{
  "code": null,
  "collection": "architecture",
  "href": "https://banes-lab.com/ontology#architecture-authorization-scattering",
  "id": "authorization-scattering",
  "kind": "anti-pattern",
  "layer": {
    "href": "https://banes-lab.com/ontology/schema#layer-enforcement-core",
    "json": "https://banes-lab.com/json/records/layer/enforcement-core",
    "label": "Enforcement Core",
    "markdown": "https://banes-lab.com/records/layer/enforcement-core.md",
    "ref": "layer:enforcement-core"
  },
  "name": "Authorization Scattering",
  "ref": "architecture:authorization-scattering",
  "relations": [
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-centralize-policy",
          "json": "https://banes-lab.com/json/records/lexicon/centralize-policy",
          "label": "Centralize Policy",
          "markdown": "https://banes-lab.com/records/lexicon/centralize-policy.md",
          "ref": "lexicon:centralize-policy"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-policy-as-code",
          "json": "https://banes-lab.com/json/records/architecture/policy-as-code",
          "label": "Policy as Code",
          "markdown": "https://banes-lab.com/records/architecture/policy-as-code.md",
          "ref": "architecture:policy-as-code"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-attribute-based-access-control",
          "json": "https://banes-lab.com/json/records/architecture/attribute-based-access-control",
          "label": "Attribute-Based Access Control (ABAC)",
          "markdown": "https://banes-lab.com/records/architecture/attribute-based-access-control.md",
          "ref": "architecture:attribute-based-access-control"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-role-based-access-control",
          "json": "https://banes-lab.com/json/records/architecture/role-based-access-control",
          "label": "Role-Based Access Control (RBAC)",
          "markdown": "https://banes-lab.com/records/architecture/role-based-access-control.md",
          "ref": "architecture:role-based-access-control"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-authorization-tests",
          "json": "https://banes-lab.com/json/records/lexicon/authorization-tests",
          "label": "Authorization Tests",
          "markdown": "https://banes-lab.com/records/lexicon/authorization-tests.md",
          "ref": "lexicon:authorization-tests"
        }
      ],
      "relation": "refactored-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#vocabulary-severity-discouraged",
          "json": "https://banes-lab.com/json/records/vocabulary/severity-discouraged",
          "label": "discouraged",
          "markdown": "https://banes-lab.com/records/vocabulary/severity-discouraged.md",
          "ref": "vocabulary:severity-discouraged"
        }
      ],
      "relation": "severity"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-anti-patterns",
          "json": "https://banes-lab.com/json/records/architecture-category/anti-patterns",
          "label": "Anti-patterns",
          "markdown": "https://banes-lab.com/records/architecture-category/anti-patterns.md",
          "ref": "architecture-category:anti-patterns"
        }
      ],
      "relation": "category"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#force-model-governance",
          "json": "https://banes-lab.com/json/records/force/model-governance",
          "label": "Model governance",
          "markdown": "https://banes-lab.com/records/force/model-governance.md",
          "ref": "force:model-governance"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#force-security-governance",
          "json": "https://banes-lab.com/json/records/force/security-governance",
          "label": "Security governance",
          "markdown": "https://banes-lab.com/records/force/security-governance.md",
          "ref": "force:security-governance"
        }
      ],
      "relation": "force"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-authorization",
          "json": "https://banes-lab.com/json/records/architecture/authorization",
          "label": "Authorization",
          "markdown": "https://banes-lab.com/records/architecture/authorization.md",
          "ref": "architecture:authorization"
        }
      ],
      "relation": "negated-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-anti-patterns",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-anti-patterns",
          "label": "Anti-patterns",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md",
          "ref": "chapter:/ontology#architecture-category-anti-patterns"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md",
          "ref": "chapter:/ontology#architecture-category-security-privacy-compliance-governance"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-security-privacy-compliance",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-security-privacy-compliance",
          "label": "Security Privacy Compliance",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-security-privacy-compliance"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-vocabulary-severity",
          "json": "https://banes-lab.com/json/ontology/schema/the-vocabulary-severity",
          "label": "Severity levels",
          "markdown": "https://banes-lab.com/ontology/schema/the-vocabulary-severity.md",
          "ref": "chapter:/ontology/schema#the-vocabulary-severity"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-forces",
          "json": "https://banes-lab.com/json/ontology/schema/the-forces",
          "label": "The forces",
          "markdown": "https://banes-lab.com/ontology/schema/the-forces.md",
          "ref": "chapter:/ontology/schema#the-forces"
        }
      ],
      "relation": "linked-from"
    }
  ],
  "summary": "A defect in which authorization checks are spread across layers with no central policy.",
  "siblings": {
    "next": {
      "href": "https://banes-lab.com/ontology#architecture-secret-sprawl",
      "json": "https://banes-lab.com/json/records/architecture/secret-sprawl",
      "label": "Secret Sprawl",
      "markdown": "https://banes-lab.com/records/architecture/secret-sprawl.md",
      "ref": "architecture:secret-sprawl"
    },
    "previous": {
      "href": "https://banes-lab.com/ontology#architecture-security-theater",
      "json": "https://banes-lab.com/json/records/architecture/security-theater",
      "label": "Security Theater",
      "markdown": "https://banes-lab.com/records/architecture/security-theater.md",
      "ref": "architecture:security-theater"
    }
  },
  "up": {
    "href": null,
    "json": "https://banes-lab.com/json/api/records/architecture",
    "label": "Architecture principles",
    "markdown": "https://banes-lab.com/api/records/architecture.md",
    "ref": "api:records/architecture"
  },
  "aliases": [],
  "exemplar": {
    "after": "if (policy.can(user, \"delete\", foo)) deleteFoo();\nif (policy.can(user, \"edit\", foo)) editFoo();",
    "before": "if (user.role === \"admin\") deleteFoo();\nif (user.role === \"admin\" || user.id === foo.owner) editFoo();",
    "lang": "ts",
    "medium": "code"
  },
  "formedBy": "Spread authorization checks across controllers, services, repositories, UI, and ad hoc conditionals without a central policy model.",
  "scope": [
    "security_governance",
    "model_governance"
  ],
  "severity": "discouraged"
}