Authentication

Kind: mechanism

Layer: Security Core

Record: architecture:authentication

Severity: mandatory

Scope: user, service, API

Canonical: Ontology

A mechanism that verifies a caller's claimed identity from a credential before any protected action runs.

Listed in Architecture principles, after Threat Modeling and before Authorization.

Requires

• Identity Proof

Reinforces

• Access Control

Enables

• Identity-Aware Authorization

Conflicts with

• Anonymous Sensitive Access

In tension with

• User Experience

Tensions

• Authentication / User Experience

Violated by

• Anonymous Sensitive Access

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Refactors

• Zero Trust Architecture

Reinforced by

• CSRF Protection

Required by

• Session Management

Linked from

• Security / Privacy / Compliance / Governance
• Quality Attributes
• Security Privacy Compliance
• Severity levels
• The resolutions