Authorization from request to enforcement
Model the subject, resource, action, context, policy, decision, enforcement, and application authorization chain.
Topic index
Authorization and Policy
Learn how policy decides who can do what, under which conditions, and for how long.
Topic index
Understand this domain
Pomerium coverage
Pomerium route and inherited policy can use identity-provider claims, device identity, request facts, and external records. Pomerium Policy Language defines reusable criteria. The Proxy and Authorization services enforce the route decision before approved traffic reaches the upstream.
Limits
- A correct policy at the gateway does not replace authorization inside the application.
- Frequent evaluation cannot correct false identity data or stale context.
- A later denial cannot undo an action that already completed.
Primary sources
2 learning paths
Paths for this topic
Build secure software and web applications
Move from security requirements through safe implementation, browser boundaries, authorization tests, and vulnerability response.
21 related guides
Guides in this topic
Build an access audit trail
Join authentication, authorization, proxy, and application evidence without confusing one event for another.
Choose DAC, MAC, RBAC, or ABAC
Compare owner-controlled, centrally mandated, role-based, and attribute-based authorization for one resource.
Choose where authorization decisions and enforcement run
Compare central and local authorization while preserving complete enforcement, current context, and safe failure behavior.
Delegate authority without losing identity
Preserve subject, actor, audience, action, and authority limits when a service or agent acts for another principal.
Design human approval for agent actions
Present the real target, arguments, authority, effect, and uncertainty so human approval gates a concrete agent action.
Design identity-aware API access
Protect API inventory, clients, routes, versions, objects, actions, credentials, quotas, and evidence with explicit owners.
Design Information Flow Controls
Define labels, allowed flows, trusted transformations, release policy, evidence, and residual channels across an application and its data systems.
Do not treat a scope as a resource permission
Separate OAuth scopes, roles, entitlements, consent, and application permissions before a resource server authorizes an action.
Govern the access policy lifecycle
Assign owners and review, approve, deploy, observe, expire, and retire access policy with evidence and rollback.
Model and Verify a Security Invariant
Turn one access protection need into a precise state model, analyze adverse transitions, and connect the result to deployed evidence.
Operate access configuration as code
Review, test, deploy, attest, observe, and reconcile access configuration without allowing hidden runtime drift.
Operate temporary and break-glass access
Grant short-lived and emergency authority with explicit scope, expiry, approval, monitoring, revocation, and review.
Operate the authorization policy lifecycle
Move access policy from protection need through review, testing, staged deployment, observation, rollback, and retirement.
Place the components of a policy system
Place policy administration, information, decision, enforcement, distribution, and evidence components in one access system.
Separate three different access decisions
Trace authentication, gateway route authorization, and application permission as separate decisions with separate evidence.
Test application authorization
Verify object, property, action, workflow, tenant, and administrative authorization with a systematic identity and state matrix.
Test authorization policy as a decision system
Build deterministic authorization tests for allow, deny, boundaries, conflicts, failures, stale context, and bypass paths.
Threat-model an identity-aware access path
Trace one protected request, find trust boundaries and bypass paths, and test which access decisions belong at the gateway and application.
Trace Kubernetes control-plane access
Trace Kubernetes API transport, authentication, authorization, admission, persistence, and audit for human and workload requests.
Trace the human-agent-tool identity chain
Trace one agent action from human intent through agent, client, server, tool, credential, target resource, and evidence.
Turn protection needs into access requirements
Derive testable security objectives, requirements, invariants, controls, and evidence for one protected action.
50 related terms
Concepts in this topic
Access Control
Combine policy, reliable decision inputs, enforcement, and evidence to control actions on protected resources.
Agentic Access Management (AAM)
Agentic Access Management controls agent actions with originating identity, explicit delegation, per-request policy, enforcement, and audit evidence.
Attribute-Based Access Control (ABAC)
Evaluate subject, resource, action, and environment attributes with explicit provenance, freshness, and policy behavior.
Authorization
Authorization determines whether a subject can perform a requested operation on a resource. It evaluates policy after or alongside authentication.
Authorization Consent
Use consent to record a user's informed grant without treating it as proof that an action is safe or permitted.
Authorization Decision Log
Record enough structured evidence to explain and test an access decision without storing credentials or excess personal data.
Authorization Drift
Authorization drift is the gap that develops when effective access no longer matches intended access.
Authorization Request
Model each decision with a subject, resource, action, context, policy, and evidence instead of a user role alone.
Capability-Based Security
A capability is an unforgeable reference that carries authority to perform defined operations on a resource.
Complete Mediation
Check every relevant access and prevent alternate paths or stale decisions from bypassing current policy.
Confused Deputy
Prevent a service or agent from using its own authority for a caller that did not have permission to request the action.
Continuous Verification
Continuous verification means that a system continues to evaluate authorization during a session instead of treating the initial login as permanent trust.
Default-Deny Authorization
Deny unmatched and indeterminate requests, then add explicit narrow grants with tested conflict and failure behavior.
Delegation
Delegation gives an actor limited authority to act for another principal, called the subject.
Delegation Chain
Preserve the human actor, agent, service, tool, target, authority, and constraints through every delegated access step.
Device Posture
Device posture is the current security state of a device.
Distributed Security State
Control policy, identity, revocation, key, context, and quota state across replicas with explicit freshness and failure semantics.
Explicit Delegation
Explicit delegation records a deliberate grant from a subject to an actor with a named audience, actions, lifetime, and authorization evidence.
Fail-Safe Defaults
Start from explicit denial and define safe behavior for missing policy, invalid input, dependency failure, and recovery.
Information Flow Control
Control where information may move after access by tracking source, destination, transformation, label, release, and declassification.
Kubernetes RBAC
Grant Kubernetes API verbs on exact resources and namespaces without broad roles, aggregation, bind, or escalation paths.
MCP Authorization
Learn how MCP authorization uses OAuth metadata, resource indicators, token audience checks, route policy, and tool authorization.
MCP Security
Model Context Protocol security is the set of controls that protects hosts, clients, servers, tools, authorization flows, and downstream resources.
Multilevel Security
Enforce mandatory policy when one system processes information and users at different sensitivity and clearance levels.
OAuth 2.0
Learn how OAuth 2.0 separates clients, authorization servers, resource servers, scopes, tokens, PKCE, and current OAuth 2.1 guidance.
OAuth Resource Indicator
An OAuth resource indicator identifies the protected resource for which a client requests an access token.
Object and Action Authorization
Authorize every application action against the exact object instead of trusting route access, a role, or an object ID.
Per-Request Authorization
Per-request authorization evaluates each action against current identity, resource, policy, and request context immediately before enforcement.
Policy
In access control, a policy is a machine-enforceable set of rules that decides whether a subject can perform an action on a resource under stated conditions.
Policy Administration Point (PAP)
In an XACML-style access control system, the Policy Administration Point creates and manages policy. It does not supply live request context to the PDP.
Policy as Code
Treat access policy as a versioned, reviewed, tested, and observable decision artifact with controlled deployment.
Policy Combining and Conflict
Policy combining defines how allow, deny, not-applicable, indeterminate, inherited, and local results become one decision.
Policy Decision Point (PDP)
A Policy Decision Point evaluates the applicable policies and request attributes and returns an authorization decision. It can be centralized or distributed.
Policy Enforcement Point (PEP)
A Policy Enforcement Point guards a resource and enforces the decision returned by a PDP. It permits, denies, or ends access at the enforcement location.
Principle of Least Privilege
Limit authority by resource, action, context, and time, then remove access when the assigned function ends.
Privileged Access Management (PAM)
PAM is the set of controls used to protect, monitor, and audit privileged accounts and privileged sessions.
Prompt Injection
Learn how direct and indirect prompt injection can drive unsafe agent actions, and how least privilege and authorization reduce impact.
Reference Monitor
Evaluate an access-control mechanism for complete mediation, tamper resistance, and evidence-based assurance.
Relationship-Based Access Control (ReBAC)
Derive permission from typed relationships between subjects, groups, resources, and organizations in an authorization graph.
Role-Based Access Control (RBAC)
Assign permissions to reviewed job or system roles, then assign subjects to roles with constraints and lifecycle controls.
Security Policy and Mechanism
Separate the rule that states allowed behavior from the components that decide, enforce, and record it.
Security Time and Freshness
Use clocks, expiries, nonces, sequence, versions, and replay state without treating wall time as a complete ordering or trust source.
Separation of Duties
Split incompatible authority across independent people or roles so one actor cannot complete a sensitive process alone.
Separation of Privilege
Require independent conditions, authorities, or actors before the system permits a sensitive action.
Stale Authorization Context
Find authorization decisions that outlive the identity, relationship, policy, resource state, or request they evaluated.
Token Exchange
Exchange an incoming security token for narrow target authority while preserving subject, actor, audience, and delegation semantics.
Token Issuer and Audience
Accept a token only from a trusted issuer and only at the resource audience for which the token was issued.
Tool Misuse
Stop an agent from using a legitimate tool with harmful targets, arguments, sequences, volume, or delegated authority.
Workload Identity
Learn how workload, machine, service, and non-human identities differ from user identity, and how to scope machine-to-machine access.
Zero Trust Trust Algorithm
A zero trust trust algorithm combines subject, resource, action, context, policy, and confidence into an access decision.
