Library
Notes on authorization, zero trust, and agent security
General-purpose reference material on the problem space Vallum operates in. These pages describe industry concepts and terminology, not Vallum's internal implementation.
Essays
Foundations and Principles
The core distinctions and design principles everything else in this library builds on.
- Authorization models
Deterministic vs. Probabilistic Authorization
Why some authorization decisions must be reproducible from their inputs, and why probabilistic judgment is the wrong tool for that job.
- Fundamentals
Authorization vs. Authentication
Authentication answers who is asking. Authorization answers what they are allowed to do. Conflating the two is a common and costly design mistake.
- Architecture
Zero-Trust Architecture Fundamentals
The core assumptions behind zero-trust design, and what changes in practice when a network perimeter is no longer treated as a trust boundary.
- Design principles
Fail-Closed vs. Fail-Open Design
When a system cannot determine whether an action should be allowed, does it stop, or does it proceed? The answer is a deliberate design choice, not a default.
- Practice
Policy as Code
Writing authorization rules in a form that can be versioned, tested, and reviewed like any other software artifact, instead of living in tribal knowledge or scattered configuration.
- Design principles
Explicit Deny vs. Implicit Deny
Default deny and default allow look similar until a rule-writer misses a case. Then the difference between the two postures is the whole story.
- Concept
The Principle of Complete Mediation
A system that checks access most of the time, with a shortcut here and there for convenience or performance, is a system with a hole precisely where the shortcut is.
- Concept
Defense in Depth in Authorization Design
Betting everything on one excellent control means that control's failure is total. Layering several imperfect ones means no single failure is.
- Concept
The Principle of Economy of Mechanism
A simple system can be fully reasoned about. A complex one accumulates corners nobody has actually verified — and complexity itself, not any specific flaw, is where those corners tend to hide.
- Concept
The Economics of Attacker Effort
Very few security controls actually make an attack impossible. Most raise the cost of succeeding — and that's a meaningfully different, more honest thing to claim.
- Concept
The Principle of Fail-Safe Defaults
A new resource that's open by default until someone remembers to restrict it is a resource that's open for however long that remembering takes — sometimes indefinitely.
- Concept
The Principle of Open Design
A design that only holds up because nobody's looked at it closely hasn't actually been shown to be secure — it's been shown to be unexamined, which is a different and much weaker claim.
- Concept
The Principle of Least Common Mechanism
Two users whose individual access is each configured correctly can still affect each other through whatever they both happen to share — the shared mechanism itself is the overlooked risk.
- Concept
Risk Scoring and Authorization Decisions
A computed estimate of how suspicious a request looks is a useful input to an authorization decision. Letting it quietly become the decision itself replaces a rule with a guess at exactly the point that rule was supposed to matter.
- Concept
The Role of Nonces in Preventing Replay Attacks
A captured request doesn't need to be understood or forged to be dangerous — an exact copy, resubmitted later, can repeat its effect just as well as the original did.
- Concept
The Principle of Psychological Acceptability
A security mechanism people find too burdensome doesn't stay effective — it gets routed around, which makes its actual, real-world protection close to nothing, however sound it was on paper.
- Practice
Canonicalization and Authorization Bypass
A security check that correctly rejects one written form of a malicious request can be completely defeated by a differently-encoded version of the exact same request that the check simply doesn't recognize as equivalent.
- Concept
The Principle of Least Astonishment in Authorization Design
A permission that's technically correct but wider than the requester thought they were asking for is still a defect — the surprise itself is the problem, independent of whether the outcome happens to be safe.
- Concept
The Principle of Separation of Privilege
Split knowledge and dual control look like two unrelated practices until you notice they're both answering the exact same underlying question the same way: what happens if the one condition standing between an attacker and access turns out not to be enough.
- Concept
Trust on First Use as a Security Pattern
Accepting a credential's claim the first time it's seen, with nothing to check it against, is a deliberate bet — that the moment of first contact carries low enough risk to accept, in exchange for not building independent verification for every device a system will ever meet.
- Concept
The Role of Escrow in Conditional Access Arrangements
Escrow resolves mutual distrust structurally, by placing something neither party controls in the hands of someone genuinely neutral — but the whole arrangement only works if the condition for release is precise enough that the neutral holder never has to make a judgment call.
Identity, Credentials, and Authentication
Proving who or what is making a request, and managing the credentials that proof depends on.
- Fundamentals
Identity for Machines and Agents
A verifiable identity for a non-human principal has to be more than a shared secret. What actually makes machine and agent identity trustworthy.
- Practice
Credential Lifecycle Management
Issuance, rotation, and retirement as one designed process — not a one-time setup step that nobody revisits until something breaks.
- Fundamentals
Multi-Factor and Step-Up Authentication
Why the strength of identity verification should scale with the stakes of the action, rather than staying fixed at whatever level a session started with.
- Practice
Session Management and Token Lifetimes
A session token that lives too long is nearly as sensitive as the credential it replaced. How lifetime choices shape a system's actual exposure.
- Concept
Federated Identity and Single Sign-On
Letting one identity provider vouch for a user across many applications simplifies login, but it also means every downstream application inherits that provider's decision without re-checking it.
- Concept
Token Binding and Proof of Possession
A bearer token authorizes whoever holds it, no questions asked — which means a copied token is just as good to an attacker as the original. Binding a token to its holder closes that gap.
- Concept
OAuth 2.0 and Delegated Authorization
Letting an application act on a user's behalf without handing over the user's actual password solves a real problem — and creates a new one in how carefully that delegated access gets scoped.
- Concept
Consent and Scoped Permission Grants
Asking permission only means something if the person asked can see specifically what's being requested, and can grant part of it while declining the rest.
- Concept
Device Posture and Conditional Access
Two requests with identical, valid credentials aren't necessarily equally trustworthy if one comes from a patched, managed laptop and the other from a device nobody can vouch for.
- Concept
Passwordless Authentication and Passkeys
A password is a shared secret that has to be stored, transmitted, and remembered correctly by both sides. Removing it removes an entire category of failure, not just an inconvenience.
- Concept
Credential Stuffing and Account Takeover
An attacker doesn't need to break a system's defenses if the system's own users hand over working credentials by reusing them somewhere else that already got breached.
- Concept
Identity Proofing and Verification
Authenticating someone correctly, forever, doesn't help if the identity behind the account was never actually verified to begin with.
- Concept
Assurance Levels and Authentication Strength
Treating every successful login as equally trustworthy ignores a real difference: some authentication methods provide far more confidence than others that the person really is who they claim to be.
- Concept
Session Fixation and Hijacking
A session token stands in for a user's identity after login. Two different attacks target that substitution from opposite directions — one before authentication, one after.
- Concept
The Bootstrap Problem in New Systems
Every authorization system has exactly one moment that can't be authorized by anything, because nothing exists yet to do the authorizing — and that moment deserves attention the moments after it don't need.
- Concept
The Role of Time Synchronization in Authorization
A background service most engineers never think about — keeping two clocks roughly aligned — turns out to be a load-bearing dependency for anything that authorizes based on when a token expires.
- Practice
Preventing Enumeration Through Authorization Responses
The specific wording of a rejection can leak exactly as much information as the access decision it accompanies — and a system focused only on getting the decision right often ignores what the response reveals.
- Practice
Default Credentials and Initial Device Setup
A preset password meant only to get a device through its first boot is, in practice, often the only password it ever has — and the same one, known once, unlocks every other device that shipped with it.
- Practice
Authorization for Third-Party Identity Verification Services
Outsourcing identity proofing to a specialized provider is often the right call — and it doesn't outsource the accountability for what happens when that provider's process has a gap.
- Concept
Negative Consent and Opt-Out Defaults
Whether a new feature starts enrolled for everyone until someone leaves, or excluded for everyone until someone joins, isn't a minor implementation detail — it's a bet on what inertia will do at scale.
- Practice
Authorization for Cross-App Single Sign-Out
A user who logs out believing they've ended their session everywhere may, in every application except the one they clicked logout in, still have a fully live one — because propagating a logout is a harder problem than propagating a login ever was.
- Practice
Authorization for Account Recovery Flows
A recovery flow exists specifically to work around an account's normal, strong authentication — which means an account is only ever as strong as its recovery path, no matter how rigorous the primary login is.
- Concept
Consent Receipts and Verifiable Consent Records
A database flag saying consent was given proves nothing on its own if that same record could, in principle, have been set incorrectly or altered afterward — resolving a dispute needs more than the system's own say-so.
- Practice
Derived Credentials on Mobile Devices
Copying a strong, hardware-backed credential onto a phone so it can be used on the go turns the phone into an equally sensitive target. A derived credential gets the convenience without that trade.
- Practice
Graceful Degradation When an Identity Provider Is Down
Federating authentication out to a shared identity provider means every relying application inherits that provider's outages too — what each application does during one is a design decision, not an accident.
- Concept
The Role of Request Signing in Verifying Caller Identity
A bearer token proves the presenter holds a valid credential. It says nothing about whether the specific request it's attached to was altered somewhere between being sent and being received — signing the request itself closes that gap.
- Concept
Authorization for Biometric Authentication
A biometric characteristic can't be reissued the way a compromised password can — which makes how the underlying data is stored, and whether a live person is actually present, considerably more consequential than for any other factor.
- Practice
Same-Site Cookies and Session Scoping
A malicious page doesn't need to steal a session cookie to abuse it — it only needs the victim's browser to attach that cookie to a request the malicious page itself triggers.
- Practice
The Role of Device Binding in Preventing Credential Reuse
Stealing a credential and being able to use it are different problems for an attacker — device binding is specifically about making the second one hard, even after the first one has already succeeded.
- Concept
The Role of Password Managers and Credential Autofill Trust
A password manager that autofills loosely — by visual similarity rather than verified origin — can be tricked into handing a stored credential straight to a convincing phishing page, defeating the exact problem it was adopted to solve.
- Concept
The Role of Identity Reconciliation During System Mergers
Combining two systems can silently merge two different people into one identity, handing them each other's access — or leave one person's identity permanently duplicated, with stale access nobody remembers to clean up. Both failures look identical to the migration tooling that caused them.
- Concept
The Role of Progressive Trust in Collaborative Platforms
At the exact moment someone signs up, a platform genuinely knows nothing about them beyond the fact that an account was just created — which makes granting broad capability immediately a bet with no real information behind it.
- Concept
The Role of Continuous Authentication During a Session
A hijacked session passes the original login check perfectly well, because that check already happened before the takeover — the login-time model has nothing left to say about anything that happens afterward.
Data, Access Models, and Boundaries
Deciding what a principal may reach, at what granularity, and how that boundary is actually drawn.
- Fundamentals
Data Classification and Access Control
Not all data deserves the same protection. Without an explicit classification, access control ends up either too loose for the sensitive data or too strict for everything else.
- Authorization models
Attribute-Based vs. Role-Based Access Control
Roles are simple to reason about and awkward to keep accurate. Attributes are flexible and harder to audit at a glance. Neither model is right for every system.
- Concept
Capability-Based Security
Naming who someone is and then checking a rulebook is one way to authorize an action. Handing out an unforgeable token that already means 'you may do exactly this' is another, with different failure modes.
- Concept
The Confused Deputy Problem
A component with more authority than the request it's acting on can be tricked into using that extra authority on the requester's behalf — a classic failure mode that's easy to reintroduce even after it's named.
- Concept
Multi-Tenancy and Tenant Isolation
Sharing infrastructure between customers is what makes multi-tenant systems affordable to run — and it's exactly what makes a single authorization mistake capable of crossing from one customer's data into another's.
- Concept
Data Minimization in Access Design
Every field a system collects is something an authorization decision eventually has to be made about. Collecting less isn't just a privacy preference — it shrinks the surface access control has to cover.
- Practice
Authorization for Object and File Storage
A storage bucket is a flat, simple abstraction that hides an unusually easy way to get access control wrong — a single misconfigured default can expose everything in it at once.
- Practice
Authorization for GraphQL and Flexible Query APIs
An API that lets a single request ask for any combination of fields makes endpoint-level authorization insufficient — the permission question has to be answered per field, not per request.
- Practice
Authorization for Search and Indexed Content
A search index is a separate copy of data, and separate copies don't automatically inherit changes to the original — including changes to who's allowed to see it.
- Concept
Data Residency and Cross-Border Access
An otherwise fully authorized request can still need to be denied or rerouted purely because of where the data lives, or where the request is coming from — a dimension identity and role alone don't capture.
- Practice
Authorization for Bulk Export and Data Portability
Being authorized to read each individual record doesn't automatically mean an export of all of them at once should be treated the same way — bulk actions concentrate risk that scattered individual reads don't.
- Practice
Authorization for In-App Entitlements
A purchase happens once. What it unlocks has to be checked every time it's used — treating the original transaction as a permanent, self-enforcing grant is where this quietly goes wrong.
- Practice
Authorization for Data Deletion Requests
A wrongly authorized read is usually recoverable after the fact. A wrongly authorized deletion typically isn't — which is exactly why verifying who's asking deserves more scrutiny here than for an ordinary request.
- Practice
Authorization for Link-Based Sharing
A link that grants access to whoever holds it trades identity verification for convenience — and inherits a specific, durable risk that verified-identity access control doesn't have to worry about at all.
- Concept
Authorization for Data Anonymization and Pseudonymization
A dataset can satisfy every anonymization requirement checked in isolation and still be re-identifiable once combined with something else entirely — which means treating anonymization as a permanent, one-time property is a mistake.
- Concept
The Role of Tokenization in Reducing Sensitive Data Exposure
Rather than protecting a sensitive value everywhere it might conceivably be handled, tokenization concentrates that protection requirement onto one narrow, specifically hardened component — and lets everything else handle something worthless to steal.
- Concept
Authorization and Data Lineage for Derived Data
A report computed from sensitive records doesn't automatically inherit their sensitivity, and it doesn't automatically escape it either — telling the two cases apart requires actually knowing what produced the report, not just what it looks like.
- Concept
Aggregate Disclosure Limits and Statistical Anonymity
No single record needs to be exposed for an individual to still be identifiable — a dataset can pass every check applied to it record by record and still leak an individual's data through the aggregate.
- Concept
Authorization and Multi-Party Computation
When no single party ever sees the raw combined data, deciding who's authorized to see the underlying input stops being the meaningful question — the question shifts entirely to who's authorized to see what the computation produces.
- Concept
Attribute Freshness in ABAC Decisions
An attribute-based policy can be written exactly right and still produce the wrong outcome, if the attribute values it evaluates against haven't caught up with reality yet.
- Practice
Authorization for AI Training Data and Dataset Curation
A dataset sensitive enough to control access to carefully doesn't stop being sensitive once a model has finished training on it — the model itself can carry traces of what it learned from.
- Concept
Zero-Knowledge Proofs and Authorization
The usual pattern collects sensitive data and then trusts the system to guard it responsibly. A zero-knowledge proof asks whether the system needed to collect the data at all, if all it actually needed was one fact about it.
- Concept
Server-Side Request Forgery and the Confused Deputy Problem
A feature that fetches a URL on a caller's behalf is quietly lending out the server's own, broader network reach — and a caller who couldn't reach an internal system directly can often reach it anyway, through the server that can.
- Practice
Authorization for Cross-Organization Shared Workspaces
A shared channel assumes two organizations' offboarding processes stay in sync automatically. In practice, one side leaving rarely, on its own, propagates to remove that person's access on the other side.
- Concept
Authorization for Anonymous One-Person-One-Vote Systems
Most authorization design starts by verifying identity and then checking that identity's permissions. A one-person-one-vote system needs something structurally different: a way to prevent double participation without ever needing to know who actually participated.
Delegation, Automation, and Machine-to-Machine
Authorization for services, jobs, and agents acting without a person driving each step.
- Emerging risk
AI Agent Security and Authorization
Autonomous agents act faster and more broadly than the humans who deploy them. Authorizing what they can do is a different problem than authorizing what a person can do.
- Design principles
The Cost of Standing Access
Broad, long-lived access is the cheapest thing to set up and one of the most expensive things to have granted, once something goes wrong with the identity holding it.
- Design principles
Deciding What Needs to Be Gated at All
Not every operation deserves the same authorization overhead. Drawing the line between routine and consequential is itself a design decision, and an unexamined one usually gets it wrong in a specific direction.
- Architecture
Service-to-Service Authorization
The internal traffic between services is where zero-trust principles are most often skipped, and where a compromise can spread the fastest once they are.
- Fundamentals
Delegation and Impersonation
Two ways for one identity to act on behalf of another — one built to preserve accountability, the other easy to misuse in ways that erase it.
- Practice
Time-Bound and Just-in-Time Access
Access that exists only while it's needed, and disappears automatically when the task is done, closes the specific gap that standing access leaves open.
- Practice
Authorization for Webhooks and Callbacks
A webhook receiver has to authorize an inbound request from a caller it usually can't interactively challenge, which rules out most of the authorization patterns built for user-facing traffic.
- Practice
Authorization for Batch and Scheduled Jobs
A job that runs on a schedule, with no human present to approve anything in the moment, still needs an authorization model — one that doesn't rely on the same assumptions built for a live user session.
- Concept
Distinguishing Humans, Bots, and Agents
A request's authorization can reasonably depend on whether a human is directly driving it, a script is running unattended, or an autonomous agent is acting on loosely specified goals — three different risk profiles behind the same API call.
- Practice
Service Mesh and Policy Enforcement
Enforcing authorization policy inside every individual service's own code means the policy is only as consistent as every team's implementation. A shared infrastructure layer changes where that enforcement actually happens.
- Practice
Authorization in Serverless and Ephemeral Compute
A function that spins up, runs, and disappears in a fraction of a second doesn't have a persistent process to hold a long-lived credential in memory the way a traditional server does.
- Practice
Authorization for Developer and Command-Line Tooling
A credential cached on a developer's laptop so a CLI doesn't have to re-authenticate every command lives on a machine the organization typically has far less visibility into than its own servers.
- Practice
Authorization for Inter-Organization Data Sharing
A data-sharing arrangement between two organizations is a policy agreement first and a technical access grant second — and the two tend to drift apart if nobody keeps them in sync.
- Practice
Authorization for Infrastructure as Code
When infrastructure is defined in versioned configuration rather than changed by hand, the consequential access question shifts from who can touch production to who can merge a change to the definition of it.
- Practice
Authorization for Email and Messaging Delegation
Granting the ability to send a message that appears to come from another identity is a narrow, specific delegation — and one recipients extend unusual trust to, precisely because it looks exactly like the real thing.
- Practice
Impersonation in Customer Support Tooling
Support staff genuinely need to see what a customer sees to help them — the design question is how much of that access to give, how visibly, and for how long.
- Practice
Immutable Infrastructure and Configuration Drift
A system patched directly, over and over, ends up as an undocumented history of individual changes nobody fully remembers making. Replacing rather than modifying removes that history from ever accumulating.
- Practice
Authorization for Multi-Cloud and Hybrid Environments
The same policy intent, expressed separately on several different platforms, tends to end up enforced slightly differently on each — not through anyone's mistake, but because each platform's native controls simply work a little differently.
- Concept
Authorization for Real-Time Collaborative Editing
When two authorized principals modify the same resource at nearly the same moment, the rule that decides whose change wins is quietly making an authorization decision, whether or not anyone designed it to.
- Practice
Authorization for Machine Learning Inference Endpoints
Exposing a model only through a query interface, rather than distributing the model itself, was often assumed to be protective on its own — enough queries can approximate the model's behavior without ever touching its parameters directly.
- Practice
Authorization for Scheduled and Delayed Actions
The authorization checked when an action was scheduled and the authorization actually held when it finally executes are two different moments in time — and a system that only checks the first one is trusting a snapshot that may already be stale.
- Practice
Authorization for Cross-Account Role Assumption in Cloud Platforms
Provisioning a standing credential in every account someone might occasionally need to act in accumulates exactly the kind of long-lived, rarely-reviewed access that's cheapest to set up and most expensive when something goes wrong.
- Practice
Token Exchange and Scoped Credential Derivation
Forwarding one broad credential across every service in a call chain means every hop ends up holding more access than its own specific piece of the work requires. Exchanging it for something narrower at each step changes that.
- Concept
Service Accounts vs. Workload Identity
A static credential provisioned once and left running has to be generated, stored, and eventually rotated by hand. An identity issued fresh by the platform each time removes that entire category of burden.
- Concept
Privilege Bracketing and Minimizing Exposure Windows
Running with elevated privilege for an entire session because one operation somewhere in the middle needs it leaves that elevated privilege standing for far longer than the operation itself ever actually required.
- Practice
Authorization for Code Signing and Release Integrity
A code-signing key that leaks doesn't just expose one release — it lets an attacker produce anything and have it accepted as genuinely coming from the organization, which makes the key itself the highest-value target in the entire pipeline.
- Practice
Authorization for API Gateways as a Policy Chokepoint
Centralizing authentication and policy at a single edge chokepoint stops every service from reimplementing the same checks slightly differently — and turns that one chokepoint's own configuration into the single highest-leverage place a mistake can happen.
- Concept
The Role of Context Propagation Across Service Boundaries
By the second or third hop in a call chain, the request's actual originating caller has usually disappeared from the picture entirely — each service only sees whichever internal service called it directly, which is frequently not the right identity to authorize against.
- Concept
The Role of Out-of-Order Message Processing in Authorization Decisions
An event pipeline that doesn't guarantee ordering can process a revocation after the action it should have prevented — the action was authorized, technically, but only because the events describing what actually happened arrived scrambled.
- Concept
The Role of Domain-Based Message Authentication
Email's underlying protocol never guaranteed that a message's claimed sender was actually who it said it was — which is exactly what made impersonating a trusted domain so easy for so long, and exactly the gap domain authentication was built to close.
Governance, Incident Response, and Resilience
Keeping an authorization system honest over time: review, testing, incident response, and recovery.
- Governance
Human-in-the-Loop Authorization
Which decisions should require a person, and how to route those decisions to a human without either bottlenecking every routine action or rubber-stamping the ones that matter.
- Verification
Audit Trails, Evidence, and Provenance
A log that only the system operator can read and only they can vouch for is not evidence. What separates a genuine audit trail from an activity log.
- Incident response
Revocation and Incident Containment
Detecting a compromise is only useful if the system can act on it fast enough. What makes revocation and containment actually effective under pressure.
- Evaluation
Questions Worth Asking About Any Authorization Architecture
A general checklist for evaluating an authorization system's design — framed as questions to ask, not as a pitch for any particular product.
- Common confusions
Secrets Management Is Not Authorization
Storing a credential safely and deciding who is allowed to use it are different problems. Conflating them leaves a gap exactly where it's least visible.
- Common confusions
Rate Limiting Is Not Authorization
Throttling how often a caller can act and deciding whether a given action is allowed are separate controls, easy to conflate because they can look identical from the outside.
- Verification
Supply Chain Trust and Software Provenance
Most software is built from components nobody on the team wrote. Trusting it means being able to verify where each piece came from, not just that the whole thing runs.
- Practice
Blameless Postmortems and Systemic Fixes
An incident review aimed at finding someone to blame gets a censored account of what happened. One aimed at the system gets the truth, and a fix that actually holds.
- Practice
Threat Modeling for Authorization Systems
Building defenses without first naming the adversary tends to defend against whatever the team happened to think of, which is rarely the same as what actually threatens the system.
- Practice
Break-Glass Procedures
Ordinary access controls are built to slow people down. An emergency needs the opposite — a deliberate, narrow exception that trades routine friction for speed, without leaving the exception permanently open.
- Practice
Policy Versioning and Rollback
Treating authorization rules as living, versioned artifacts — rather than a mutable table edited in place — is what makes it possible to know which policy was in effect for a past decision, and to undo a bad change quickly.
- Practice
Authorization Latency and Caching Tradeoffs
Every authorization check that has to run before an action can proceed adds latency to that action — and caching the result to remove that latency introduces the risk of enforcing a decision after it's gone stale.
- Practice
Red-Teaming Authorization Systems
An authorization system that's never been deliberately attacked by someone trying to break it has only been tested against the cases its own designers thought to check.
- Concept
The Shared Responsibility Model
A managed platform secures the infrastructure it runs on. It does not, and cannot, secure how a customer configures access on top of it — and confusing the two lines is one of the most common causes of avoidable breaches.
- Practice
Authorization Testing and Fuzzing
A test suite that only checks the access patterns its authors thought to write down will pass cleanly right up until someone sends a request nobody anticipated.
- Practice
Policy Drift and Periodic Access Review
A permission granted for a good reason today doesn't audit itself six months from now — access tends to accumulate quietly unless something forces a deliberate look back at what's actually still justified.
- Practice
Third-Party and Vendor Access Management
An external party doing work for an organization often ends up holding real access to its systems — access that isn't covered by the organization's own hiring, training, or offboarding processes.
- Concept
Trust Anchors and Hardware Roots of Trust
Every chain of verification has to start somewhere that isn't itself verified by anything else — and the physical, hardware-backed version of that starting point is harder to compromise than a purely software one.
- Concept
Log Integrity and Tamper Evidence
A log that anyone with write access can silently edit isn't much of a record at all — the party best positioned to want an entry changed is often the same party whose actions it recorded.
- Concept
Single Points of Failure in Authorization Systems
Every authorization system has at least one component whose compromise would matter more than any other's. Naming it deliberately is different from discovering it during an incident.
- Practice
Authorization for Administrative Interfaces
An administrative interface holds more power per action than almost anything else in a system, and it's frequently the least scrutinized surface precisely because its users are trusted staff.
- Practice
Honeytokens and Deception-Based Detection
Most detection signals carry real false-positive noise. A credential with no legitimate use at all is a rare exception — any attempt to use it means something is already wrong.
- Concept
Authorization Versus Content Moderation
Whether an action was permitted and whether the result is appropriate are two different questions, judged at different times, by different logic — and conflating them leaves gaps in both.
- Practice
Key Custody and Split Knowledge
For the handful of secrets whose exposure would matter most, no single person holding the complete secret is itself the vulnerability worth designing around.
- Practice
Progressive Rollout of Policy Changes
A policy change deployed to everyone at once turns any unintended consequence into an incident affecting the whole system simultaneously. Rolling it out gradually turns the same mistake into a contained, correctable one.
- Practice
Out-of-Band Verification for High-Stakes Approvals
Verifying a suspicious request through the same channel it arrived on only confirms that the channel is internally consistent — it says nothing about whether the channel itself has been compromised.
- Concept
Quotas and Resource Consumption Limits
A caller comfortably inside every reasonable rate limit can still exhaust a shared resource through sustained, moderate-paced use — a different failure mode that a frequency-based control was never designed to catch.
- Practice
Approval Chains and Multi-Level Sign-Off
A chain of approvals only provides more scrutiny than a single approval if each link genuinely exercises independent judgment — one that simply defers to whoever went first collapses into one effective check wearing several signatures.
- Practice
The Role of Watermarking in Tracing Leaked Content
Access control decides who receives a copy of something. Watermarking answers a different question, asked only after a leak has already happened: whose copy was it.
- Practice
The Role of Circuit Breakers in Authorization-Dependent Systems
When a policy service starts failing, every caller retrying it immediately makes the failure worse. A circuit breaker's real contribution is buying that dependency room to recover — deciding what happens in the meantime is a separate question.
- Practice
Authorization for Offline and Disconnected Operation
A device that can't reach its policy source at all has no live check to fall back on — every action it takes offline rests on a cached decision that might already be stale, with no way for the device itself to know.
- Practice
Chaos Engineering for Authorization Resilience
A fail-closed design that's never actually been tested by killing the real policy service is a design that's assumed to work, not one that's been shown to. The two are not the same claim.
- Practice
The Role of Idempotency Keys in Safe Request Retries
A client that honestly doesn't know whether its first attempt succeeded has exactly one safe move: retry, and rely on the receiving system to recognize the retry as the same request rather than a new one.
- Practice
The Role of Audit Log Redaction and Selective Disclosure
An audit log built to record everything faithfully becomes, itself, a sensitive document the moment someone outside the organization needs to see part of it — sharing the whole thing trades one problem for another.
- Practice
Authorization for Air-Gapped and Isolated Environments
Almost every assumption a typical authorization architecture makes — push an update, revoke remotely, check a live policy source — depends on a network connection that an air-gapped environment, by design, will never have.
- Practice
Privilege Escalation Detection in Runtime Monitoring
Preventing every possible path to unauthorized privilege is unrealistic across a system of any real size — which makes actually noticing when a principal's effective access changes unexpectedly its own necessary, independent layer of defense.
- Practice
The Role of Blocklists and Negative Reputation Lists
A blocklist isn't a replacement for a system's general access rules — it's a targeted exception layered on top, for the specific bad actors a system has already identified, and it says nothing about anyone it hasn't.
- Practice
The Role of Revocation Checking and Denylist Freshness
A certificate that looks perfectly valid by its own printed expiry date can have already been revoked — whether a verifier actually catches that depends entirely on how it checks, and how recently.
- Practice
Authorization for Third-Party Security Researchers and Bug Bounty Programs
The exact same technical action can be a legitimate, invited security test or an actual attack — the only thing separating them is whether it happened inside a precisely defined, explicitly agreed boundary.
- Concept
Post-Quantum Migration for Authorization Systems
No practical quantum computer exists yet that breaks today's cryptography — but data encrypted today can be captured and stored now, for decryption whenever one eventually does, which makes today's choices consequential for tomorrow's threat.
- Practice
Authorization for Delegated Administration
A permission system that only offers full organization-wide administrator access or none at all forces every delegation to be broader than the task actually needs, purely because there's no narrower option on the menu.
- Practice
Authorization for Cross-Team On-Call and Incident Access
An engineer who took a rotation once, months ago, and never had that access explicitly withdrawn afterward quietly retains standing reach into a system they no longer have any operational reason to touch.
- Concept
The Role of Maintainer Account Security in Open-Source Supply Chains
A package with a modest-looking maintainer count can sit deep in the dependency tree of an enormous number of other projects that never directly chose to trust that specific maintainer at all — and its account is often protected with far less rigor than its actual reach would justify.
- Concept
The Role of Trusted Timestamping in Proving When Something Happened
A tamper-evident log proves a record hasn't been altered since it was made. It says nothing about whether the timestamp on that record, self-reported by whoever created it, was ever honest in the first place.
- Practice
Authorization for Electronic Signatures and Document Signing
A rendered signature on a page can look identical whether it was captured with rigorous identity verification and a tamper-evident record, or with almost none — the evidentiary strength lives entirely underneath what's actually visible.
- Concept
The Role of Hardware Supply Chain Provenance
No amount of software-level verification can meaningfully vouch for hardware that was already compromised before it ever powered on — trust anchors and attestation mechanisms all quietly assume the physical component underneath them is exactly what it claims to be.
Product and Everyday Surfaces
Where authorization shows up in ordinary product experiences, not just backend architecture.
- Concept
CORS and the Limits of Browser Security
A permissive cross-origin policy looks like a security lapse and gets treated like one — but confusing it with actual authorization leaves the real gate unchecked.
- Practice
Authorization for Real-Time and Streaming Connections
A connection authorized once at the start can stay open far longer than the access it was granted for was ever meant to last.
- Concept
API Keys and Their Limits
A static string pasted into a request header is the simplest possible access credential — and simplicity is exactly what makes it a weak choice for anything consequential.
- Practice
Separation of Environments
A test environment that quietly shares credentials, data, or network access with production isn't really a separate environment — it's production with an extra label.
- Practice
Authorization for Notifications and Alerting
A notification is trusted because it looks like it came from a known, legitimate source — which is exactly the property a forged one exploits to get a recipient to act without scrutiny.
- Practice
Authorization for IoT and Embedded Devices
A device too constrained to run the cryptography a server uses routinely, and too physically exposed to trust the way a data-center machine can be trusted, needs its own approach to proving what it is.
- Practice
Authorization for Voice and Conversational Interfaces
A voice is convenient to authenticate with precisely because it requires no hands and no screen — and convenient for exactly the same reason to capture and, increasingly, to convincingly fake.
- Practice
Authorization for Payment and Financial Transactions
Moving money is one of the few actions where a mistake in either direction — too permissive or too restrictive — has an immediate, tangible, and hard-to-reverse cost.
- Practice
Authorization for Shared Devices and Kiosk Mode
Most access control assumes a device belongs, at least for the session, to one identifiable person. A shared kiosk breaks that assumption on purpose, and the device itself has to carry restrictions that would otherwise live with the account.
- Practice
Authorization for Plugins and Third-Party Extensions
A plugin system built purely for functional extensibility tends to grant, by default, far more access than most individual plugins actually need — because nobody had to decide otherwise.
- Practice
Authorization for Cross-Device and Continuity Flows
Letting a user pick up an authenticated session on a second device without logging in again is a real convenience — and the mechanism that makes it possible is itself something an attacker could try to intercept.
- Practice
Authorization for Guest and Anonymous Access
Allowing an action without requiring any identity at all is a deliberate, scoped decision when done well — and a quietly expanding gap when it's treated as an oversight nobody revisits.
- Concept
Authorization for Consent to Record and Capture
Deciding who may later access a recording and deciding whether the recording should have been made at all are two different questions, checked at two different moments — getting the first one right doesn't retroactively fix the second.
- Practice
Authorization for Shared Family and Household Accounts
A household account sits in an authorization middle ground most designs don't have a ready template for: members trusted enough to share a resource, but not necessarily trusted equally with every capability it offers.
- Concept
Authorization for Physical and Print Output
Data doesn't stop being sensitive the moment it leaves a screen — a printed page carries the exact same information, through a channel most digital access-control systems have no visibility into at all.
- Practice
Authorization for Browser Extension Permissions
A single bundled prompt at install time asks a user to approve everything an extension might ever need, before they have any concrete sense of what it actually does with any of it.
- Practice
Authorization for Recurring Subscriptions and Auto-Renewal
A single approval given once at signup ends up authorizing every future charge indefinitely — a durable grant that's easy to give without fully registering just how durable it actually is.
- Practice
Authorization for Shared Calendars and Scheduling Systems
Finding a mutually available time and seeing the actual substance of everything on someone's calendar are very different levels of access — and a system offering only 'all' or 'nothing' forces a choice between scheduling friction and unnecessary over-exposure.
- Practice
Authorization for Emergency Broadcast and Mass Notification
The permission to message an entire user base at once is exercised rarely enough that the access controlling it can quietly go unreviewed — and consequential enough that a misuse reaches everyone, all at once, with no way to take it back.
- Practice
Authorization for Code Execution in Notebooks and Sandboxes
An interactive notebook session that runs arbitrary code against real systems, for hours at a time, doesn't fit the shape most authorization models are actually built for — a single, narrowly scoped request.
- Practice
Authorization for Shared Vehicles and Fleet Access
A fleet-management system's most consequential single capability isn't granting access to a vehicle — it's the ability to remotely disable one someone is actively depending on, which is a physical, not just digital, consequence.
- Practice
Authorization for Building Access and Badge Systems
A badge reader that checks a locally cached list, rather than calling home on every single use, has to keep working when the network doesn't — which means every badge system inherits the same freshness-versus-availability tradeoff that shows up everywhere else authorization caching does.
- Concept
The Role of Device Pairing in Establishing Initial Trust
Everything two paired devices exchange afterward relies on that first, brief, easy-to-overlook ceremony — a weak or bypassable one undermines every later exchange, however well-secured those exchanges are on their own.
- Practice
Authorization for Video Conference and Meeting Admission
Holding a valid meeting link proves someone knows the link. It doesn't prove the host actually wants them in this particular meeting — and a link, once shared, is far easier to forward than most hosts ever intend.
- Practice
Authorization for Location Permissions and Background Access
Someone comfortable sharing their location with a mapping app while actively using it may feel very differently about that same app quietly tracking them at every other moment of the day too — which is exactly why the two deserve separate, explicit permissions.
- Practice
Authorization for Shared Wi-Fi and Guest Network Isolation
A guest network that lets a visitor's device reach the internet but also happens to let it see every other device on the same network hasn't actually isolated anyone from anything — it's added a login page in front of a network that was never actually segmented.