Authorization

Kind: mechanism

Layer: Security Core

Record: architecture:authorization

Severity: mandatory

Scope: API, domain action, data access

Canonical: Ontology

A mechanism that decides, from a policy, whether an authenticated principal may perform an action on a resource.

Listed in Architecture principles, after Authentication and before Access Control.

Requires

• Authenticated Principal
• Policy

Reinforces

• Least Privilege

Enables

• Controlled Access

Conflicts with

• Authenticated-Equals-Authorized
• Authorization Scattering

In tension with

• Policy Complexity

Tensions

• Authorization / Policy Complexity

Violated by

• Unrestricted Access

Refactored by

• Policy Enforcement
• Centralize Policy

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Enabled by

• Proxy Pattern

Refactors

• Zero Trust Architecture

Linked from

• Anti-patterns
• Structural Patterns
• Security / Privacy / Compliance / Governance
• Core Vocabulary
• Quality Attributes
• Security Privacy Compliance
• Severity levels
• The resolutions