# Access Control

> A mechanism that evaluates an access policy for each request to a resource and denies the request when the policy does not allow it.

Record: `architecture:access-control`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: API, data, infrastructure
Canonical: https://banes-lab.com/ontology#architecture-access-control

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Authorization](https://banes-lab.com/records/architecture/authorization.md) and before [RBAC](https://banes-lab.com/records/architecture/role-based-access-control.md).

## Repair

- Refactored by: Add ACL/RBAC/ABAC Policy
- Detected by: resource endpoint lacking policy
- Violated by: broad or missing access controls
- Measured by: access control coverage
- Enforced by: policy tests

## Requires

- [Authorization Policy](https://banes-lab.com/records/lexicon/authorization-policy.md)

## Reinforces

- [Least Privilege](https://banes-lab.com/records/architecture/least-privilege.md)

## Enables

- [Resource Protection](https://banes-lab.com/records/lexicon/resource-protection.md)

## Conflicts with

- [Unrestricted Access](https://banes-lab.com/records/lexicon/unrestricted-access.md)

## In tension with

- [Usability](https://banes-lab.com/records/lexicon/usability.md)

## Tensions

- [Access Control / Usability](https://banes-lab.com/records/tension/access-control-usability.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Required by

- [Centralized Configuration](https://banes-lab.com/records/architecture/centralized-configuration.md)

## Reinforced by

- [Authentication](https://banes-lab.com/records/architecture/authentication.md)
- [RBAC](https://banes-lab.com/records/architecture/role-based-access-control.md)
- [Session Management](https://banes-lab.com/records/architecture/session-management.md)

## Linked from

- [Control / Coordination / Centralization](https://banes-lab.com/ontology/principles/architecture-category-control-coordination-centralization.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)