Authorization / Policy Complexity
Kind: tension
Record: tension:authorization-policy-complexity
Canonical: Schema
"authorization" (security-core layer) is traded against "Policy Complexity" (security-core layer) — a principle cannot be scope-separated from a quality, metric, or cost it competes with; resolve by measuring "Policy Complexity" and choosing an explicit operating point.
Listed in Tensions, after Authentication / User Experience and before Access Control / Usability.