lifecycle.
- [Layered Controls](https://banes-lab.com/records/lex/layered-controls.md): The requirement that multiple independent safeguards protect a resource, so no single failure exposes it.
- [Machine-Readable Policies](https://banes-lab.com/records/lex/machine-readable-policies.md): Security or compliance policies expressed in a structured, executable format that tools can evaluate directly.
- [Minimal Exposure](https://banes-lab.com/records/lex/minimal-exposure.md): The condition of exposing only the endpoints, ports, and capabilities strictly required.
- [Minimal Permissions](https://banes-lab.com/records/lex/minimal-permissions.md): The requirement that each principal hold only the permissions its function needs.
- [Mitigation](https://banes-lab.com/records/lex/mitigation.md): The activity of reducing a risk's likelihood or impact through deliberate countermeasures.
- [Policy Engine](https://banes-lab.com/records/lex/policy-engine.md): A runtime component that evaluates access requests against declared policies and returns permit or deny decisions.
- [Query Parameter Binding](https://banes-lab.com/records/lex/query-parameter-binding.md): Passing query values as bound parameters separate from the query text, so input can never alter the query structure.
- [Request Origin Verification](https://banes-lab.com/records/lex/request-origin-verification.md): Confirming that a state-changing request originates from a trusted client, typically via a token or origin check.
- [Review](https://banes-lab.com/records/lex/review.md): The activity of examining a change or artifact against standards before it is accepted.
- [Risk Identification](https://banes-lab.com/records/lex/risk-identification.md): The activity of discovering and cataloguing the risks that could affect a system or objective.
- [Role Definitions](https://banes-lab.com/records/lex/role-definitions.md): Declared sets of permissions grouped into named roles that are assigned to principals.
- [Rotation Policy](https://banes-lab.com/records/lex/rotation-policy.md): The specified interval and procedure by which secrets or keys must be replaced to limit the value of any single compromise.
- [Secret Store](https://banes-lab.com/records/lex/secret-store.md): A dedicated, access-controlled repository that holds credentials and keys outside of application code.
- [Threat Scenarios](https://banes-lab.com/records/lex/threat-scenarios.md): Concrete descriptions of how an attacker might attempt to compromise a system, enumerated during threat modeling.
- [TLS/mTLS](https://banes-lab.com/records/lex/tls-mtls.md): Transport-layer protocols that encrypt a connection and, with mutual TLS, mutually authenticate both endpoints.
- [Trust Boundaries](https://banes-lab.com/records/lex/trust-boundaries.md): The demarcations in a system where the level of trust changes and data crossing them must be validated.
- [Strong Identity](https://banes-lab.com/records/lex/strong-identity.md): The requirement that every actor prove a strong, verified identity before any access is granted.
- [Validation Rules](https://banes-lab.com/records/lex/validation-rules.md): Declared constraints that input must satisfy, such as type, range, format and length, before it is accepted.
- [Automated Control](https://banes-lab.com/records/lex/automated-control.md): The ability to enforce rules automatically at runtime without manual intervention.
- [Bounded Session Lifetime](https://banes-lab.com/records/lex/bounded-session-lifetime.md): The degree to which a session's validity is time-limited so that access does not persist indefinitely.
- [Coarse-Grained Permission Management](https://banes-lab.com/records/lex/coarse-grained-permission-management.md): The ability to manage access by assigning broad, role-level permission sets rather than per-individual grants.
- [Compromise Containment](https://banes-lab.com/records/lex/compromise-containment.md): The ability to keep a breach confined to one layer or segment so it cannot spread system-wide.
- [Confidentiality](https://banes-lab.com/records/lex/confidentiality.md): The degree to which data is kept secret from all but authorized parties.
- [Confidentiality of Stored Data](https://banes-lab.com/records/lex/confidentiality-of-stored-data.md): The degree to which data held at rest remains unreadable to anyone without authorized access.
- [Context-Aware Authorization](https://banes-lab.com/records/lex/context-aware-authorization.md): The ability to base access decisions on the runtime context of a request, such as its attributes, its environment and the resource's state.
- [Control Selection](https://banes-lab.com/records/lex/control-selection.md): The activity of choosing which security controls to apply based on identified threats and their priority.
- [Data Protection](https://banes-lab.com/records/lex/data-protection.md): The ability to safeguard data against unauthorized access, loss, or disclosure throughout its lifecycle.
- [Fine-Grained Access Control](https://banes-lab.com/records/lex/fine-grained-access-control.md): The ability to grant or deny access at a precise level using specific attributes rather than broad roles.
- [Forged-Request Rejection](https://banes-lab.com/records/lex/forged-request-rejection.md): The ability to detect and reject requests that a user did not intentionally initiate.
- [Identity-Aware Authorization](https://banes-lab.com/records/lex/identity-aware-authorization.md): The ability to make access decisions grounded in a verified caller identity.
- [Injection Prevention](https://banes-lab.com/records/lex/injection-prevention.md): The ability to stop untrusted input from being interpreted as executable code or commands.
- [Injection-Safe Data Access](https://banes-lab.com/records/lex/injection-safe-data-access.md): The ability to query data such that input can never be interpreted as part of the query structure.
- [Integrity](https://banes-lab.com/records/lex/integrity.md): The degree to which data is protected from unauthorized or undetected alteration.
- [Ongoing Assurance](https://banes-lab.com/records/lex/ongoing-assurance.md): The ability to demonstrate continuously that controls remain effective, rather than only at audit time.
- [Perimeterless Security](https://banes-lab.com/records/lex/perimeterless-security.md): A security model that trusts no network location implicitly and verifies every request regardless of origin.
- [Priority-Based Controls](https://banes-lab.com/records/lex/priority-based-controls.md): The ability to apply controls in order of risk priority, addressing the greatest exposure first.
- [Privacy Compliance](https://banes-lab.com/records/lex/privacy-compliance.md): The degree to which a system meets the privacy obligations imposed by law and policy.
- [Proactive Risk Reduction](https://banes-lab.com/records/lex/proactive-risk-reduction.md): The ability to reduce risk by designing safeguards in from the start rather than patching flaws later.
- [Reduced Blast Radius](https://banes-lab.com/records/lex/reduced-blast-radius.md): The degree to which the impact of a compromise is confined to a limited scope.
- [Reduced Exploitability](https://banes-lab.com/records/lex/reduced-exploitability.md): The degree to which fewer exposed features leave a system harder to exploit.
- [Reduced Misconfiguration Risk](https://banes-lab.com/records/lex/reduced-misconfiguration-risk.md): The degree to which safe defaults lower the chance of an insecure configuration.
- [Regulatory Alignment](https://banes-lab.com/records/lex/regulatory-alignment.md): The degree to which a system conforms to the laws and regulations that govern it.
- [Resource Protection](https://banes-lab.com/records/lex/resource-protection.md): The ability to ensure that only permitted operations reach a protected resource.
- [Revocable Access](https://banes-lab.com/records/lex/revocable-access.md): The ability to withdraw a principal's access immediately when a session or grant is terminated.
- [Safe Credential Handling](https://banes-lab.com/records/lex/safe-credential-handling.md): The ability to store, transmit, and use credentials without exposing them.
- [Safe Rendering](https://banes-lab.com/records/lex/safe-rendering.md): The ability to display untrusted data without allowing it to execute as markup or script.
- [Secure Communication](https://banes-lab.com/records/lex/secure-communication.md): The ability to exchange data over a channel protected from interception and tampering.
- [Secure Configuration](https://banes-lab.com/records/lex/secure-configuration.md): The degree to which a system's settings and secrets are arranged to minimize exposure.
- [Zero Trust](https://banes-lab.com/records/lex/zero-trust.md): A security stance that grants no implicit trust and continuously verifies every access request regardless of its source.
- [Analytics/Personalization](https://banes-lab.com/records/lex/analytics-personalization.md): The ability to analyze collected data and tailor experiences to individuals, in tension with strict data minimization.
- [Certificate Management](https://banes-lab.com/records/lex/certificate-management.md): The activity of issuing, deploying, renewing, and revoking the digital certificates that transport encryption depends on.
- [Client Complexity](https://banes-lab.com/records/lex/client-complexity.md): The degree of additional effort a protective measure imposes on client implementations.
- [Developer Ergonomics](https://banes-lab.com/records/lex/developer-ergonomics.md): The degree to which a system is convenient and pleasant for developers to work with.
- [Dynamic Query Flexibility](https://banes-lab.com/records/lex/dynamic-query-flexibility.md): The degree of freedom to vary a query's structure at runtime, constrained when inputs must be bound as parameters.
- [Ease of Initial Use](https://banes-lab.com/records/lex/ease-of-initial-use.md): The degree to which a system is easy to start using without upfront configuration.
- [Feature Exposure](https://banes-lab.com/records/lex/feature-exposure.md): The degree to which functionality is made accessible, which broadens capability but enlarges the attack surface.
- [Formatting Flexibility](https://banes-lab.com/records/lex/formatting-flexibility.md): The degree of latitude to present output in varied formats, constrained when encoding must be strict.
- [Input Flexibility](https://banes-lab.com/records/lex/input-flexibility.md): The degree to which a system accepts varied or loosely-structured input, in tension with strict validation.
- [Key Operations](https://banes-lab.com/records/lex/key-operations.md): The degree of operational burden imposed by generating, rotating, and safeguarding cryptographic keys.
- [Latency/Complexity](https://banes-lab.com/records/lex/latency-complexity.md): The degree of added latency and complexity introduced by verifying every request rather than trusting a perimeter.
- [Operational Convenience](https://banes-lab.com/records/lex/operational-convenience.md): The degree to which broad access makes day-to-day operations easier, in tension with least privilege.
- [Pipeline Complexity](https://banes-lab.com/records/lex/pipeline-complexity.md): The degree of intricacy added to a delivery pipeline by embedding continuous checks within it.
- [Policy Maintenance](https://banes-lab.com/records/lex/policy-maintenance.md): The activity of keeping codified policies correct and current as requirements evolve.
- [Role Explosion](https://banes-lab.com/records/lex/role-explosion.md): The degree to which roles proliferate into many narrow definitions as access requirements grow.
- [Speed](https://banes-lab.com/records/lex/speed.md): The degree to which delivery proceeds rapidly, in tension with the caution that managing risk requires.
- [Team Velocity](https://banes-lab.com/records/lex/team-velocity.md): The rate at which a team delivers completed work, which governance overhead can slow.
- [Usability](https://banes-lab.com/records/lex/usability.md): The ease with which users can accomplish their goals with a system.
- [User Convenience](https://banes-lab.com/records/lex/user-convenience.md): The degree to which a system minimizes friction and effort for its users.