Authorization

Overview

Authorization evaluates policies after or alongside authentication to decide what a person, service, key, or contract may do. Decisions can depend on role, ownership, attributes, transaction value, device, time, jurisdiction, approval state, and other contextual conditions.

Failures include missing checks, excessive privileges, inconsistent policy enforcement, insecure defaults, and trusting client-side restrictions. Authorization must protect objects, fields, functions, and workflow transitions because access to an endpoint does not imply permission for every underlying operation.

Good systems deny by default, apply least privilege, centralize policy where practical, and log sensitive decisions. Permission changes and emergency overrides need strong governance, while tests should cover both horizontal and vertical privilege escalation.

Authorization decides whether an authenticated or otherwise identified actor may perform a specific action on a resource under current policy.

Authorization is the decision process that determines whether an identified requester may perform a specific action on a particular resource. Authorization decides whether this requester may perform this exact action now, and it must be enforced consistently for every protected resource.

For Authorization, the trust decision should establish the decision process that determines whether an identified requester may perform a specific action on a particular resource and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for permissions and protected actions, rather than checking only a successful request. Logs concerning the permission decision and permissions and protected actions should support investigation without exposing reusable secrets or unnecessary personal data.

Review of Authorization should compare permitted and rejected actions related to permissions and protected actions, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.