# Authorization

> A mechanism that decides, from a policy, whether an authenticated principal may perform an action on a resource.

Record: `architecture:authorization`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: API, domain action, data access
Canonical: https://banes-lab.com/ontology#architecture-authorization

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Authentication](https://banes-lab.com/records/architecture/authentication.md) and before [Access Control](https://banes-lab.com/records/architecture/access-control.md).

## Repair

- Refactored by: Add Policy Check, Centralize Authorization
- Detected by: protected operation without authz guard
- Violated by: missing permission check
- Measured by: authorization coverage
- Enforced by: security tests, [policy-as-code](https://banes-lab.com/records/architecture/policy-as-code.md)

## Requires

- [Authenticated Principal](https://banes-lab.com/records/lexicon/authenticated-principal.md)
- [Policy](https://banes-lab.com/records/lexicon/policy.md)

## Reinforces

- [Least Privilege](https://banes-lab.com/records/architecture/least-privilege.md)

## Enables

- [Controlled Access](https://banes-lab.com/records/lexicon/controlled-access.md)

## Conflicts with

- [Authenticated-Equals-Authorized](https://banes-lab.com/records/lexicon/authenticated-equals-authorized.md)
- [Authorization Scattering](https://banes-lab.com/records/architecture/authorization-scattering.md)

## In tension with

- [Policy Complexity](https://banes-lab.com/records/lexicon/policy-complexity.md)

## Tensions

- [Authorization / Policy Complexity](https://banes-lab.com/records/tension/authorization-policy-complexity.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Enabled by

- [Proxy Pattern](https://banes-lab.com/records/architecture/proxy-pattern.md)

## Linked from

- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Structural Patterns](https://banes-lab.com/ontology/principles/architecture-category-structural-patterns.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Core Vocabulary](https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md)
- [Quality Attributes](https://banes-lab.com/ontology/lexicon/lexicon-category-quality-attributes.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)