new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Three levels of authorization policy ownership

Authorization policies can be owned at three levels: Microservice Team (policies authored and maintained by the service team, focused on local enforcement logic); Domain Level (policies shared across services within a business domain, requiring coordination between teams); and Central/Organization Level (policies governed by a central security, compliance, or platform team, applying across domains or services). Policy ownership defines governance boundaries and determines who may create, modify, review, and deploy policies.

Policy change latency definition and distinction from frequency

Policy change latency describes how quickly a change must be reflected in the system once introduced and is distinct from policy change frequency (how often policies are updated) and input data freshness (how quickly attribute updates must be reflected). Latency defines how fast policies must be deployed and propagated across services to take effect. The three latency levels are: Immediate (seconds to minutes), Fast (hours to days), and Delayed (weeks or more).

Out-of-Band Delivered Policies strategy

Out-of-Band Delivered Policies are proactively pushed from the Policy Administration Point (PAP) to the Policy Decision Point (PDP) and stored locally for evaluation. This strategy enables dynamic policy updates without PDP redeployment, supporting high availability and enables low deployment overhead. However, it requires robust synchronization mechanisms to deploy correct policy versions to each PDP instance and demands governance controls to enforce ownership boundaries. This strategy suits immediate to fast change latency requirements.

Embedded Policies strategy

Embedded Policies are embedded directly within the PDP (as code or static configuration) and cannot be updated without restarting or redeploying the PDP. This strategy prioritizes stability and operational simplicity over agility. It simplifies policy management as policies are bundled with the PDP with no external synchronization needed, but increases deployment overhead (rebuild/redeploy per change), limits scalability for frequent policy adjustments, and introduces governance challenges since the team deploying the PDP effectively decides which policies get activated. This strategy suits delayed change latency requirements.

Authorization policy ownership and distribution security risks

Policy ownership and distribution directly affect authorization system security. Out-of-Band Delivered Policies can allow teams to deploy policies beyond their ownership scope, effectively overriding organizational or domain-level rules; distribution pipelines must enforce strict ownership boundaries and include policy review steps. Embedded Policies have more subtle governance gaps: the team performing deployment determines what gets activated regardless of who authored the policy, increasing risk in multi-team environments. In both strategies, policy changes should be subject to the same review and audit processes as application code changes.

Recommended authorization distribution strategy by ownership level

Microservice Team-owned policies with immediate to fast change latency should use Out-of-Band Delivered distribution strategy. Domain Level policies with fast change latency should use Out-of-Band Delivered distribution strategy. Central/Organization policies with delayed change latency should use Embedded distribution strategy.

Operational comparison of authorization policy distribution strategies

Out-of-Band Delivered policies suit immediate and fast latency, require low deployment overhead (no redeployment), require a sync mechanism, have medium governance complexity with ownership boundaries enforced at distribution layer, and provide high scalability for frequent changes. Embedded policies suit delayed latency, require high deployment overhead (rebuild/redeploy per change), do not require a sync mechanism, have medium governance complexity with deploying team controlling policy activation, and provide low scalability for frequent changes.

Give your agent this brain