{
  "code": null,
  "collection": "architecture",
  "href": "https://banes-lab.com/ontology#architecture-access-control",
  "id": "access-control",
  "kind": "mechanism",
  "layer": {
    "href": "https://banes-lab.com/ontology/schema#layer-security-core",
    "json": "https://banes-lab.com/json/records/layer/security-core",
    "label": "Security Core",
    "markdown": "https://banes-lab.com/records/layer/security-core.md",
    "ref": "layer:security-core"
  },
  "name": "Access Control",
  "ref": "architecture:access-control",
  "relations": [
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-authorization-policy",
          "json": "https://banes-lab.com/json/records/lexicon/authorization-policy",
          "label": "Authorization Policy",
          "markdown": "https://banes-lab.com/records/lexicon/authorization-policy.md",
          "ref": "lexicon:authorization-policy"
        }
      ],
      "relation": "requires"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-least-privilege",
          "json": "https://banes-lab.com/json/records/architecture/least-privilege",
          "label": "Least Privilege",
          "markdown": "https://banes-lab.com/records/architecture/least-privilege.md",
          "ref": "architecture:least-privilege"
        }
      ],
      "relation": "reinforces"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-resource-protection",
          "json": "https://banes-lab.com/json/records/lexicon/resource-protection",
          "label": "Resource Protection",
          "markdown": "https://banes-lab.com/records/lexicon/resource-protection.md",
          "ref": "lexicon:resource-protection"
        }
      ],
      "relation": "enables"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-unrestricted-access",
          "json": "https://banes-lab.com/json/records/lexicon/unrestricted-access",
          "label": "Unrestricted Access",
          "markdown": "https://banes-lab.com/records/lexicon/unrestricted-access.md",
          "ref": "lexicon:unrestricted-access"
        }
      ],
      "relation": "conflicts-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-usability",
          "json": "https://banes-lab.com/json/records/lexicon/usability",
          "label": "Usability",
          "markdown": "https://banes-lab.com/records/lexicon/usability.md",
          "ref": "lexicon:usability"
        }
      ],
      "relation": "tensions-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#tension-access-control-usability",
          "json": "https://banes-lab.com/json/records/tension/access-control-usability",
          "label": "Access Control / Usability",
          "markdown": "https://banes-lab.com/records/tension/access-control-usability.md",
          "ref": "tension:access-control-usability"
        }
      ],
      "relation": "tensions"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-unrestricted-access",
          "json": "https://banes-lab.com/json/records/lexicon/unrestricted-access",
          "label": "Unrestricted Access",
          "markdown": "https://banes-lab.com/records/lexicon/unrestricted-access.md",
          "ref": "lexicon:unrestricted-access"
        }
      ],
      "relation": "violated-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#vocabulary-severity-mandatory",
          "json": "https://banes-lab.com/json/records/vocabulary/severity-mandatory",
          "label": "mandatory",
          "markdown": "https://banes-lab.com/records/vocabulary/severity-mandatory.md",
          "ref": "vocabulary:severity-mandatory"
        }
      ],
      "relation": "severity"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/records/architecture-category/security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md",
          "ref": "architecture-category:security-privacy-compliance-governance"
        }
      ],
      "relation": "category"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-centralized-configuration",
          "json": "https://banes-lab.com/json/records/architecture/centralized-configuration",
          "label": "Centralized Configuration",
          "markdown": "https://banes-lab.com/records/architecture/centralized-configuration.md",
          "ref": "architecture:centralized-configuration"
        }
      ],
      "relation": "required-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-security-by-design",
          "json": "https://banes-lab.com/json/records/architecture/security-by-design",
          "label": "Security by Design",
          "markdown": "https://banes-lab.com/records/architecture/security-by-design.md",
          "ref": "architecture:security-by-design"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-attack-surface-reduction",
          "json": "https://banes-lab.com/json/records/architecture/attack-surface-reduction",
          "label": "Attack Surface Reduction",
          "markdown": "https://banes-lab.com/records/architecture/attack-surface-reduction.md",
          "ref": "architecture:attack-surface-reduction"
        }
      ],
      "relation": "refactors"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-authentication",
          "json": "https://banes-lab.com/json/records/architecture/authentication",
          "label": "Authentication",
          "markdown": "https://banes-lab.com/records/architecture/authentication.md",
          "ref": "architecture:authentication"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-role-based-access-control",
          "json": "https://banes-lab.com/json/records/architecture/role-based-access-control",
          "label": "Role-Based Access Control",
          "markdown": "https://banes-lab.com/records/architecture/role-based-access-control.md",
          "ref": "architecture:role-based-access-control"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-session-management",
          "json": "https://banes-lab.com/json/records/architecture/session-management",
          "label": "Session Management",
          "markdown": "https://banes-lab.com/records/architecture/session-management.md",
          "ref": "architecture:session-management"
        }
      ],
      "relation": "reinforced-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-control-coordination-centralization",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-control-coordination-centralization",
          "label": "Control / Coordination / Centralization",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-control-coordination-centralization.md",
          "ref": "chapter:/ontology#architecture-category-control-coordination-centralization"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md",
          "ref": "chapter:/ontology#architecture-category-security-privacy-compliance-governance"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-security-privacy-compliance",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-security-privacy-compliance",
          "label": "Security Privacy Compliance",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-security-privacy-compliance"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-vocabulary-severity",
          "json": "https://banes-lab.com/json/ontology/schema/the-vocabulary-severity",
          "label": "Severity levels",
          "markdown": "https://banes-lab.com/ontology/schema/the-vocabulary-severity.md",
          "ref": "chapter:/ontology/schema#the-vocabulary-severity"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-resolutions",
          "json": "https://banes-lab.com/json/ontology/schema/the-resolutions",
          "label": "The resolutions",
          "markdown": "https://banes-lab.com/ontology/schema/the-resolutions.md",
          "ref": "chapter:/ontology/schema#the-resolutions"
        }
      ],
      "relation": "linked-from"
    }
  ],
  "summary": "A mechanism that evaluates an access policy for each request to a resource and denies the request when the policy does not allow it.",
  "siblings": {
    "next": {
      "href": "https://banes-lab.com/ontology#architecture-role-based-access-control",
      "json": "https://banes-lab.com/json/records/architecture/role-based-access-control",
      "label": "Role-Based Access Control (RBAC)",
      "markdown": "https://banes-lab.com/records/architecture/role-based-access-control.md",
      "ref": "architecture:role-based-access-control"
    },
    "previous": {
      "href": "https://banes-lab.com/ontology#architecture-authorization",
      "json": "https://banes-lab.com/json/records/architecture/authorization",
      "label": "Authorization",
      "markdown": "https://banes-lab.com/records/architecture/authorization.md",
      "ref": "architecture:authorization"
    }
  },
  "up": {
    "href": null,
    "json": "https://banes-lab.com/json/api/records/architecture",
    "label": "Architecture principles",
    "markdown": "https://banes-lab.com/api/records/architecture.md",
    "ref": "api:records/architecture"
  },
  "aliases": [],
  "exemplar": {
    "after": "const decision = accessPolicy.evaluate({\n  subject: user,\n  action: \"foo:list\",\n  resource: { tenantId: request.tenantId },\n});\nif (!decision.allowed) throw new ForbiddenError();\nreturn fooStore.findAll(request.tenantId);",
    "before": "if (user.role === \"admin\") return fooStore.findAll();",
    "lang": "ts",
    "medium": "code"
  },
  "formedBy": null,
  "scope": [
    "API",
    "data",
    "infrastructure"
  ],
  "severity": "mandatory"
}