authorisation-pattern

name	authorisation-pattern
description	Security pattern for implementing access control and authorization. Use when designing permission systems, implementing RBAC/ABAC, preventing unauthorized access, addressing privilege escalation, or ensuring users can only perform allowed actions on permitted resources. Addresses "Entity performs disallowed action" problem.

Authorisation Security Pattern

Ensures entities can only perform actions they are permitted to perform on resources they are permitted to access. Prevents privilege escalation and unauthorized access.

Problem Addressed

Entity performs disallowed action: An unprivileged user performs actions reserved for administrators, accesses other users' data, or manipulates resources beyond their permissions.

Examples:

• User changes another customer's account details
• Unprivileged entity performs admin operations
• Attacker accesses internal documents by guessing identifiers

Core Components

Role	Type	Responsibility
Subject	Entity	Requests actions on resources
System	Entity	Manages protected resources
Enforcer	Enforcement Point	Intercepts requests, enforces decisions
Decider	Decision Point	Makes allow/deny decisions
Policy Provider	Information Point	Manages access control rules

Data Elements

• action: Operation Subject wants to perform
• principal: Authenticated identity of Subject