# Authorization Scattering

> A defect in which authorization checks are spread across layers with no central policy.

Record: `architecture:authorization-scattering`
Kind: anti-pattern
Layer: [Enforcement Core](https://banes-lab.com/records/layer/enforcement-core.md)
Severity: discouraged
Scope: security_governance, model_governance
Canonical: https://banes-lab.com/ontology#architecture-authorization-scattering

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Security Theater](https://banes-lab.com/records/architecture/security-theater.md) and before [Secret Sprawl](https://banes-lab.com/records/architecture/secret-sprawl.md).

## Repair

- Refactored by: centralize_policy, [policy_as_code](https://banes-lab.com/records/architecture/policy-as-code.md), ABAC_or_RBAC_model, authorization_tests
- Detected by: repeated_role_checks, missing_policy_engine, endpoint_without_authz, inconsistent_resource_access
- Violated by: Spread authorization checks across controllers, services, repositories, UI, and ad hoc conditionals without a central policy model.
- Measured by: endpoints without a policy check, duplicated role checks
- Enforced by: a policy engine, with authorization tests per endpoint

## Severity

- [discouraged](https://banes-lab.com/records/vocabulary/severity-discouraged.md)

## Category

- [Anti-patterns](https://banes-lab.com/records/architecture-category/anti-patterns.md)

## Force

- [Model governance](https://banes-lab.com/records/force/model-governance.md)
- [Security governance](https://banes-lab.com/records/force/security-governance.md)

## Negated by

- [Authorization](https://banes-lab.com/records/architecture/authorization.md)

## Linked from

- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The forces](https://banes-lab.com/ontology/schema/the-forces.md)