# Authorization

Record: `arch:authorization`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: API, domain action, data access
Canonical: https://banes-lab.com/ontology#arch-authorization

## Repair

- Refactored by: Add Policy Check, Centralize Authorization
- Detected by: protected operation without authz guard
- Violated by: missing permission check
- Measured by: authorization coverage
- Enforced by: security tests, [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

## requires

- [Authenticated Principal](https://banes-lab.com/records/lex/authenticated-principal.md)
- [Policy](https://banes-lab.com/records/lex/policy.md)

## reinforces

- [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

## enables

- [Controlled Access](https://banes-lab.com/records/lex/controlled-access.md)

## conflicts-with

- [Authenticated-Equals-Authorized](https://banes-lab.com/records/lex/authenticated-equals-authorized.md)
- [Authorization Scattering](https://banes-lab.com/records/arch/authorization-scattering.md)

## tensions-with

- [Policy Complexity](https://banes-lab.com/records/lex/policy-complexity.md)

## tensions

- [Authorization Policy Complexity](https://banes-lab.com/records/tension/authorization-policy-complexity.md)

## referenced-by

- [Proxy Pattern](https://banes-lab.com/records/arch/proxy-pattern.md)