Access Control

Kind: mechanism

Layer: Security Core

Record: architecture:access-control

Severity: mandatory

Scope: API, data, infrastructure

Canonical: Ontology

A mechanism that evaluates an access policy for each request to a resource and denies the request when the policy does not allow it.

Listed in Architecture principles, after Authorization and before Role-Based Access Control (RBAC).

Requires

• Authorization Policy

Reinforces

• Least Privilege

Enables

• Resource Protection

Conflicts with

• Unrestricted Access

In tension with

• Usability

Tensions

• Access Control / Usability

Violated by

• Unrestricted Access

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Required by

• Centralized Configuration

Refactors

• Security by Design
• Attack Surface Reduction

Reinforced by

• Authentication
• Role-Based Access Control
• Session Management

Linked from

• Control / Coordination / Centralization
• Security / Privacy / Compliance / Governance
• Security Privacy Compliance
• Severity levels
• The resolutions