Auth & Security
Authorization
Overview
Authorization defines which operations an authenticated identity may perform on which resources. Review the actual role and permission model available in your service and deployment.
Design access around required tasks: maintaining specifications, running tests, reviewing evidence, approving changes, administering identities, and managing integrations can require different authority.
Prerequisites
- An access matrix approved by the application and security owners.
- Representative test identities and resources in an authorized nonproduction environment.
Step-by-step procedure
Map tasks to permissions
Identify the minimum access required for each role and automation. Review sensitive operations such as credential changes, evidence export, approval policy changes, and production writes separately.
Test permitted and denied operations
For each representative role, verify a required operation succeeds and an out-of-scope operation is denied through the supported interface. Hiding a button is not sufficient evidence of an authorization boundary.
Review changes and inherited access
Check how team membership, role changes, and integration credentials affect effective permissions. Reassess access when responsibilities change and preserve the review evidence.
Key concepts
- Least privilege
- Giving an identity only the authority required for its approved tasks.
- Separation of duties
- Allocating sensitive steps to different authorized parties when required by risk or policy.
Best practices
- Review service identities independently of human user roles.
- Do not grant broad administrator permissions as a default troubleshooting method.
- Record the owner, purpose, and review date of exceptional access.
Was this page helpful?