Authorization

Formally, an authorization decision is a function of subject, action, resource and context that returns permit or deny, sometimes with obligations such as "log this" or "mask these fields". How that function is expressed defines the model: access control lists attached to resources, roles in RBAC, attribute rules in ABAC (NIST SP 800-162), or relationship tuples in ReBAC. Google's Zanzibar paper (USENIX ATC 2019) stores tuples of the form object#relation@user and evaluates permissions by walking that graph; it introduced consistency tokens ("zookies") to avoid the "new enemy" problem, where a check runs against a snapshot older than a just-made revocation. Policy languages include OASIS XACML 3.0, Open Policy Agent's Rego and Cedar.

Decisions are usually layered. Coarse checks at an API gateway or middleware look at the route and the token's scopes; fine-grained checks inside the service look at the specific object and its owner or tenant. OAuth scopes limit what a client has been delegated, not what the user is allowed to do, so the effective right is the intersection of both. Claims baked into a JWT at issuance stay valid until expiry even if the user's rights are revoked, which is why sensitive systems combine short token lifetimes with token introspection (RFC 7662) or a live policy lookup, and use token exchange (RFC 8693) instead of forwarding a broad token to downstream services.

The dominant failure mode is a missing object-level check. OWASP API Security Top 10 2023 ranks Broken Object Level Authorization as API1, Broken Object Property Level Authorization (including mass assignment) as API3 and Broken Function Level Authorization as API5; for web applications, Broken Access Control is A01 in OWASP Top 10:2021 and 2025. Typical bugs are taking a tenant or user ID from the request body instead of the authenticated token, enforcing rules only in the user interface, and trusting client-side role flags. The confused deputy pattern appears when a service authorises a request against its own broad rights rather than the caller's.

In control catalogues, NIST SP 800-53 Rev. 5 places enforcement under AC-3 (Access Enforcement), separation of duties under AC-5 and least privilege under AC-6. HTTP mirrors the boundary with authentication, although confusingly named: status 401 "Unauthorized" means the request lacks valid authentication, whereas 403 "Forbidden" means the server understood who is asking and refuses (RFC 9110 §15.5.2 and §15.5.4). Authorization always presupposes authentication, but a strong login says nothing about whether a particular request should be allowed.